Ordinary internal work
Public information, your own procedures, selected non-sensitive files, and sample data are good first candidates. We still confirm ownership and access.
Data & access guide
What can we connect?
We decide that with you, one task at a time. A business account, a “no training” setting, or a human checking the answer does not by itself make every file or connection appropriate.
Our starting point: selected information, limited access, drafts for review, and a record of what was enabled.
How we set boundaries
You direct the work.
01
Choose the task.
We write down the job, its sources, its output, and who checks it. A task instruction is not a technical permission limit.
02
Check the accounts.
We review the exact AI plan and each connected service: access, data use, retention, sharing, and the right to use its data. We prefer selected files or narrow access over an entire inbox or drive.
03
Test safely.
We start with public, sample, or properly sanitized information when possible. We confirm what the connection can actually read or change before using live private records.
04
Keep a person in charge.
The initial setup is directed by you. It prepares research, working lists, and drafts; you check the sources and result. Sending, publishing, deleting, paying, changing official records, or making consequential decisions needs explicit approval and a separately defined workflow. Unattended agents are outside this offer.
By type of work
What needs another look.
These are screening rules for our setup, not a declaration that an entire industry is approved or prohibited. We check the actual data, account, provider, and contracts before connecting anything.
Finance, mortgage & insurance
Borrower or customer nonpublic personal information, bank and tax documents, credit reports, and insurance records wait for a review of notices, provider agreements, safeguards, and any lender or data-provider restrictions. A business AI account alone is not clearance.
Healthcare
Patient information stays out of a live setup unless the required business associate agreements, permitted services, security review, and workflow approvals are in place.
Legal, tax & people records
Privileged client matters, tax-preparer files, employee records, and applicant information need review of professional duties, confidentiality, notices, and provider terms. We do not set up automated hiring, lending, or other eligibility decisions in this package.
Real estate & third-party portals
We check the local MLS, brokerage, CRM, and portal rules before connecting an agent or using data. We do not scrape, bypass controls, or assume that a login permits automation.
Who does what
Clear responsibilities.
Your business controls its accounts, chooses the approved information and purposes, confirms its own notices and third-party restrictions, and reviews work before relying on or sending it.
I document the agreed setup, limit and protect the access I use, test the agreed setup, explain its limits, and remove temporary access at handoff. My responsibilities are set out in our written engagement.
The AI and connected-service providers handle information under the plans, terms, and policies that apply to their services. Each connection may have different permissions and retention.
The provider's terms do not replace our agreement or erase either party's legal duties. Human review helps catch mistakes; it does not authorize sharing data with a service. Before live use of regulated information, our written scope identifies the approved sources, any files I may receive, who can access them, and when temporary access or copies end.
Read further
The terms matter.
We check the current terms for the exact plan and feature, including the AI provider, connected email or file service, and any other tool in the workflow. “Not used for training” does not mean no cloud processing or retention. These official pages are starting points, not approval of a particular setup:
- OpenAI business data
- Anthropic commercial privacy
- Google Workspace & Gemini privacy
- Grok enterprise terms
Industry references: CFPB Regulation P · FTC Safeguards Rule · HHS HIPAA cloud guidance · NAR on MLS data rules · ABA AI ethics opinion · EEOC on AI in employment · Florida data-security law. Reviewed October 27, 2026. Terms and rules can change.
This guide explains our approach; it is not a privacy notice for your customers, a legal opinion, or a substitute for a signed service agreement. See what this website collects.
Talk through your work