AI Data-Safety Checklist for Agencies Handling Lead, Call and Client Data

Key takeaways

• Client data goes only into business tiers. Personal ChatGPT plans train on chats by default, and personal Claude plans can keep data for up to five years if training is on.[1][2]
• Keep one AI context per client, so data never crosses accounts.
• Redact payment, ID and health fields before upload, and get recording consent before a call is transcribed.
• Scope every connector to least privilege and set write actions to need approval. Files and web pages can carry injected instructions.
• Recheck vendor settings every quarter. Terms change, and the setting you checked last spring may not be the default now.

Ten rules, one page. Every agency now puts call transcripts, CRM exports and ad-account data into AI tools. The risk isn't the tool. It's the personal account someone used on a Sunday, the connector with write access nobody scoped, and the transcript recorded without consent.

The checklist below is the one we run. Each rule is explained after it, with the vendor setting or the governing rule behind it.

The one-page checklist

AI data-safety checklist for agencies

• 1. Business tiers only. Client data goes into Claude Team or Enterprise, ChatGPT Business or Enterprise, or an API. Never a personal account.
• 2. One context per client. Each client gets its own thread or project. Data never crosses accounts.
• 3. Redact before upload. Strip payment, government ID, health and credit fields from exports and transcripts.
• 4. Scope connectors. Least privilege on every connector and MCP server. Write actions set to need approval.
• 5. Treat files and pages as untrusted. Restrict network access where a tool can read connected data.
• 6. Check training and retention settings. Per vendor, per seat, and again when terms change.
• 7. Sign a DPA wherever GDPR applies.
• 8. Mask session recordings and get consent where the law requires it.
• 9. Consent before transcripts, and never publish a prospect's words.
• 10. Keep regulated-category data out of shared tools.

Rule 1: business tiers only

The evidence that people ignore this is strong. In a Wakefield Research survey for PagerDuty of 1,250 office workers at $500M+ companies (April 2026), 34% of AI users said they'd entered customer data into public AI tools.[3] Harmonic's browser telemetry across 22.5 million enterprise prompts in 2025 found 579,113 sensitive-data exposures, 16.9% of them through personal free-tier accounts.[4]

The tier decides the defaults:

Tool and tier	Trains on your data by default?	Retention
Claude Team, Enterprise, API	No; explicit feedback is the exception[5]	API inputs and outputs deleted within 30 days, with exceptions[6]
Claude Free, Pro, Max	Your choice[1]	5 years if training is allowed, otherwise 30 days[1]
ChatGPT Business, Enterprise, API	No[7]	Deleted chats removed within 30 days; API up to 30 days, zero retention on eligible endpoints[7]
ChatGPT Free, Plus, Pro	Yes; opt out in Data Controls, new chats only[2]	Temporary Chats kept up to 30 days[8]
Manus Team	Lists a data-training opt-out[9]	No fixed period after account deletion[10]

Check each vendor's current page before you rely on this. Manus's training policy page could not be retrieved, so its lower-plan defaults are unconfirmed.

Two details trip people up. Anthropic keeps inputs flagged for usage-policy violations for up to 2 years and trust-and-safety scores for up to 7.[6] And OpenAI's court-ordered indefinite retention of consumer chats ended on September 26, 2025, though some April to September 2025 data is still held.[11] Old articles still describe that order as current.

Shadow AI also costs money when things go wrong. In IBM's 2025 study of 600 breached organisations, one in five reported a breach due to shadow AI, and high shadow-AI use was associated with a $670,000 higher average breach cost.[12] That's an association among breached firms, not proof of cause.

Rule 2: one context per client

We keep one running AI thread per client, with every meeting transcript for that client in it. It started as a quality rule: per-client context beats topic-based projects, because the model knows everything about one account and nothing about the others. It's also the cleanest separation rule there is. A thread that only ever held one client's data can't leak another client's numbers into a draft.

Never build a "hooks that worked" project from several clients' ads. Rewrite the lesson without names first. How we structure these threads is in how we use Claude for marketing operations.

Rule 3: redact before upload

GDPR's principles are a good rule even where GDPR doesn't apply: collect personal data for a specified purpose, keep it limited to what's necessary, and keep it no longer than necessary.[13] For an AI upload, that means:

• Strip card numbers, bank details, government IDs, health information and credit data before export.
• Drop columns the task doesn't need. A cohort analysis needs dates and amounts, not phone numbers.
• Delete the upload when the task is done.

The share of sensitive data is rising. Cyberhaven found 34.8% of the corporate data employees put into AI tools was sensitive, up from 10.7% two years earlier.[14]

Rule 4: scope connectors and MCP

Connectors are where an AI tool gets reach. Claude's connectors inherit the source system's permissions, and Team and Enterprise owners can set each tool to Always allow, Needs approval or Blocked.[15] Fathom's MCP integration can see only the meetings the user can already view.[16] That's a permission, not client consent to process the recording somewhere else.

Our house rule for write access matches how we run agents: an agent can flag a change, and a person approves it before it's applied. Set every write tool to Needs approval, and connect only the services the task needs.

Rule 5: treat files and pages as untrusted

Anthropic warns that instructions hidden in an external file or website can trick Claude into reading sensitive data from connected sources and sending it out through network requests, and advises restricting network access.[17] Security researchers showed the same pattern in May 2025: a malicious public GitHub issue hijacked an agent using the official GitHub MCP server and leaked private-repository data into a public pull request.[18] That was a demonstration, not a customer breach. It's the reason a web-browsing tool shouldn't hold write access to your CRM.

Rule 6: check training and retention settings, then recheck

Every vendor in the table above has changed its terms in the last 18 months. The FTC has warned AI companies that quietly changing terms to use data for other purposes, without clear notice and consent, risks violating the law.[19] That protects you only if you notice the change. Put a quarterly date on the calendar to check each tool's data page.

Rule 7: GDPR basics for agencies

If you process EU or UK personal data for a client, you're usually a processor, and the AI vendor is your sub-processor. Article 28 requires a binding contract: the processor acts only on documented instructions, keeps data confidential and secure, needs authorisation to use sub-processors, and deletes or returns the data at the end.[20] The official text is on EUR-Lex. Sign the vendor's DPA, and make sure your client contract allows the sub-processor.

The EU AI Act adds dates to track: its prohibitions and AI-literacy duty have applied since February 2, 2025, and its Article 50 transparency rules since August 2, 2026.[21]

Rule 8: mask session recordings

Session-recording tools capture what people type. Microsoft Clarity's default Balanced mode masks numbers and email addresses, and masks inputs and dropdowns in every mode. Clarity requires explicit consent for visitors in the EEA, UK and Switzerland, and Microsoft describes itself as a data controller for it.[22] Keep masking on before you feed recordings to an AI; our Clarity and Claude workflow shows how.

Rule 9: consent before transcripts, and never publish a prospect's words

Consent first. US federal law requires one party's consent to record a call, and about 11 states primarily require all parties' consent.[23] For interstate calls, follow the stricter rule and keep the consent record before the transcript goes anywhere.

Never publish a prospect's words. We don't quote clients or prospects from call recordings by name, in articles, ads or case studies. We paraphrase the objection and strip anything identifying.

Shared links aren't private. Anyone with a ChatGPT shared link can open and forward it.[24] In July 2025, shared chats that users had made discoverable turned up in search results until OpenAI pulled the feature.[25] Never share a chat that holds client data.

Rule 10: keep regulated-category data out of shared tools

Some data shouldn't sit in a general AI workspace at all: health details, credit and financial standing, anything tied to housing or employment decisions. Meta requires US advertisers in financial products and services to use that special ad category, from January 21, 2025, and limits audience selection for employment, housing and financial products.[26] We describe audiences by "financial-fit questions", never by credit, income or ethnicity selectors, and keep that data out of shared tools.

CCPA basics for agencies

CCPA applies to a for-profit business in California that meets any one threshold. The revenue line is $26,625,000 from January 1, 2025, after the CPPA's inflation adjustment; the Attorney General's page still shows the older $25 million.[27][28] The other thresholds are 100,000+ consumers or households, or half of revenue from selling personal information. Consumers can know, delete, opt out, correct and limit use of sensitive data, and the business answers those requests, not its service provider.[28]

New regulations took effect January 1, 2026: risk assessments start now, automated decision-making rules for significant decisions apply from January 1, 2027, and audit certifications phase in from 2028 to 2030.[29] If a client uses AI to score or reject applicants, that's the rule to read.

Recheck quarterly

NIST's AI Risk Management Framework organises the work into four functions: Govern, Map, Measure and Manage, with a separate generative AI profile.[30] For an agency, that reduces to one loop: own the policy, list where data goes, check the settings, fix what drifted.

Write it down once, show the team how, then have them run it while you watch. That's Hormozi's document, demonstrate, duplicate, and it works for a policy as well as a sales script. Few organisations have the basics: only 13% have an AI roadmap, council, genAI policy and ethics policy all in place.[31]

Copy the checklist at the top into your SOPs. If you want us to set it up across your stack, book a strategy call.