Corporate data security with AI: where does your data go?

Month-end is close and the management meeting needs a margin analysis. Someone in accounting or sales exports the sales, cost and stock report from the ERP to Excel, uploads the file to a general-purpose AI chat tool and says, "summarise this and find the trend." The answer arrives in ten minutes. The intent is good and the result is useful. But that file holds prices, costs, customer lists and possibly financial statements, and it now sits somewhere outside the company's own systems.

This article does not say you should stop using AI. Quite the opposite: the real question is whether your company knows which data goes to which tool, under which account and with which settings.

Same tool, different account type, different rules

The data policies of general-purpose chat tools differ by account type. According to OpenAI's published policy, conversations on personal (consumer) ChatGPT accounts may be used to improve its models unless the user opts out, using data controls or the privacy portal. On the business side, data in ChatGPT Enterprise, Business and the API platform is not used for model training by default.

Anthropic draws a similar line. Under the update it announced in 2025, users of consumer plans such as Claude Free, Pro and Max choose whether their data may be used to improve models; for those who allow it, retention extends to five years, and for those who do not it stays at 30 days. Claude for Work (Team and Enterprise), Claude for Government, Claude for Education and API use are outside that change, and for commercial products inputs and outputs are not used for model training by default.

These policies can change over time; what is written here reflects the source pages below as of the date this article was prepared. The common takeaway is that the same tool behaves differently depending on whether an employee uses a personal account or a company account. If the company does not know which, it does not know which rules the data falls under.

This is not only theoretical

The most cited example is Samsung's. According to Forbes and Business Today, both drawing on a Bloomberg report, a Samsung engineer uploaded internal source code to ChatGPT in spring 2023, and the company then issued a memo temporarily restricting the use of generative AI tools. The stated concern was that data sent to chat tools is stored on external servers and is hard to retrieve or delete. Details such as how much data was involved are not clear in public sources, so we report only the core that both outlets confirm.

Surveys show a similar picture. Microsoft and LinkedIn's 2024 Work Trend Index, based on 31,000 people in 31 countries, reports that 78% of AI users are bringing their own AI tools to work. In Cisco's 2024 Data Privacy Benchmark Study of 2,600 privacy and security professionals, 48% of respondents said they had entered non-public company information into generative AI tools, and 27% of organisations had banned such tools for the time being. These are self-reported results from different samples, but they point the same way: usage spreads faster than management's line of sight.

How OWASP frames it

OWASP's 2025 Top 10 for Large Language Model Applications lists "LLM02: Sensitive Information Disclosure" as a risk of its own. Its recommended measures include data sanitisation so that user data does not enter training, letting users opt out of having their data used in training, keeping retention and deletion policies clear, and giving users guidance on avoiding the input of sensitive information. In other words, the advice is not prohibition but information, settings and discipline.

The legal side: personal data and trade secrets

A customer list often contains personal data. Article 9 of Turkey's Personal Data Protection Law No. 6698 (KVKK) was rewritten on 1 June 2024 (Law No. 7499, Article 34). Under the current regime, personal data may be transferred abroad if the Board has issued an adequacy decision for the country, sector or international organisation. Without one, an appropriate safeguard such as a standard contract, binding corporate rules or a Board-approved undertaking is needed. Without a safeguard, only narrow exceptions apply; the authority says they must be read narrowly, covering only incidental, irregular and rare transfers. The authority's page states that the Board has not yet made any adequacy determination; check the page for the current position.

Whether a chat tool processes your data outside Turkey depends on the provider and the account type; not every use is automatically a transfer abroad, but you cannot answer the question without knowing. On trade secrets, Article 55(1)(d) of Turkish Commercial Code No. 6102 lists the unlawful disclosure of production and business secrets as one of the forms of unfair competition. This is not legal advice; for the outcome in your own situation, ask your legal counsel. In both areas the practical question is the same: can you show where the data went?

The way out: don't move the data, work where it is

The export, upload and paste-back loop is the source of both the risk and the effort. A sturdier model brings AI to where the data already lives: AI that reads the ERP directly through an authorised connection, works within the company's own user permissions and needs no manual file moving.

iyibir's products work this way and are integrated with Logo Edge and Logo ERP. iyibir Mind produces reports and dashboards from your Logo data, so you no longer export to Excel and upload to a tool for a management report. iyibir Copilot carries out ERP work with AI help, such as preparing quotes, reconciliation, and creating customer and item records.

We cover how iyibir works with Logo Edge, and the migration path, on a separate page. Logo Edge page

To be honest, integration alone is not security. A data processing agreement that states which data is processed for what purpose, permissions that define who can access what, and the AI provider's terms still matter. The difference is that these are defined once and can be audited, whereas uploading a file depends on an individual decision every time. iyibir's own terms are published on a public page.

To see the terms under which data is processed on the iyibir side: Data processing agreement

A short checklist for your company

• Take inventory: which AI tools are used in the company, with which account types (personal or corporate)? Asking employees beats guessing.
• Write down data classes: which data must never be uploaded to a general-purpose tool? For example customer lists, price and cost tables, financial statements, personnel and payroll data.
• Check account types and settings: the training option, retention period and chat history settings differ between personal and corporate accounts; who can change them?
• Prepare a written AI usage policy: permitted tools, forbidden data classes, an approval process. One page is enough, but make sure everyone reads it.
• Inform employees: the goal is not to prohibit, but to show the consequence of well-meant sharing.
• Where possible, prefer tools that read data in place and respect permissions; this removes most of the need to move files.
• For uses involving personal data, find out the provider's data processing terms and the country where the data is processed; ask your legal counsel if needed.

Closing: don't move the data, work where it is

The benefit of AI is real, and employees' wish to use it is reasonable. A company's job is not to block that wish but to open a path where the data stays inside a controlled setup. Very often the plainest way is to bring the tool to the data rather than the data to the tool.

To see reports and dashboards from your Logo data with AI, without moving files: iyibir Mind

To carry out ERP work (quotes, reconciliation, customer and item records) with AI help: iyibir Copilot

Sources

1. OpenAI: How your data is used to improve model performance
2. OpenAI: Business data privacy, security, and compliance
3. Anthropic: Updates to Consumer Terms and Privacy Policy
4. Anthropic Privacy Center: Is my data used for model training? (ticari ürünler)
5. Bitdefender: Anthropic Shifts Privacy Stance, Lets Users Share Data for AI Training
6. OWASP Top 10 for LLM Applications 2025: LLM02 Sensitive Information Disclosure
7. KVKK: Yurt Dışına Aktarım (6698 sayılı Kanun m. 9, 1 Haziran 2024 değişikliği)
8. Resmî Gazete, 12 Mart 2024, sayı 32487: 7499 sayılı Kanun, m. 34 (KVKK m. 9'un yeniden düzenlenmesi)
9. 6102 sayılı Türk Ticaret Kanunu, m. 55/1-d (mevzuat.gov.tr)
10. Erdem & Erdem: Ticari Sırların Korunması
11. Forbes: Samsung Bans ChatGPT Among Employees After Sensitive Code Leak (2 Mayıs 2023, Bloomberg haberine dayanır)
12. Business Today: Samsung bans the use of ChatGPT, Google Bard, Bing chatbot and other AI tools (2 Mayıs 2023)
13. Microsoft ve LinkedIn: 2024 Work Trend Index on the state of AI at work
14. Cisco: 2024 Data Privacy Benchmark Study