The mistakes we see in pilots
None of these require a massive IT department to fix. They require a workspace designed for business use, not consumer chat with extra steps.
The scariest leak we hear about in interviews is not hacking, it is a screenshot of a client ID in a shared chat thread because someone wanted a quick summary.
Seat hygiene matters: disable the user, do not just change the shared password and hope five people notice.
- One shared password for five producers, no audit trail when data leaks
- Pasting full policy or account numbers into free tiers with unclear retention
- Treating model output as final on regulated client communications
- Skipping seat limits when someone leaves the firm
Questions clients actually ask
| Question | Plain answer |
|---|---|
| Who holds API keys? | Your company admin; encrypted per tenant |
| Where do uploads live? | Company workspace scope, not a public model thread |
| Can we disable a user? | Yes, without rotating everyone’s login |
| Do you mark up tokens? | No, provider account bills your provider directly |
Paste these answers into your security questionnaire appendix once, then update quarterly when you rotate keys or add apps.
If a client asks for SOC 2 on day one, be honest about stage. Offer provider account, tenant isolation, and a pilot timeline instead of bluffing.
Roll out in layers
Basic proves one secure workflow. Standard spreads the same boundary to a small team. Elite adds compliance-oriented utilities when legal wants automated checks on generated text.
Elite’s compliance checker is a guardrail, not a lawyer. Keep counsel on anything that binds the company.
Document which apps may touch PHI or PII, even if you think they do not. Future you will forget.
Minimum viable AI policy
One page is enough for most SMBs: approved apps, forbidden consumer chat uses, who holds keys, who approves client text, how to offboard users.
Review the page when you add an industry pack or a new provider key, not annually on a calendar nobody owns.
Counsel can expand later. Operators need clarity this week.
Field notes from recent pilots
The fastest security win we see is disabling departed users the same day, not rotating a shared password five people share.
Clients ask whether models train on uploads. provider account lets you point to provider settings; shared chat answers are mushier.
Pharmacy and medical tenants keep counsel on patient-facing drafts even when Compliance Checker flags ‘low risk.’
Screenshot leaks beat API breaches in SMB incident stories. Policy beats patching alone.
Annual pen tests are rare at this size; quarterly key rotation and seat audits are not.
Further reading
Image credits
- Technology workspace with monitors and notebooks · Photo by Alex Knight on Unsplash
- Business handshake after a policy review meeting · Photo by LinkedIn Sales Solutions on Unsplash
- Colleagues collaborating over laptops in an open office · Photo by Brooke Cagle on Unsplash
- Small business team in a working session at a table · Photo by Campaign Creators on Unsplash
- Developer reviewing data and code on a laptop · Photo by Markus Spiske on Unsplash
- Team brainstorming at a whiteboard in a bright office · Photo by Headway on Unsplash
Illustrations and tutorial mockups are original to EZ4YouTech.com. Stock hero photos use Unsplash or Pexels licenses (see site image attribution records).
Next step
Ready to move from reading to doing? Start with a pilot or talk to our team.