Can AI be used safely with company data?
Yes, if the task, data sources, rights, logs, and approvals are clarified before productive use. An AI application does not receive blanket company access.
Security
AI with clear boundaries.
When AI accesses business data and systems, permissions and responsibility need to be clear. We define data flows, approvals and operating responsibilities with your IT team before implementation.
Why it's different
System access needs defined permissions.
It reads documents, checks data, looks for context, prepares answers, or creates records in systems. That raises data protection, security, and regulatory questions, including GDPR and the EU AI Act. These points need to be clarified before the pilot.
- Which sources can it read?
- Which actions can it prepare?
- When does a human have to take over?
| Access | Permission |
|---|---|
| Invoices in the inbox | Read |
| Purchase orders in the ERP | Read |
| Posting proposal | Prepare |
| Deviation above tolerance | Human decides |
| Trigger payment | No access |
Log
- 09:14Invoice read
- 09:14Matched with purchase order
- 09:15Deviation handed to accounting
Short answer
AI and data protection need architecture, auditing and clear boundaries.
We design access, logging and human approvals around the actual task. The operating environment and model providers are selected with your IT team, including EU cloud or local options. Our underlying privacy architecture has been reviewed by legal partner DORDA. Project-specific GDPR and EU AI Act questions can be reviewed with DORDA separately.
How are privacy requirements handled?
We design the setup so data protection is clarified before productive use: purpose, data, roles, rights, logs, approvals, and responsibility. The specific classification depends on the process.
Does thirdmind take the EU AI Act into account?
Yes. In the project, we examine which role, risk classification and transparency obligations may be relevant for the specific AI system. We clarify open points with DORDA.
What prevents uncontrolled AI actions?
Limited rights, human-in-the-loop, escalation rules and audit logs. Critical steps are prepared or handed over to people instead of going through automatically.
At a glance
- Hosting
- Agreed architecture
- LLM training
- Agreed provider terms
- Logs
- Audit per case
- Rights
- Per system
- Handover
- Human-in-the-Loop
- Regulatory
- GDPR, EU AI Act
Seven principles
This is how we plan security into every setup.
Clear task instead of open access
An AI application does not receive general company access. It gets a task: check invoices, prepare tickets, compare master data. Everything else remains outside the scope.
Roles and rights
Rights are defined for each AI application: read, write and approval rights, system limits, data types and escalation points. The goal is limited agency, not blanket autonomy.
Human-in-the-Loop
People stay in the process where responsibility lies. If a case is uncertain, outside the rules, or needs a decision, it is referred.
Audit logs
Logs show which case was processed, which data was used, which decision was prepared and when it was handed over to a human.
Document hosting and data flows
We define processing locations, model providers and how data may be used. EU hosting alone does not settle every data flow. Retention, training use and contractual requirements are checked for the selected services.
Write permissions only with limits
An AI application can prepare actions or carry them out within clear limits. The rights it receives depend on the process, risk, and approval model.
On-premise is not an exclusion
Not every company works only in cloud systems. AI applications can also be planned for environments where databases or specialist systems are on-premise.
Before the pilot
We clarify these questions for every pilot.
Pre-pilot checklist
- What task does the AI application take on?
- What data sources does it need?
- Which systems are connected?
- What rights does it get?
- Which actions may it only prepare?
- Which cases are escalated?
- Which logs are needed?
- Who is responsible on the business side?
- Which GDPR, EU AI Act or IT requirements apply?
Our stance
No blanket guarantee. But clear responsibility.
We do not treat GDPR as a blanket seal because every setup depends on purpose, data, roles, and process. What we do: plan security as architecture, document boundaries and responsibilities, and obtain project-related legal advice on GDPR or EU AI Act questions where needed.
A legally reviewed base architecture as the starting point.
Project-related clarification on GDPR and EU AI Act questions.
Technical limits, logs and human approvals in the setup.
Frequently asked questions
Security answered honestly.
Where is our data processed?
That depends on the agreed architecture. We clarify which data is processed in which system and by which model provider before implementation. EU cloud and local setups are assessed with your IT team.
Who approves critical actions?
We define approval points with the process owner. The application may only act within agreed permissions and hands exceptions to the responsible person.
Can we operate the solution ourselves or switch providers?
You receive the custom code and agreed documentation and access. Your IT team or another provider can take over, subject to the required technical skills and third-party licences. We agree the handover and responsibilities.
Does an architecture review cover every project?
A reviewed underlying architecture provides a starting point. Each project still needs its own assessment of purpose, data, access and responsibilities. Legal questions can be reviewed with DORDA.
Discuss security
Discuss data flows and responsibilities with us.
Tell us about the workflow and systems involved. We will discuss a useful next step together.