Security, Privacy and Client Data

If you handle other people's information, you carry responsibility for it. This lesson is general guidance and not legal advice. Follow the rules that apply to your field and region, and ask a professional if you're unsure.

Vendor Checklist

• Training use: is your content used to train models on your plan?
• Retention: how long are inputs and outputs stored, and can you delete them?
• Region: where is the data stored and processed?
• Data processing agreement: does the provider offer one, and does it cover your use?
• Subprocessors: who else touches the data?
• Access controls: single sign-on, roles and audit logs?
• Incident notice: how and when will they tell you about a breach?

What Not To Paste

• Passwords, API keys and recovery codes.
• Full payment card numbers.
• Government ID numbers.
• Health or other regulated information, unless your plan and rules allow it.
• Client financial records, unless you have checked the tool and told the client where it matters.
• Anything under a confidentiality agreement you haven't checked.

Share the Minimum

Remove names and identifiers when the task doesn't need them. Maya's skill refers to 'the business' instead of a client name, so the summary works without identity. Keep a list of which tools can see which kinds of data.

Skills and Connections Are Code Paths

A skill from a stranger can tell an agent to run scripts or fetch web pages. Read every bundled script and every URL before you install it. Use skills only from sources you trust.

If Something Goes Wrong

• Pause the agent.
• Revoke the access it used.
• Write down what data may have been exposed and to whom.
• Tell the people who must be told, following your rules and contracts.
• Fix the cause and add a test for it.

Common Mistakes

• Pasting real client data into a tool you haven't reviewed. Fix: use synthetic data until the checklist passes.
• Never reviewing access. Fix: review quarterly and remove what's unused.
• Assuming a business plan means everything is private. Fix: read the terms for your plan.

Exercise

• List the data your agent touches and who owns it.
• Fill the vendor checklist for each tool from its current documentation and note the date.
• Pass condition: a data list, a checklist per tool with answers and dates, and a 'what not to paste' list for your team.