Direct answer
Safety is not decided by cloud versus on-premise. It comes down to three things: whose account the data sits under, who can reach it, and whether access leaves a record. The workable approach is to classify material into three tiers — public, internal, restricted — and then set a separate rule for where restricted material lives and how it may be connected: either on-premise, or in the cloud but under a company-owned account, in a private space, with access logging. Putting every document into one shared space with no distinction is the real source of the risk.
Clear up a misconception first
“On-premise is always safe” and “the cloud is never safe” are both false. The real risk is missing access control: documents sitting on an internal server but shared through one link open to the whole company leak just as easily.
Judge the setup against three questions:
- Whose account is the data under? Only a company-owned account — a corporate drive, your own server — keeps it controllable. Under a personal account, the material walks out when the person does.
- Can you see who accessed it? Access records are what make later discovery and accountability possible at all.
- Which external services are connected? When documents are fed to an outside model, is the endpoint one whose data is not used for training, and is there a contract governing it?
Three tiers is the practical number
| Tier | Typical content | Storage and access rules |
|---|---|---|
| Public | Website copy, published pricing, open tutorials | Anything goes; the cloud is the first choice |
| Internal | Procedures and policies, training material, project records | Company-owned account, readable by a defined group |
| Restricted | Customer lists, contracts, cost and floor pricing, personal data | On-premise, or a strictly authorised private space, connected on a minimum-necessary basis |
Classification does not need tooling — one meeting with a checklist gets it done. The real problem in most companies is that classification has never been done at all, so every document ends up moving under the same set of rules.
Three hard rules for restricted material
- Minimum necessary. Feed the smallest set of documents that lets the AI answer the question — not the whole library.
- Revocable. Any single source can be disconnected at any time, rather than being a connection you cannot unwind once it is made.
- Accountable. It is clear who may approve connecting restricted material, and those approvals are kept on file.
If on-premise is out of reach for now
Three low-cost moves come first: open the cloud space under a company-owned account rather than a personal one; keep restricted material outside the scope of AI access for the time being; switch on access logs and review them once a month for anything unusual. Those three alone drop the risk by an order of magnitude.
The exit route people overlook
Classification also has to govern the outbound side: whatever the AI repeats back inside an answer is, by definition, material leaving the building. Restricted documents can be stored perfectly safely and still leak the moment the AI reproduces them verbatim for an outside visitor. So classification has to constrain two things at once — whether the AI may retrieve a document, and whether it may surface it externally.
Key facts
| The three questions | Whose account the data sits under / whether access leaves a record / which external services are connected |
| Classification | Three tiers: public / internal / restricted |
| Three hard rules for the restricted tier | Minimum necessary, revocable, an accountable owner |
| Low-cost starting moves | Company-owned account + restricted material kept out of AI access + access logs switched on and reviewed monthly |
Sources
- Tiering and access conventions from enterprise knowledge base delivery work
- The minimum-necessary and revocable principles when connecting a knowledge base to AI customer service
- Personal information protection requirements (minimum-necessary handling where the restricted tier contains personal data)
Follow-up questions
Is staying off the cloud the safest option?
No. Safety is judged by access control and logging, not by storage location. An internal share link visible to everyone carries no less risk than a company-owned cloud space.
How many tiers should I use?
Three is enough: public, internal, restricted. Schemes with more tiers tend not to survive real-world execution, and end up worse than three.
Does feeding documents to a large model mean leaking them?
It depends on how you connect and what the contract says. An endpoint whose data is not used for training, limited to the minimum necessary documents, revocable at any time — that is a manageable risk. Handing an entire library to any public tool is not.
What if a small business cannot afford a security specialist?
Replace headcount with rules: classify once, route restricted material through a separate approval, review access logs once a month. Those three hold the line without a dedicated person.