Client Documents in AI Tools: A Checklist for Agencies
ยท 8 min read
You can put client documents into an AI tool, but only after you know where the text goes, how long it is kept, whether it trains a model, who else processes it, and what your contract with the client allows. Those five answers differ a lot between a personal chat account and a business product built on a commercial API. The checklist below works for any vendor, and the last section shows how Discovery Phase AI answers it.
This is a practical checklist, not legal advice. Your client contract and your own counsel decide what is allowed.
What actually leaves your machine
Before comparing vendors, picture the path a document takes when you upload it:
- Your browser sends the file to the tool's servers.
- The tool may store it: the original file, extracted text, or only what it generates from it.
- The tool sends text to a model provider, which is often a different company from the one whose app you use.
- The model provider may keep inputs and outputs for a period, for abuse monitoring or debugging.
- The result comes back and is saved in the tool, in your project, or nowhere.
Each hop is a place where a copy can live and a party that can read it. A good vendor can tell you, for every hop, whether a copy exists, for how long, and in which country. If the answer is "we are not sure", that is your answer.
It also matters what the documents hold. Discovery material is often more sensitive than it looks: names and contact details of client staff, unreleased plans, pricing, security details of existing systems. Some of that is personal data under laws such as the GDPR, which brings its own rules.
Questions to ask any AI vendor
Use this as a checklist. A vendor should answer each in writing, ideally on a public page.
| Area | Question | A good answer sounds like |
|---|---|---|
| Storage | Are uploaded files stored? Where and for how long? | "Not stored", or a stated period and region |
| Training | Is my content used to train models, theirs or the provider's? | "No, by default", with the source for the provider's terms |
| Model provider | Which model provider processes the text? | A named company, not "trusted partners" |
| Provider retention | How long does the provider keep inputs and outputs? | A number of days, with exceptions listed |
| Sub-processors | Who else handles data (hosting, email, payments)? | A named list with what each receives |
| Location | Where are servers and the database? | A country or region |
| Access | Who inside the vendor can see my content? | A short, specific answer |
| Isolation | How is one customer's data kept from another's? | Server-side checks, not just the interface |
| Deletion | Can I delete projects and my account, and what happens to the data? | A self-service path with clear effects |
| Export | Can I get my content out in a usable format? | Named formats |
| Contracts | Can I sign a data processing agreement? | Yes, with how to request it |
| Assurance | What independent audits or certifications exist? | A specific report, or an honest "none yet" |
The last row deserves honesty both ways. An audit report tells you a third party checked controls; a vendor without one is not automatically unsafe, but you should weigh their written answers more carefully and expect them to be specific.
Retention and training use
These are the two questions clients ask most, and they are often confused.
Training use means your text becomes material that improves a model, which other customers then use. For confidential work you want a clear "no" by default. Policies differ by product tier at the same provider. For example, OpenAI's help centre says it does not train on inputs or outputs from its business products and API by default, while personal ChatGPT accounts have an "Improve the model for everyone" setting that is on unless the user turns it off (OpenAI data controls FAQ). Pasting a client deck into a personal chat account is therefore a different decision from using a business product.
Retention means how long a copy exists, even if it never trains anything. A provider may keep API inputs and outputs for a short period. Anthropic, for instance, states that it deletes API inputs and outputs on its backend within 30 days by default, with exceptions such as a different agreement, enforcing its usage policy, or legal requirements (Anthropic privacy centre). Check the current page on the day you decide; these terms change.
Then ask the same questions of the app on top: does it keep the original files, and does it log the text of your prompts?
Contracts: DPA and sub-processors
If the documents include personal data and you or your client are subject to the GDPR, the AI vendor usually acts as a processor for that data, and Article 28 of the GDPR requires a written contract with it, commonly called a data processing agreement (DPA). It also requires the processor to get your authorisation before using sub-processors and to pass the same obligations down to them.
In practice, check three things:
- Your client contract. Many service agreements restrict which third parties may see client material, or require notice before you use a new one. An AI tool and its model provider both count.
- The vendor's DPA. It should name the sub-processors, the data location, and how international transfers are covered (for example Standard Contractual Clauses).
- The sub-processor list. Hosting, model provider, email and payments are typical. Each should be named, with what it receives.
Controls inside your own team
Most leaks are not caused by a vendor. Set a few rules for your own people:
- Use business accounts, not personal ones, for any client work, so the terms above actually apply.
- Give access by project, not by company. A contractor on one client should not see another client's files.
- Upload only what the task needs. A redacted transcript is often enough; strip bank details and passwords from anything you upload.
- Keep a record of who changed what, so an AI-generated edit can be traced and reversed.
- Tell the client. A line in the proposal saying which AI tools you use, and on what terms, prevents an awkward conversation later.
- Plan the end. Know how you will export the deliverables and delete the workspace when the engagement ends.
How Discovery Phase AI answers these
These answers are taken from our security page and Privacy Policy, which describe what the product does today:
- Files: uploaded decks, documents, transcripts and images are read in memory to draft the project and are not stored. Only the draft you review and save stays, as project content.
- Model provider and training: AI requests go to Anthropic. We do not use your content to train models, and under Anthropic's commercial API terms it does not train on inputs and outputs by default.
- AI behaviour: the model has no tools, cannot browse or change your project, and every suggestion is a proposal you apply or discard. Text from files is marked as untrusted, so instructions hidden in a document are not followed.
- Sub-processors and location: Fly.io hosts the app and database in the United States (Virginia), Anthropic processes AI requests, Resend sends email and Paddle handles payments.
- Isolation and access: each company is its own workspace, scoped on the server. Company Admins see every project; Company Members see only projects they are added to, with write or read access. On the Agency plan each client company stays separate.
- History: every change to a stage is recorded with who made it and whether it came from a person, the AI chat or an update from files, and earlier versions can be restored.
- Retention, export and deletion: AI usage records keep the feature, model and token counts, never the text, for 13 months. Project content exports as PDF, Word, PowerPoint or Markdown, and you can delete your account yourself.
- Contracts: the Privacy Policy says that for project content we act as your processor, and that an organisation that needs a data processing agreement can request one by email.
- Assurance: we do not claim a security certification or an independent audit. The route-by-route review described on the security page was our own.
Plan details, including which features each plan has, are on the pricing page.