Every AI integration starts with a data question, not a feature question. Where does the data go, who keeps it, and what can the AI reach once it’s connected? Get those answers in writing before any AI touches your business data.
We build AI integrations through our AI integration service, so weigh that. Every fact below about Anthropic, OpenAI, OWASP, the AICPA, the GDPR and the CCPA was checked against their own documentation and the regulators’ pages in October 2026.
Short answer: Ask the vendor about training, retention, sub-processors, the processor contract, transfers outside the EU and which audit reports cover your service. Then answer one question yourself: what can the AI read and do inside your systems? Prompt injection has no proven fix, so the real control is the least data and the fewest permissions the job needs.
What the Vendors and Regulators Document
As of October 2026, from vendor documentation, OWASP, the AICPA and regulators:
| Topic | What the source says |
|---|---|
| Anthropic API training | Not used to train models by default |
| Anthropic API retention | Deleted within 30 days, with exceptions |
| Flagged content | Kept up to 2 years |
| Zero data retention | Some API customers, on approval |
| New sub-processors | Notice first, 15 days to object |
| OpenAI API training | Not used unless you opt in |
| OpenAI abuse logs | Kept up to 30 days by default |
| Prompt injection | OWASP LLM01:2025 |
| SOC 2 | A CPA’s examination of controls |
| GDPR processors | Contract required |
| Sub-processing | Prior written authorisation |
Sources: Anthropic on model training, Anthropic retention, Anthropic zero data retention, Anthropic DPA, OpenAI API data controls, OWASP LLM01, AICPA SOC 2 guide, European Commission on the GDPR.
What “AI Integration” Actually Means for Your Data
“AI-powered” tells you nothing about where your data goes. It’s a feature label, not a security promise.
The Difference Between Processing and Training
Processing means using your data to produce a result. Training means using it to improve future models. “We don’t train on your data” doesn’t say how long it’s kept.
Anthropic says it doesn’t use inputs or outputs from its commercial products, including the API, to train models by default (source). It deletes API inputs and outputs within 30 days, unless you use a feature with longer retention such as the Files API, have agreed otherwise, or the content is flagged under its Usage Policy (source). OpenAI says API data isn’t used to train its models unless you opt in, but abuse monitoring logs, which can contain prompts and responses, are kept for up to 30 days by default (source).
Consumer plans differ. On Claude’s consumer plans, chats are used to improve the models if the user allows it (source). Check which product your integration calls.
Hidden Data Flows in Existing Tools
The riskiest integrations are often the ones nobody chose: the “AI summary” in your CRM, smart replies in your email platform. Each is a new data flow, usually with a new sub-processor. If a tool runs on Claude, Anthropic says the platform’s own terms govern, not Anthropic’s (source). When a tool adds AI features, read its updated terms and sub-processor list before leaving them on.
The Five Real Security Risks SMBs Face
Third-Party Data Exposure
Every AI vendor you connect has its own model provider, hosting and support tools. Two hops out from your CRM, you may have no contract with the company holding your records. Know the chain, and choose links that publish their terms.
Prompt Injection and Data Leakage
Prompt injection is the first entry in the OWASP Top 10 for LLM Applications 2025. OWASP describes indirect injection, where instructions hidden in content the model reads, such as a website or a file, change what it does (source). If your integration reads support tickets, form submissions or order notes, a crafted message could steer it.
OWASP says it’s unclear whether fool-proof prevention exists. Its mitigations include least-privilege access, human approval for high-risk actions and keeping untrusted content separate (source). It also warns that system prompt rules on what data the model may return can be bypassed by prompt injection (source). The boundary is the data and tools you connect, not the instructions.
Exposure Through Conversation History
Chat tools keep history. On Anthropic’s business plans, chats are kept in the product, and a deleted chat leaves back-end storage within 30 days (source). If staff paste customer data into chats, anyone who gets into that account can read it. Protect AI accounts like email: strong authentication, no shared logins, clear rules on what may be pasted. Keep API keys out of chats and repositories.
Unreviewed Sub-Processors
Every AI vendor uses sub-processors: cloud hosting, model providers, logging, support. Under the GDPR, a processor can’t appoint another processor without the controller’s prior, specific or general written authorisation (source).
Anthropic’s DPA, for example, says it gives reasonable notice before a new sub-processor gets access to customer personal data, and customers can object in writing within 15 days (source). Ask each vendor for its list. If they won’t share one, that is your answer.
GDPR and CCPA Regulatory Exposure
The GDPR applies to companies outside the EU that offer goods or services to people in the EU or monitor their behaviour (source). If personal data leaves the EEA, you need a transfer tool such as an adequacy decision, standard contractual clauses or binding corporate rules (source). The Commission issued modernised SCCs on 4 June 2021 (source).
The CCPA applies to for-profit businesses doing business in California that meet one of its thresholds, such as gross annual revenue of $26.625 million or more, or buying, selling or sharing the personal information of 100,000 or more California residents or households. It also puts separate obligations on service providers and contractors (source). “The vendor is compliant” isn’t enough: compliant with what, covering which flows?
How to Evaluate an AI Vendor Before Integration
The Contract Questions That Actually Matter
Before signing, get written answers to these:
- Is data from this integration used to train your models? If not by default, what turns it on, such as feedback buttons?
- How long are inputs, outputs and logs kept, and can retention be reduced?
- Who are your sub-processors, and how are changes notified?
- Where is data processed and stored, and which transfer mechanism covers each hop?
- Is a Data Processing Agreement in place, and does it cover our data subjects?
- Which audit reports cover the exact service we’ll use?
If a vendor stalls or points you to a generic privacy page, treat that as a red flag.
Certifications That Matter vs. Certifications That Don’t
SOC 2 is often quoted as proof of security. The AICPA describes it as an examination of a service organisation’s controls relevant to security, availability, processing integrity, confidentiality or privacy (source). It isn’t a promise about how your data is used. Training and retention live in the terms and the DPA.
A SOC 3 covers the same areas in less detail (source), so ask for the SOC 2 report itself.
ISO standards show up too. Anthropic, for example, lists ISO 27001:2022 for information security management and ISO/IEC 42001:2023 for AI management systems, alongside SOC 2 Type I and Type II (source). Read the scope. A certificate covers what it says, nothing more.
What to Check in AI Vendor Terms of Service
Language to watch for:
- “We may use your content to improve our services”, which can mean training
- A broad licence to your data with no limit on purpose
- Sub-processors that can change without notice or a right to object
- Retention periods longer than your own obligations require
- Feedback or logging features that keep data longer than the default
You accepted the terms, buried clauses included.
Data Minimization and Least Privilege in Practice
What Data Does This Integration Actually Need?
Integrations often get scoped for speed: a key with full account access, when the job needed recent order history.
Map the minimum data the job needs and enforce it in code and API scopes. OWASP says to limit access to sensitive data by least privilege and restrict the model’s data sources (source). Under Anthropic’s zero data retention, prompts and responses aren’t stored at rest after the API response is returned, it’s enabled per organisation, and some features aren’t covered (source).
Scoping Permissions and Auditing Access Points
List everything connected to your systems, including tools trialled and never removed. Every live connection is a data flow. Narrow it or revoke it.
If your custom WordPress development or CRM is getting AI features from a developer or plugin vendor, ask for a list of every third-party API call the implementation makes. If they can’t produce one, the work isn’t finished.
Related Posts
- AI tool data privacy: where data goes in a SaaS tool vs a custom build
- AI automation input validation: checking what reaches the model
- AI automation audit trail: what to log and where to keep it
- What your AI integration contract should say: ownership, code and data terms
Frequently Asked Questions
Does my AI vendor’s SOC 2 report mean my data is protected?
Not on its own. SOC 2 is a CPA’s examination of a vendor’s controls. It doesn’t set whether your data is used for training or how long it’s kept. Read the report, then check the terms and DPA.
If an AI tool is GDPR-compliant, can I use it with EU customer data?
Only after you check for a processor contract, a transfer mechanism such as SCCs for data leaving the EEA, and a sub-processor list with a right to object. “GDPR-compliant” is a claim. Those documents are the evidence.
What is a Data Processing Agreement and do I need one with every AI vendor?
It’s the contract setting what a vendor may do with personal data it processes for you. Under the GDPR, a processor’s duties must be set out in a binding contract or legal act. Elsewhere, get legal advice.
Can AI tools use my business data to train their models?
It depends on the product and plan. Anthropic and OpenAI both say API data isn’t used for training by default. Consumer plans and SaaS tools can differ. Get it in writing.
What’s the minimum I should check before connecting an AI tool to my CRM or website?
Training, retention, sub-processors, and a DPA in place before data flows. Then limit what the tool can read and do. For a second opinion, see how we work at designodin.com/ai.
What happens if a vendor I’ve already integrated changes their data policy?
Track each vendor’s sub-processor and policy updates, and review their terms at least yearly. If a change doesn’t fit your obligations, use your objection or exit rights while you still can.