Most business owners we speak to are not worried about whether AI works. They are worried about where their customers' names, addresses, orders and notes end up once a piece of software can read them. That is a reasonable worry, and it has a practical answer: ask the supplier the right questions, and get the answers in writing.
You do not need to be technical to do this. The questions below are plain, and a supplier who handles data properly will be able to answer every one of them clearly. If you are still deciding whether AI is worth looking at at all, start with our plain guide to AI for small businesses.
The seven questions that matter
1. Is my data used to train AI models?
This is usually the first worry, and the answer is more reassuring than many people expect. When software uses one of the major AI providers through their business API, the provider's terms generally say that customer data is not used to train their models by default. That is different from the free consumer chat apps, where the defaults can be different.
Two things to check. First, which AI services does the supplier actually use, and under which terms? Second, does the supplier itself use your data to train or improve its own models? Ask for both answers in writing, not just a reassuring sentence on a call.
2. Is my data sold or shared?
Your customer data should be used to provide the service you are paying for, and nothing else. Ask directly whether any of it is sold, shared with partners, used for advertising or pooled with other customers' data for "insights". Then ask for the list of sub-processors: the other companies, such as hosting and email providers, that touch your data on the supplier's behalf.
3. Where is it stored, and who can see it?
Ask which country your data is stored in, and if any of it leaves the UK, what safeguards cover that transfer. Then ask who inside the supplier can see it, under what circumstances, and whether that access is logged. "Only the people who need to, for support, with a record kept" is a good answer. "Our team" is not.
4. Is access read-only when connecting to my existing systems?
Many of the most useful tools work by joining up systems you already have: your accounts package, your booking tool, your shop. When they do, ask whether the connection is read-only. Read-only means the new tool can look but cannot change or delete anything in your original systems, so a fault or a mistake cannot damage your records. If the supplier needs write access for a particular feature, they should be able to explain exactly what it writes and why.
5. Can I export everything at any time?
Not just a summary, and not only when you leave. You should be able to download all of your records, in a format such as CSV that other software can read, whenever you like, without having to ask permission or pay a fee. Data you cannot get out is data you do not fully control.
6. Will you sign a data processing agreement?
If a supplier handles personal data on your behalf, UK GDPR expects a written contract between you covering what they may do with it. This is the data processing agreement, often shortened to DPA. It sets out the purpose, the security measures, the sub-processors and what happens at the end. A supplier who is unfamiliar with the term, or reluctant to sign one, is telling you something important.
7. What happens to my data if I leave?
Ask how you get your data out, how long the supplier keeps it afterwards, and how they confirm it has been deleted. The answers should be specific: a time period, a method and a written confirmation. Getting this agreed at the start is far easier than negotiating it at the end.
A good supplier answers these questions in a sentence or two each, and is happy to put those sentences in the contract.
Red flags in vague answers
Most suppliers will not say anything alarming. The warning signs are usually in what they avoid saying:
- "We take security very seriously." Everyone says this. It answers none of the questions above.
- "It is all in our terms." Perhaps, but ask them to point to the clause. If they cannot find it, neither will you.
- "We may use data to improve our services." Ask what that means in practice. It can cover anything from fixing bugs to training models on your records.
- "Export is available on request." Ask what format, how long it takes and whether there is a charge.
- No named sub-processors. If they cannot tell you who hosts your data, they either do not know or would rather you did not.
- Hesitation over a DPA. This should be routine. Reluctance suggests the data side has not been thought through.
- Full write access by default. A tool that only needs to read your systems should not ask for permission to change them.
A checklist to copy into an email
Paste this into an email to any supplier you are considering. A clear reply to each line is a good sign. A reply that answers none of them directly is useful information too.
Before we go ahead, could you confirm the following in writing?
1. Is any of our data used to train AI models, by you or by any AI provider you use? Which providers, and under which terms?
2. Is any of our data sold, shared or used for any purpose other than providing the service? Who are your sub-processors?
3. Which country is our data stored in, and who on your side can access it?
4. When you connect to our existing systems, is access read-only? If not, what do you write and why?
5. Can we export all of our data, in a standard format, at any time and at no extra cost?
6. Will you sign a data processing agreement before any of our data is transferred?
7. If we leave, how do we get our data back, and when and how will you delete your copy?
How we answer these questions
Since we build CRMs, dashboards and AI-powered tools ourselves, including our own CRM, Jeanus, here are our answers:
- Training: we never train AI models on client data.
- Selling or sharing: we never sell or share client data.
- Connections: where we join up your existing systems, the connections are read-only.
- Separation: each client has their own private workspace.
- Export: you can export all of your data at any time.
- Agreement: we sign a data processing agreement with you before any data moves.
If you would like to know how any of that works in practice, ask us. We would rather you asked us the same questions you would ask anyone else. For a wider look at what a CRM does and whether you need one, see what a CRM is and whether a small business needs one.
Common questions
Do AI providers train their models on my business data?
Under their business and API terms, the major AI providers generally do not use customer data to train their models by default. Terms differ between providers and between consumer and business products, and they can change, so ask your software supplier to confirm in writing which AI services they use and on what terms.
What is a data processing agreement?
It is a contract between you and a supplier that handles personal data on your behalf. Under UK GDPR it sets out what the supplier may do with the data, how it is kept secure, which sub-processors are involved, and what happens to the data when the contract ends. A supplier handling your customer data should be willing to sign one.
What does read-only access mean when connecting systems?
It means the new software can look at data in your existing systems, such as your accounts package or booking tool, but cannot change or delete anything there. It is a sensible default when joining systems up, because a mistake or fault in the new tool cannot damage your original records.
What should happen to my data if I stop using a supplier?
You should be able to export all of it in a usable format, such as CSV, before you leave. After that, the supplier should delete or return it within an agreed period and confirm when that has been done. Ask for this to be written into the contract before you start.
If you are weighing up a new system and want to see how your data could be joined up safely, have a look at how we bring your systems into one view, or ask for a free concept and we will show you what it could look like before you commit to anything.
