What Data Is Sent to the AI
Exactly which data from your business is included in AI prompts, what is never sent, how we minimise data exposure, and how prompt data is handled.
The Minimal Data Principle
AskBiz sends the minimum data necessary to answer your question. We do not batch-send your entire dataset to the AI on every query. Instead, our data retrieval layer identifies the specific subset of data needed and sends only that.
For example:
- 'What's my best-selling product this month?' → sends product sales summary for the current month only
- 'Why did revenue drop last Tuesday?' → sends daily revenue data for the past 2 weeks and Tuesday's anomaly details
- 'What's my landed cost on this shipment?' → sends the specific shipment record and no other data
What Is Always Sent
Every AI prompt includes:
- Your question — exactly as you typed it
- Business context — your sector, home currency, business type, and connected source types (e.g. 'Shopify + QuickBooks connected'). No actual data from these sources is included here — just the metadata.
- Retrieved data excerpt — the specific data needed to answer the question, formatted as structured text
What Is Never Sent
The following is never included in AI prompts:
- Your full historical dataset
- Customer names or email addresses (these are hashed in our system — we store anonymised identifiers, not originals)
- OAuth tokens or API credentials for connected platforms
- Your password or authentication data
- Payment card details or full billing information
- Other users' data
- Your API keys
- Contents of previous conversations (each query is independent — there is no cross-session context sent to the AI)
Data Handling at Anthropic
Data sent to Anthropic via the API is:
- Transient — processed to generate the response and not retained
- Not used for training — Anthropic's API terms prohibit using API calls to train models
- Encrypted in transit — all API communication uses TLS 1.3
- Subject to Anthropic's DPA — we have a data processing agreement with Anthropic covering GDPR obligations
Anthropicis based in San Francisco, California. Data transferred to their API from EU/UK users is governed by Standard Contractual Clauses (SCCs). The transfer is transient — data is not stored at rest in the US.