See how the work is structured
Learn how we assess the process, business case, data security, and quality before development begins.
Explore the methodology →Expert guide
Protecting company data when using LLMs
A practical framework for data classification, access control, provider review, logging, retention, and incident response.
Classify data before choosing a model
Separate public, internal, confidential, personal, financial, medical, and regulated data. Each category needs explicit rules for processing, storage, and access.
- Allowed data
- Prohibited data
- Masking requirements
- Retention period
Minimize what leaves the system
Send only the data required for the task. Remove direct identifiers, secrets, irrelevant document sections, and hidden metadata.
- Data minimization
- Pseudonymization
- Secret scanning
- Field-level filtering
Control providers and access
Review provider terms, data residency, model-training settings, subprocessors, deletion controls, encryption, and audit capabilities. Apply least privilege to both people and services.
- Approved providers
- Role-based access
- Separate environments
- Key rotation
Design for incidents
Logs should show what data was used, which model and prompt version ran, and what action followed. Define procedures for revocation, notification, investigation, and recovery.
- Audit trail
- Incident owner
- Containment
- Recovery test
Choose your next step
Start at the stage that matches your situation
You do not need a detailed brief to begin.
Assess one business process
Determine whether the task calls for AI, rule-based automation, or a process redesign.
Assess a process →Share a defined task
Send the current process, constraints, and expected outcome, and we will suggest a practical first step.
Discuss your project →