Risk & safety
The Three Tiers of AI Privacy
"Cloud AI" is three different things - match each kind of data to the lowest tier of tool that still protects it.
Free or standard web tools: the everyday ChatGPT, Claude, or Gemini. Your inputs may be logged or used to train the model. Treat anything you type here as if you posted it publicly.
A commercial API or business tier with a contract: a DPA plus a no-training, zero-retention term. Where most real business work belongs - if the contract is genuinely in place.
Open models on hardware you own. Data never crosses a network boundary - no third party, no cross-border transfer. The safest tier, and the simplest for GDPR.
The jump from Tier 1 to Tier 2 - consumer web tool to contracted commercial one - is the difference between a data breach and a compliant workflow. And a contract is the start of compliance, not the finish: for personal data you also need a valid EU-US transfer mechanism, not a DPA alone.
When to use When you need to place a kind of data in the right tier of tool - before anything sensitive goes near a chatbot.
Read the full post →