Security and data use

Who this guide is for

Users and administrators deciding what to upload and who may access it.

Before you begin

• Identify the task and data types in the document: internal information, personal information or content requiring restricted access.
• Check your organization’s decision on using this data in an AI tool and identify the access owner. Prepare an anonymized sample for the first trial.

Work through the task

1. Limit the document to the task. Remove unnecessary identity, contact and account information; renaming the file alone does not anonymize it.
2. Compare data, intended users and retention needs with current agreements and security documents. Refer open questions about subprocessors and processing locations to the organizational owner.
3. Check the company and workspace. Limit document access to the people needed for the task and assess any external-sharing requirement separately.
4. Check upload and access using sample data. When working with a real document, treat outputs as potentially sensitive too and store them in an approved organizational location.
5. Reassess access and retention when work ends. Describe original documents, generated outputs and other relevant records in any deletion request, and confirm completion through the organizational process.

Example

Check your result

• Necessary data and users are identified; the organizational usage decision and open security questions are recorded.
• Access, retention and end-of-work ownership are clear for both the document and generated output.

If something goes wrong

• If unexpected document access appears, stop the task without probing other documents. Record the time, account and general event description for support.
• If the wrong file was uploaded, do not expand sharing; inform the document owner and organizational contact. Agree on removal and the scope of related outputs.
• A file disappearing from a list does not prove deletion of all derivatives and backups. Request confirmation of the deletion scope and completion.

What still needs confirmation

Complete security assessment using current organizational documents; this guide is not a certification, an absolute isolation guarantee or a commitment to a particular processing location.