The Friday afternoon that sets your privacy posture

A senior consultant has a board paper due Monday. The client is a listed company. The engagement letter has a confidentiality clause that requires written consent before client information goes to any third-party service. It is four o'clock on Friday, she has workshop notes, last quarter's paper, and about four hours.

So she opens a chat window. Last quarter's paper goes in first, to get the structure. Then the workshop notes, to get a first pass at section three. The output is decent. The paper ships Monday. Nobody finds out, because there is nothing to find out: no incident, no breach, no complaint.

The problem is not that she was reckless. The problem is that the firm's confidentiality position for that client was decided at 4pm on a Friday by whoever happened to be under the most pressure. There is no record of what left the building, no list of which systems now hold a copy, and no answer available if the client ever asks.

That is the actual state of AI privacy at most professional services firms right now. Not a policy. A pile of individual decisions made under deadline, none of them logged.

The standard response is a ban, and bans mostly relocate the behaviour to personal accounts on personal laptops, where you have less visibility than before. The firms that have genuinely closed this gap did not write a stricter policy. They gave people a sanctioned tool whose privacy properties they could answer questions about, which made the unsanctioned route pointless rather than forbidden.

“We don't train on your data” is one answer to eight questions

The phrase has become table stakes. It is also close to costless to say, and it covers exactly one risk: your content ending up in a model's weights and being recited later to a stranger. That risk is real. It is also the least likely thing on your list, and the least likely to be what a client asks about.

Here is the fuller set. Any vendor selling into professional services should be able to answer all eight without going away to check.

Training, by whom. The vendor not training on your content is half the answer. The other half is the contractual position with the LLM provider sitting behind the product. Ask for both, separately.
Retention, at each hop. How long the vendor stores your document is a different question from how long the model provider holds the prompt for abuse monitoring. Both numbers exist. Ask for both.
Human access. Which employees can read the contents of your workspace, under what circumstances (support ticket, debugging, quality review), and whether that access is logged and disclosed to you.
Observability and telemetry. The one nobody volunteers. Most AI products pipe prompts and responses into an LLM observability platform for debugging and quality scoring. If that platform is a third-party SaaS, a complete copy of every document you draft lives in a system that never appeared in the sales conversation.
Sub-processors. The current list, in writing, plus how you find out when it changes. “We use industry standard providers” is not a list.
Residency, storage and inference. Where the data is stored and where it is processed are different answers. A vendor can hold your files in-country and still send every generation request offshore.
Deletion. Whether deleting a document removes it from backups, application logs, and the observability store, and on what timeline. Deletion that only clears the UI is not deletion.
Derived copies. Embeddings and search indexes are copies of your content in another shape, often in another system. They need the same answers as the originals.

The architecture matters more than the policy

Policies are promises about behaviour. Architecture is what stays true when a promise is inconvenient. Two structural facts drive your exposure more than any clause in a DPA.

How much material goes to the model, and how often. A tool that ships your entire source library to the model on every request has a permanently larger footprint than one that assembles a narrow context for the specific section being drafted. Same policy, different amount of confidential material in flight, every single time.

How many systems hold a copy. Every copy is another place that can be breached, misconfigured, subpoenaed, or quietly retained past its stated window. The count is usually higher than the marketing page implies: application database, object storage, observability store, search index, backups, the model provider's retention buffer.

There is a fast way to get at both. Ask the vendor to draw the data path for a single document: boxes and arrows, from upload to finished draft, with every system that touches the content named. If they cannot draw it, either nobody there knows or somebody there would rather not say. It is also the quickest route to the observability store, which never shows up in marketing copy but always shows up on the diagram.

The questionnaire you will have to answer

This stopped being hypothetical. Client security questionnaires now routinely carry an AI section, and it is aimed squarely at you rather than at your vendors. A firm bidding for a state government ICT panel gets asked things in roughly this shape:

List all AI or machine-learning services used in the delivery of the services, including sub-processors.
Confirm that customer data is not used for model training, and identify the contractual basis for that confirmation.
State the retention period for prompts and generated outputs at each processor in the chain.
Describe the controls that prevent your personnel from accessing customer content.
Confirm data residency for both storage and inference.

You cannot answer any of those from a habit of pasting things into a chat window. You can answer all of them from a sanctioned tool with a named sub-processor list, and the answering takes twenty minutes instead of a week of asking around.

There is a second-order effect worth naming. Firms that answer this section crisply are winning on it. A specific, unhedged answer where competitors write “we are developing an AI usage policy” reads as operational maturity, which is exactly what a panel evaluator is scoring. If your bid team is already fighting the time-to-first-draft problem, this is one of the few sections where the answer can be prepared once and reused for years.

Where we stand, and where the line honestly is

We publish the constraints SkyDraft puts on itself as a short numbered protocol, partly so they cannot be quietly relaxed later. Clause 004 is training-set isolation: user content is not used to train any model, not ours, not the LLM provider's, not anyone else's.

Underneath that, the architecture choices that back it up:

Observability runs on our own infrastructure. We use Langfuse for prompt and response tracing, self-hosted, so your content is not routed to a third-party analytics platform in order for us to debug our own product. This is the single most common quiet leak in AI products and it was worth the extra operational work to close.
Content sits in databases we operate, on infrastructure we control, rather than being spread across a collection of managed services with their own retention rules.
A short sub-processor list. The model provider that drafts your content, transactional email, object storage. Pilot workspaces can request the current list by email; the full list publishes with the production policy. The details we can commit to today are on the privacy page.
Per-section context, not whole-corpus dumps. Drafting runs section by section, and each section is assembled from the sources, answers, and prior sections it actually needs. That is a quality decision first, as covered in the how-it-works walkthrough, but it has the useful side effect of keeping the amount of confidential material in flight to what the current step requires.
Export, edit, and delete from inside the app, without raising a support ticket to get your own content back.

Now the honest part. There is a model provider in the path. There is no version of AI drafting where a model produces your document without reading the relevant material, and any vendor implying otherwise is describing something other than what they built. What you actually get to control is which material goes across, for how long it is held, who else keeps a copy, and whether any of it is ever used to improve somebody else's product. Those four are answerable. “Nothing leaves your building” is not, unless you are running the model yourself.

What to keep out anyway

A sanctioned tool changes what is sensible to put in, not whether the question applies. Three things are worth keeping out regardless of how good the vendor answers are.

Personal data the deliverable does not need. A workshop transcript with twelve named participants and their candid views on their own executive team does not need to go in whole. The findings do. Redact at the source stage, where you control it, instead of hoping the draft happens not to quote it.

Anything under a specific client instruction. Some engagement letters name AI services explicitly now. If one of yours does, the answer is a conversation with the client, not an interpretation by whoever is drafting.

Credentials, keys, and raw system exports. These turn up in technical assessment work constantly, usually buried in an appendix of a document someone uploaded as background. They serve no drafting purpose and they are the one category where a copy in an extra system is a genuine incident.

Five questions for your next vendor call

Short version, for the call you have this week. Each of these has a clean answer and a recognisable dodge.

Which model provider, and what is your contractual position on their retention? Dodge: “we use enterprise-grade providers”.
Where do prompts and responses go for your own debugging? Dodge: a pause, followed by an offer to come back to you.
Who on your team can read my documents, and is that access logged? Dodge: “only for support purposes” with no logging answer.
If I delete a document, what still holds a copy tomorrow, and for how long? Dodge: a description of the delete button.
Can you send the current sub-processor list today? Dodge: anything other than a list.

These sit alongside the drafting-quality questions in our guide to evaluating AI document tools. A tool can be perfectly private and still produce output you cannot use, which is a separate test worth running in the same call.

The point of all of this is not paranoia. It is that confidentiality in professional services is a promise your firm made to a client in writing, and right now that promise is being kept or broken by individual people at 4pm on a Friday. Making it a property of the tool instead of a property of everyone having a good day is the whole job.