- It can be, if the vendor follows your existing permissions, keeps your data apart, and never uses it for training.
- Ask eight questions before you connect anything. Vague answers are a warning sign.
- The most important one: will each person only get answers from what they can already open?
- Approving the connection is a short task for whoever manages your Microsoft 365 or Google Workspace.
Connecting your company's email and files to an AI tool is a reasonable thing to be cautious about. Your mailboxes hold contracts, pay discussions, customer complaints and personal details. Before you connect anything, you should know exactly what happens to them.
The good news is that the right questions are simple, and a trustworthy vendor will answer them plainly.
Eight data security questions to ask any AI vendor
1. Will each person only get answers from what they can already open?
This is the most important question. If a junior employee cannot open the board's folder in Microsoft 365 today, the AI tool must not answer them from it tomorrow.
A good answer: "Yes. We follow the permissions you already have, for every document, and we keep up as they change."
2. Is our data used to train AI models?
Your records should be used to answer your own team's questions, and nothing else.
A good answer: "No. Never." Ask whether that also applies to the AI services the vendor uses behind the scenes, and how long those services keep data.
3. Is our data kept apart from other companies?
A good answer: "Yes, at every level, from storage to search." Your records should never be mixed with another customer's.
4. Is it encrypted?
A good answer: "Yes, when stored and while it moves between systems." Ask whether the keys that let the vendor read your mailboxes are protected separately.
5. Can the vendor's own staff read our data?
There are sometimes good reasons for support staff to look, such as fixing a problem you reported. The question is who decides.
A good answer: "Only with your permission, for a limited time, and every view is recorded."
6. Can managers read employees' questions?
Staff will only use a tool they trust. If they suspect their manager can read every question they ask, they will not ask.
A good answer: "No. Managers see topics and trends, never individual conversations."
7. What happens when someone leaves?
A good answer: "When you close their work account, their access is removed automatically." Nobody should have to remember to do it.
8. What happens to our data if we stop?
A good answer: "It is deleted, as set out in your contract." Ask for the contract wording, and how long backups are kept.
What approving the connection involves
For most companies, this is less work than people expect. Whoever manages your Microsoft 365 or Google Workspace, whether that is your IT team, an outside IT contractor or an office manager, approves the connection in their admin centre. It takes minutes. There are no servers to install and no software on anyone's computer.
How AskNeil answers
| Question | AskNeil |
|---|---|
| Only what each person can open? | Yes. The check happens before Neil looks for an answer. |
| Used for training? | No. |
| Kept apart from other companies? | Yes, at every level. |
| Encrypted? | Yes, stored and moving. Connection keys are encrypted a second time. |
| Staff access? | Only if your admin allows it, for a set period, with every view recorded and visible to your admin. |
| Managers reading questions? | No. Topics and trends only. |
| Leavers? | Access removed automatically, usually within the hour. |
| Leaving AskNeil? | Your data is deleted, as set out in your contract. |
In short
Connecting Microsoft 365 or Google Workspace to an AI tool can be safe, if the vendor follows your existing permissions, keeps your data apart and never trains on it. Ask the eight questions above. Plain answers are a good sign. Vague ones are not.