Where does your data go when an AI agent works for you?
Entrusting a task to an AI agent means entrusting it with information. This guide follows the path of your data, piece by piece, tells you how it works at ABYS without embellishment, and gives you the GDPR reflexes and questions to ask any service provider before opening your files to them.
- An agent keeps what you entrust to it: needs, files, received emails, conversation.
- The processed text goes to a model provider, often outside the European Union.
- GDPR requires a legal basis, the least data possible, and supervised subcontractors.
- Only entrust an agent with what its task needs.
- Ask the same questions to any service provider, in writing.
An AI agent does not invent its work: it reads your documents, your emails, your customer tables. This information therefore leaves your computer. The useful question is not "is it safe?", to which no one can answer yes or no, but "where does it go, who processes it, and what am I accepting knowingly?". Here is the path, step by step, then what the law requires of you.
IWhat an AI agent reads and keeps
To work, an agent needs material. It therefore keeps a record of what you give it, otherwise you would have to give it everything again each time. At ABYS, the following are stored in the database: the description of the need, your answers to its questions, attached files and the text extracted from them, emails the agent receives, the log of its passages and the conversation with it.
Take a real estate agency that attaches its list of property owners to prepare follow-ups. This list, with names, phone numbers and addresses, is now with the service provider. It's neither good nor bad in itself. It's a fact to know before clicking "attach".
IIThe path of your data, piece by piece
- 1You entrust
You describe the task and attach documents. Everything is recorded in the service provider's database, with the text extracted from the files, so the agent can find it each time.
- 2The model processes
To write or analyze, the agent sends the text to be processed to an AI model provider. At ABYS, this is by default Anthropic, an American company. Images, on the other hand, are generated by Google.
- 3The agent sends
Emails go through a sending service. With us, it is Brevo, a French service provider. Responses received by the agent are stored with the rest.
- 4Payment is processed separately
The subscription is paid via Stripe. We store no payment card data: it remains with the payment provider.
- 5Consumption is counted
The consumption log records meters and costs, not the content of your requests.
In other words, three actors see part of your content pass through: the agent service provider, the AI model supplier and the email sending service. Any serious service provider must be able to provide you with this list.
IIIWhat is protected, and how?
Not all data has the same level of protection, and you should be wary of blanket statements. At ABYS, access keys and login passwords are encrypted. The content of documents is not presented as encrypted: I prefer to tell you clearly rather than leave it to assumption.
If this output bothers you, know that an alternative exists: with us, a European provider, Mistral, can be plugged in instead of the default provider. Ask the same question to any other service provider.
IVGDPR in practice for an SME using an agent
As soon as the agent handles names, emails or phone numbers of individuals, GDPR applies. You remain responsible for the processing: you decide why and how this data is used. Five points are enough to cover the essentials.
Check what applies to you: the list remembers your answers on this device.
Maintaining a record of processing is part of GDPR obligations, including for a small business that regularly processes customer data. The CNIL offers a simplified template. For each use, you note what you process, why, for how long and with which service providers.
VWhat you should never entrust to an agent
Some data has no place in a prospecting or follow-up agent: social security numbers, health information, identity documents, complete banking details, disciplinary files. If the task does not require it, do not attach them. A medical practice or law firm must also consider its professional confidentiality before any delegation.
VIQuestions to ask any AI service provider
These questions apply to ABYS as much as to any other tool. Ask them in writing and keep the answers: they also help you fill in your register.
Check what applies to you: the list remembers your answers on this device.
A real estate agency attaches its list of property owners to its ABYS agent, with names, phone numbers and addresses. What becomes of this list?
?Questions we're asked
Does ChatGPT keep my business data?
This depends on the version used and its settings, which evolve. Read the terms of service you use, particularly what concerns the retention of conversations and their use to improve models. For an agent going through a service provider, ask the provider: they are the one who chooses the provider and access conditions.
Is an AI agent compliant with GDPR?
A tool is not compliant on its own: it is the use you make of it that is or is not. You must have a legal basis, limit the data transmitted, supervise your subcontractors, verify transfers outside the European Union and be able to respond to requests from individuals. The service provider must give you the information to do so.
Can you give a customer file to an AI?
Yes, if you have a legal basis for using this data for this purpose and if you transmit only what is necessary. Remove unnecessary columns before attaching the file. Also verify what providers will process this data and where they are established, so you can inform your customers if needed.
Is there a European AI for businesses?
Yes, Mistral is a French AI model provider, with its assistant Le Chat. Some service providers allow you to use it instead of an American provider. At ABYS, Mistral can be plugged in. Still verify the complete path of your data, as other services (email sending, images) may be involved.
Before creating an agent, list what it really needs to read for its task, and attach only that.
Create My AgentRead more next
AI Audit of your company: where to start, in one hour
No need to hire a consultant to know where AI can help you. One hour, one sheet and your tasks for the week are enough.…
Read the lessonWhat documents to give an AI agent, and which to keep
An AI agent works from what you give it. This guide tells you which documents really help it, in what form…
Read the lessonHave the final say on an AI agent: validate, then delegate
An AI agent prepares the work, you decide what goes out. You'll know at the end how to review their first sends, what signs…
Read the lesson