AI and privacy: what to check
What to look into before you let AI work with information about your customers and staff.
When AI gets to work with your email, invoices or documents, it also gets access to information about people. So it matters where that information ends up and who can see it.
This article is not legal advice, just general guidance in plain words.
Where is the data stored
Ask which country your data is stored and processed in. Iceland and the EU share the same data protection rules, usually called GDPR. They set out how information about people may be handled. If data leaves that area, it should be clear how it is protected.
At AkurAI, data is hosted inside the EU today, and our goal is to host it in Iceland.
Is it used for training
Training an AI means letting it learn from text so that it gets better. Some tools use what their users type for this. That means your information could end up as part of a system other people use. Ask directly whether your data is used for training, and get the answer in writing.
Our rule is clear: customer data is never used to train AI models.
Data processing agreement
If another company handles personal data on your behalf, you need a data processing agreement. It states what may be done with the data, how it is protected and what happens to it when you stop working together. AkurAI signs one with its customers. If a vendor does not offer one, that is a bad sign.
Only the access it needs
An assistant that sorts your email does not need access to payroll. A well-built system gets the access the job requires and nothing more. That way, less is at stake if something goes wrong.
Logged and reviewed
Everything the AI does should be logged, so you can see afterwards what happened and why. Where mistakes are costly, such as replies to customers or bookkeeping, a person should review the work before anything is sent or posted.
Questions to ask any AI vendor
- Which country is my data stored and processed in?
- Is my data used to train AI models?
- Will you sign a data processing agreement with me?
- What access does the system get, and can I limit it?
- Is everything the system does logged, and can I see the log?
- Does a person review the work before anything is sent or posted?
- What happens to my data if I stop, and do I get it back?
If the answers are vague, that tells you something too.
If you want to go through these points with us, get in touch.