Yes, a service business can use AI on customer, pricing and financial data safely, but the safety comes from setup, not from the brand of AI. Use a business plan that does not train on your data, sort what data may go in, give every connected AI its own narrow login, and make a person approve anything that sends, pays or changes a record.
Is it safe to put business data into AI tools?
It depends on three things: which plan you are on, what you paste or connect, and what the AI is allowed to do with it. Most of the scary stories come from the first one. Someone in the office signs up for a free account with a personal email, pastes in a customer list or a margin sheet, and nobody checks the data settings. On many consumer plans that conversation can be used to improve the vendor's models unless the user turns a switch off.
The second risk is the one owners rarely think about: AI that is connected to your field service software, CRM or accounting system. A chat window only sees what you paste. A connected agent can read every job, every invoice and every customer record its login can reach, and if it has write access, it can change them. That is where real damage happens, and it is solved with permissions, approvals and logs rather than with a privacy policy.
The page 1 results for this topic are written for enterprise security teams. This guide is for an owner or office manager at a 5 to 50 truck company who wants a straight answer and a list they can tape to the wall.
Which AI tools are safe for business data?
As of November 2026, every major assistant has a business tier that does not train on your data by default, and a consumer tier where training is on by default or depends on a setting. Here is what each vendor's own data page says. Plans and wording change, so check the linked page before you decide.
| Assistant and plan | Used to train models by default? | What the vendor says |
|---|---|---|
| ChatGPT Free, Plus, Pro (personal workspace) | Yes, unless you turn it off | OpenAI's help center says data sharing is enabled by default on personal plans. Turn off Settings, Data Controls, "Improve the model for everyone." |
| ChatGPT Business, Enterprise, Edu and the API | No | OpenAI's enterprise privacy page says it does not train on business data by default. |
| Microsoft Copilot with a personal Microsoft account | Yes in most countries, unless you opt out | Microsoft's Copilot privacy FAQ says signed-in consumers can opt out of model training. Opting out does not stop limited human review for safety. |
| Microsoft Copilot Chat with a work (Entra ID) account | No | Covered by Microsoft's Data Protection Addendum, logged in your own tenant, and Microsoft says prompts and responses are not used to train foundation models. Look for the green shield. |
| Claude Free, Pro, Max | Only if the model improvement setting is on | Anthropic says consumer chats are used for training when you allow it. With the setting on, chats can be kept de-identified for up to 5 years. |
| Claude Team, Enterprise and the API | No | Anthropic says it will not use inputs or outputs from commercial products for training by default. |
| Gemini app with a personal Google account | Yes, while Keep Activity is on | Google says a subset of chats are reviewed by people and kept up to three years. With Keep Activity off, chats are still kept 72 hours. |
| Gemini in Google Workspace (qualifying business edition) | No | Google says Workspace does not use customer data to train models without permission, and work content is not human reviewed. |
Three details matter as much as the training default:
- Not trained is not the same as not stored. Business plans still keep your chats so you can come back to them, and admins can often read them. Microsoft, for example, logs Copilot Chat prompts and responses in your tenant for audit and eDiscovery.
- Feedback buttons are an exception. Anthropic keeps thumbs up and down feedback for up to 5 years, and Google keeps submitted Gemini feedback for up to three years. Tell staff not to rate chats that contain customer data.
- The account type decides it, not the app. The same Copilot or Gemini app behaves differently depending on whether the person is signed in with a work account or a personal one. A personal login on a work laptop puts you back on consumer terms.
The practical rule: pay for the business tier of whichever assistant your team already likes, sign everyone in with company accounts, and block or discourage personal accounts for work. That one step closes most of the gap.
How do you use AI with sensitive business data?
Sort the data before you pick tools. The Federal Trade Commission's guide to protecting personal information starts with two steps that fit AI well: know what personal information you have, and keep only what you need. For a service business, that sort usually lands in three groups, which our Three-Bin Data Sort walks through in detail:
- Low risk: price book descriptions, marketing copy, public reviews, scheduling rules. Any approved business-tier tool can use it.
- Customer and job data: names, addresses, phone numbers, job notes, estimates, invoice amounts. This can go to cloud AI under business terms, or to a hybrid setup, with narrow access and a log.
- Money and identity data: bank and card numbers, Social Security numbers, payroll, passwords and API keys. Keep it out of chat windows entirely, and only let AI near it on systems you control.
Then practice data minimization. If the question is "write a follow-up for this unsold estimate," the AI needs the job type, the price and the customer's first name. It does not need the full customer history, the card on file or your margin. Send the fields the task needs and nothing else. When you build an agent, the same rule applies to what it is allowed to read, not just what it is allowed to say.
What controls does AI need when it connects to your business software?
Once an AI can log in to ServiceTitan, Jobber, QuickBooks or your CRM, the question changes from privacy to permissions. The OWASP project, which publishes the standard list of risks for AI applications, calls this "excessive agency": an agent with more functions, more access or more autonomy than its job needs. Its fixes are the same controls a careful office manager would ask for anyway.
Its own login for every system
Never run an agent on the owner's login or a shared admin account. Give it a dedicated user, API app or token in each system, created by an account that will not leave the company. If the agent misbehaves, you switch off one login and nothing else breaks, and every change it makes is labeled as the agent's change in the system's own history.
Least-privilege scopes: AI agent permissions
Grant the narrowest scope the job needs. A daily report agent needs read access to jobs and invoices, not write access to customers. A follow-up drafter needs to read estimates and create drafts, not send. OWASP gives the same example: an agent that reads email should not be able to delete it. Our Permission Ladder puts each task on one of four rungs (read, draft, fixed-wording sends, and money or promises that always stay with a person) so you decide permissions task by task.
A person approves writes and sends
Anything that goes to a customer, moves money or changes a record should wait for a named person's yes. Approval only works if the approver checks the draft against the real record instead of clicking through, which is what the Real Yes Rule is for. This also protects you from prompt injection, where text hidden in an email or web form tries to give the AI new instructions. An agent that can only draft cannot be talked into sending.
Logs you can read
Keep a log of what the agent read, what it drafted, who approved it and what it changed. Use the business software's audit trail where it exists, and keep the agent's own log alongside it. If a customer asks why they got a message, you should be able to answer in a minute.
Key rotation and offboarding
API keys and tokens are passwords. Store them in a password manager or secrets store, never in a spreadsheet or chat. Put a rotation date on the calendar, rotate immediately when someone who had access leaves, and delete keys for agents you no longer run.
Vendor agreements
Before customer data flows to any AI vendor or integrator, get their data processing agreement (often called a DPA), their list of subprocessors, and a clear answer on training and retention. Microsoft, for example, puts Copilot under its published Data Protection Addendum with Microsoft acting as a processor. If a vendor cannot tell you where your data goes, that is your answer.
Secure AI for business checklist (printable)
Print this and check each line before an AI tool touches customer, pricing or financial data.
- Pick one approved assistant and pay for its business tier (ChatGPT Business or Enterprise, Copilot with work accounts, Claude Team or Enterprise, or Gemini in Workspace).
- Sign every employee in with a company account. No personal AI accounts for work data.
- Confirm the training setting on the vendor's own data page, and note the date you checked.
- Write a one-page rule on what never goes into AI: card and bank numbers, Social Security numbers, passwords, API keys, payroll.
- Sort your data into low risk, customer and job data, and money and identity data.
- Tell staff not to submit feedback ratings on chats that contain customer data.
- For each connected agent, create its own login or API app in every system it touches.
- Grant read-only access first. Add write access one task at a time, only when needed.
- Require a named person to approve every customer message, payment and record change.
- Send the agent only the fields its task needs.
- Turn on logging: what was read, drafted, approved and changed, and by whom.
- Store keys in a password manager, set a rotation date, and rotate when anyone with access leaves.
- Collect a DPA and subprocessor list from every AI vendor and integrator.
- Review the logs and the access list once a month, and remove anything unused.
- Decide which data, if any, must stay on systems you control, and plan private or hybrid AI for that data only.
When should you choose private, local or hybrid AI?
For most small service companies, business-tier cloud AI with the controls above is secure enough for customer and job data, and it is cheaper and easier to run. Private AI is worth it in a narrower set of cases:
- A customer contract, insurer or regulation says certain data cannot go to a third-party AI service.
- You run the same job on sensitive records every night (payroll exceptions, bank reconciliation, account notes) and want that data to stay on hardware you control.
- You want to keep running if a cloud vendor changes its terms, prices or models.
The trade-off is real. A model on your own machine needs someone to update it, secure it and watch it, and small local models are weaker at hard reasoning. Our guide to self-hosted AI for business covers the hardware and upkeep honestly. Many businesses land on hybrid: routine, sensitive work runs locally, harder work goes to a cloud model under business terms, and a router decides which is which. Read more on our private AI page.
One warning: hosting does not make AI safe by itself. A local model with an admin login and no approval step is more dangerous than a cloud model with read-only access and a person on every send. The controls travel with you whichever way you host it.
Where Cortex fits
Cortex builds AI agents inside the software service businesses already use, such as ServiceTitan, Jobber, Housecall Pro, QuickBooks, Tekmetric and GoHighLevel. Each agent has one job, its own login with the least permission that job needs, and a log, and a person approves anything that sends, pays or changes a record. When some data should stay on systems you control, we build that part private or hybrid. Our trust page lays out those standards.
You may not need us. If your team only needs a chat assistant for writing and research, buying the business tier of one tool and following the checklist above is enough. If you want AI working inside your field service and accounting software, start with the Free AI Operations Audit. We map where AI would help, which data each job needs, and what permissions it should have before anything is built.
