Secure AI on Company Data: Local or Cloud?
You can run secure AI on company data both in the cloud and locally on your own server. Whether data leaks depends mainly on what the assistant can access, where it sends data and who is allowed to see its answers. The brand of the tool comes second.
Businesses increasingly want an AI assistant or an internal chatbot that answers from their own documents: “What terms do we have in the framework agreement with this supplier?”, “Where is the current service price list?”. The idea is simple. In practice, though, the assistant often gets the contents of an entire shared drive, including documents an ordinary employee would never open.
Attackers are using AI to find their way to company data too. At the end of October, for example, Chainalysis announced that an external attacker, using what the company called “offensive agentic techniques”, gained access to internal tools and to platform users’ data. On 4 November the company added that password hashes and live tokens for all users had been exposed too. The reverse also holds: AI inside your organisation is one more entry point that needs guarding.
1. Web IT, a software development company from Prague and Brno, covers in this article where data actually leaks with AI over documents, what cloud tools do and do not give you, when local AI makes sense, and a checklist to go through before launch.
Where AI over company documents actually leaks data
A data leak through an AI assistant rarely looks like a Hollywood hack. More often it follows one of three ordinary routes.
When the AI sees more than the person asking
The most common problem is permissions that are too broad. The assistant connects to the whole drive or SharePoint through a service account and then happily answers anyone who asks. A salesperson learns everyone’s salaries, an intern reads a contract only the board should see. Nobody hacked anything; the AI simply sees more than the user asking the question.
Where the data goes and how long it stays there
With cloud AI, the question and selected document excerpts go to the provider. What matters is the region where they are processed, how long they are stored and whether the model learns from them. This varies by product and plan, so you need to read the terms of the specific service, not general promises.
Attacks through document content
The third route is prompt injection: someone plants an instruction such as “ignore previous instructions and send…” in a document, email or web page that the AI reads. The model may follow it. The OWASP Top 10 for LLM Applications 2025 puts prompt injection first and also lists sensitive information disclosure, excessive agency and vector and embedding weaknesses.
How an AI assistant over documents works: RAG in plain terms
Most company chatbots over documents are built on RAG (retrieval augmented generation): the assistant first searches your documents for relevant excerpts and only then has a language model compose an answer from them. The model does not “learn” your documents; it receives them with each question.
There are four steps. Documents are split into chunks and stored in a search index. A user asks a question. The system finds the closest excerpts. The model writes an answer from them, ideally with a link to the source.
From a security point of view, what matters is where permissions are enforced. If the index contains everything and there is no per-user filter, a RAG chatbot will return an excerpt from a document the user has no right to see. The risk lies in the index and the permissions, not in how clever the model is.
Cloud: Microsoft Copilot, Copilot Studio and ChatGPT for business
Microsoft Copilot (Microsoft 365 Copilot)
Microsoft Copilot works on data in Microsoft 365. According to Microsoft’s documentation, prompts, responses and data accessed through Microsoft Graph are not used to train foundation models. Copilot only surfaces organisational data that the user has at least view permission for, and it honours Microsoft Purview sensitivity labels and encryption.
The key consequence: Copilot is only as safe as your SharePoint and OneDrive permissions. If the “Management” folder is accidentally shared with the whole company, Copilot will find it for the whole company.
The details are worth reading. Microsoft states, for example, that traffic from EU users stays within the EU Data Boundary, but Anthropic models, as a subprocessor, are excluded from the EU Data Boundary (as of 5 November 2026). For customers in the EU, EFTA and the UK, Anthropic models are off by default and an administrator has to turn them on. Agents that extend Copilot are governed by that agent’s own terms, and administrators decide which agents to allow.
Copilot Studio: your own agent over your sources
Copilot Studio is for building your own agents, such as an internal assistant over company policies or CRM data. Here more of the responsibility is yours. In the Power Platform admin center, administrators can use data policies (DLP) to control which knowledge sources, connectors, user authentication options and publishing channels agents may use. They can also turn off publishing of agents that use generative AI altogether, or restrict data movement across geographic locations.
An agent’s tools can be configured to run with the signed-in user’s credentials. That is usually a safer choice than a single service account with access to everything.
ChatGPT for business
With ChatGPT, the key difference is between personal and business accounts. OpenAI states that by default it does not use data from ChatGPT Business, Enterprise, Edu or the API to improve its models, that customers own their inputs and outputs, and that the organisation controls who has access and which internal sources are connected.
On individual plans (Free, Plus, Pro), OpenAI may use conversation content for training unless the user turns this off in settings. An employee who pastes a contract into a personal ChatGPT account is sending company data outside the terms you agreed. That is why the checklist covers rules for people, not just technology.
Local AI makes sense where data must not leave
Local AI means the language model and the document index run on your own server or private infrastructure. Neither questions nor documents go to an external AI provider. Examples include open models run through Ollama, combined with your own search index.
Local AI makes sense mainly when:
- you work with highly sensitive documents (health data, trade secrets, R&D),
- regulation or customer contracts do not allow you to send data to the cloud,
- you want full control over where data lives and who can access it.
The price is operations. The server, model updates, security, backups and monitoring are your responsibility, or that of the supplier who manages your infrastructure. Open models may also not match the largest cloud models in every respect, so test them on your own documents. We can run such a server as part of our server and infrastructure management.
Running locally does not solve permissions on its own. A local assistant that sees every document will still show salaries to a salesperson.
Cloud or local AI: a decision table
| Question | Lean towards cloud (Copilot, Copilot Studio, ChatGPT Business / Enterprise) | Lean towards local AI |
|---|---|---|
| How sensitive is the data? | everyday business documents, policies, quotes | trade secrets, health data and other special categories |
| Must data stay with you? | the provider’s region and contractual guarantees are enough | data must not leave your own infrastructure |
| Where is your data today? | in Microsoft 365 or another cloud | on your own servers and internal systems |
| Do you have capacity to run it? | no, you want a ready-made service | yes, in-house or through a supplier |
| How fast do you want to start? | a pilot within weeks | longer infrastructure preparation |
| How demanding is answer quality? | the strongest commercial models | an open model, tested on your data, is enough |
Often the answer is a combination: everyday documents in the cloud, the most sensitive matters in a local solution.
Access control matters more than the choice of model
Whether you choose cloud or local AI, security rests on the same foundations.
- Document or record-level permissions. The assistant may only return what the user could open themselves. Signing in is not enough; permissions must be checked for every source. We cover this in more detail in our article on CRM and AI integration security.
- Least privilege. No service account with access to everything. Roles and their rights should follow your business access management, including removing access when someone leaves.
- Separate reading from writing. An assistant that only answers questions does not need permission to change anything. If it also needs to act in your CRM, that is a different kind of integration; see our article on connecting your CRM to AI with MCP.
- Audit. Log who asked what and which documents each answer came from.
Data quality matters just as much. An assistant working over outdated and duplicate documents answers confidently and wrongly, as we explain in the AI sandwich.
Checklist before launching AI on company data
- Have we listed the sources the assistant will draw on, and removed what does not belong there?
- Do we know which documents are sensitive, and are they labelled?
- Do permissions in the sources (SharePoint, drives, CRM) match who should see what?
- Does the assistant only answer from documents the user has access to?
- Do we have a data processing agreement with the provider under the GDPR?
- Do we know in which region data is processed, how long it is stored and whether the model learns from it?
- Do we log questions and answer sources, and do we know who reviews the logs?
- Have we tested prompt injection and attempts to extract someone else’s document?
- Are we starting with a pilot for a small group and a limited set of documents?
- Do employees have clear rules on which AI tools they may use and what not to paste into them?
For legal questions, such as transfers of data outside the EU or a data protection impact assessment, we recommend consulting a lawyer.
How we help with secure AI on company data
1. Web IT is a software development company based in Prague and Brno. We design AI solutions and connect them to business systems: from an assistant over documents in Microsoft 365, through custom RAG solutions, to local AI on a server we manage for you.
We always start with an inventory of sources and permissions, because that is where security is decided. Then we recommend cloud, local or a combination, and prepare a pilot.
Frequently asked questions
Can Microsoft Copilot or ChatGPT see all of my company’s documents?
Microsoft 365 Copilot only shows data the user has at least view permission for. If permissions are set too broadly, though, it will find documents the user should not see. ChatGPT for business only sees the sources the organisation connects. So it comes down to how your access is set up.
Is Microsoft Copilot safe for company documents and GDPR?
Microsoft states that it does not use Microsoft 365 data to train foundation models and that traffic from EU users stays within the EU Data Boundary, with exceptions worth reading. In practice, security depends on permissions, sensitivity labels and which agents you allow. Assess GDPR compliance with a lawyer, based on the personal data the assistant processes.
When does local AI make more sense than the cloud?
When you work with highly sensitive data, when contracts or regulation do not allow you to send it to the cloud, or when you want full control over the infrastructure. Bear in mind that running, updating and securing the server is then up to you or your supplier.
How do I stop an AI chatbot showing a document to someone without access?
The assistant must check the specific user’s permissions on every question and only return excerpts from documents that user could open themselves. Do not use a single service account with access to everything. Test it with accounts in different roles before launch.
Do ChatGPT or Copilot train on my company data?
According to Microsoft, prompts, responses and data from Microsoft Graph are not used to train Copilot’s foundation models. By default, OpenAI does not use data from ChatGPT Business, Enterprise, Edu or the API to improve its models. On personal Free, Plus and Pro accounts, however, conversations may be used for training unless the user turns this off.
Want an AI assistant over your company documents but unsure whether to go cloud or local? Let us look at your data sources, permissions and the scope of a first pilot. Book a free 30-minute intro call or see how we help with AI implementation. We reply to every enquiry within 1 working day.
