Is it safe to connect company data to ChatGPT or Claude? A checklist for Saudi businesses

Last verified: 17 October 2026

Short answer

It can be safe, if you decide three things before you connect: what the connector may do (start with reading only), whose permissions it uses, and where a record of every action is kept. Anthropic and OpenAI both warn that a connected tool can change data and that hidden instructions in content are a real risk, so connect only sources you trust and read what the assistant asks to do. If the data includes personal data about customers or staff, Saudi rules on sending personal data outside the Kingdom may apply, and you should not assume that Claude or ChatGPT process anything inside Saudi Arabia.

The checklist

Ten checks, in the order we would do them. Each one links to the reasoning below.

Know what leaves your systems. Your question, any file you attach and whatever the connector fetches all go to the AI provider.
Use business plans, not personal accounts. Training and retention rules differ by plan, and so does who controls connectors.
Start read-only. Turn on each kind of change later, one at a time, after you have watched it work.
Use a person's permissions, not one shared key. The assistant should be able to do only what the signed-in person can do.
Require approval for changes. Anything that touches money, stock, prices or customers waits for a named person.
Assume hidden instructions can arrive. Emails, files and reviews can carry text meant to steer the assistant.
Keep a record you control. Know who asked, which system, what changed, and how long the log is kept.
Leave out personal data the question does not need. Totals by branch do not need customer names.
Trust the connector's source. Prefer the software maker's own connector, and vet anything else.
Check the Saudi rules and ask where data is processed. Do not assume it stays in the Kingdom.

What the AI provider sees

When you ask a question, three things reach the AI provider: your message, any file you attach, and whatever the connector fetches from your system to answer it. The connector uses the signed-in person's permissions, so it should not return anything that person could not already open. Anthropic's help centre says Claude takes on each person's permissions in the connected service. The exception is a custom connector built on a shared credential, which reaches whatever that credential can reach.

Once the data is in the conversation, it is held under the provider's terms, not your system's. Shopify's help centre says this plainly: after you authorise sharing, the selected data leaves the Shopify environment and is governed by the AI provider's terms and privacy policy. The connector is also a second place the data passes through. If a third party runs it, they handle that traffic too.

One detail for Claude Team and Enterprise. If someone clicks thumbs up or down, Anthropic stores the whole conversation for up to 5 years and may use it for training. Raw connector content is excluded unless it was pasted into the chat. Owners can switch feedback off under Organization settings > Data and Privacy.

Training and retention, by plan

Use a business plan for company data. Claude accepts custom connectors on every plan, including Free (one connector), so a staff member can connect a company system to a personal account on their own. That is why the plan matters.

Plan	Used to train models?	Retention and where to check
Claude Team, Enterprise and API	Not by default. Feedback you submit, or data you choose to allow, can be used.	Chats are kept until deleted. Deleted chats leave back-end storage within 30 days. API inputs and outputs are deleted within 30 days, with exceptions such as legal requirements. See Anthropic's training and retention pages.
Claude Free, Pro and Max	Your choice. A model-improvement setting controls it, and turning it off stops future training use.	If you allow it, data may be kept in de-identified form for up to 5 years. Deleted chats leave back-end storage within 30 days. See Anthropic's consumer retention page.
ChatGPT Business, Enterprise, Edu and API	Not by default.	Qualifying organisations can set how long OpenAI retains business data, including zero data retention on the API platform. See OpenAI's business data page.
ChatGPT Free, Plus and Pro (personal workspace)	Data sharing is on by default, and you can opt out.	Switch off "Improve the model for everyone" under Data Controls in your settings. It applies to new conversations only. See OpenAI's help article.

Plans and menu names change. Check the live page before you rely on a row.

The setting that matters next is who can add connectors. On Claude Team and Enterprise, Owners add connectors for the organisation, and each person then signs in individually. On ChatGPT Business, only admins and owners can create and publish custom connectors. On Enterprise and Edu, admins can also let chosen members create them. Pro can connect custom servers for read and fetch only.

Start read-only

Reading and changing need different rules. A wrong answer wastes an afternoon. A wrong change can go live in every branch. Begin with read access only, run it for a few weeks, and turn on each kind of change only when you have a reason and a named person to approve it.

Claude: on Team and Enterprise, Owners can set each connector tool to Always allow, Needs approval or Blocked, so a connector can read but not write. See Anthropic's connector article.
Business Central: out of the box, agents can only discover and read data the signed-in user has permission to use. An admin must switch on create, modify, delete or actions for each API object. See Microsoft's configuration page.
Shopify: when you install the connector you approve a data access level. Some access is read-only and some includes write access. To lower it later, you uninstall and install again. See Shopify's authorisation page.
Your own database: create a database login that can only read, and point it at views rather than raw tables.

How these switches work in practice is covered in AI that asks before it changes anything.

Use a person's permissions, not one shared key

The safest set-up is the one where the assistant can do only what the signed-in person can do. Business Central works this way: every operation runs under the user's own identity, so its audit trail shows who acted. NetSuite goes further. Its AI connector does not support Administrator roles, and queries respect the permissions of the role that signed in. See Oracle's FAQ.

A shared API key is the opposite. Everyone who uses it gets the same access, and the log shows one name. Shopify tells owners not to create their own API token for an AI tool and to use its official integration instead. OWASP's guidance for AI applications calls the principle least privilege: give the model the minimum access its job needs.

Approval before any change

A good rule: the assistant may propose a change, but a named person confirms it before it runs. The built-in prompts help, with limits.

Claude shows tool approval requests. The "Allow always" option removes that check for a tool, and in research mode connector tools can run without further approval, so Anthropic advises switching write tools off there. See Anthropic's custom connector article.
ChatGPT may ask for confirmation, depending on the app's permissions and the action. OpenAI says some especially risky actions may be blocked instead of offered for approval. On Enterprise and Edu, admins can switch individual actions on or off after publishing, and new actions from an updated server start switched off. See OpenAI's help article.

These prompts ask the person using the assistant. If your rule is that a manager approves price changes, check that the tool can route the request to the manager.

Hidden instructions (prompt injection), in plain words

An assistant reads text, and text can carry instructions. OpenAI describes prompt injection as a form of social engineering aimed at AI: harmful instructions hidden in ordinary content such as a web page, a document or an email, meant to trick the assistant into doing something you did not ask for. For example, a supplier's PDF, a customer review or an order note could contain a line telling the assistant to send a customer list to an outside address. OpenAI's own example is an assistant asked to answer overnight emails that ends up sharing bank statements. Anthropic warns that malicious connector servers can carry hidden instructions too.

Nobody has a complete fix. OWASP says it is unclear whether fool-proof prevention exists, and OpenAI expects the problem to keep evolving. What limits the damage is what you already decided: narrow permissions, read-only access and approval before changes. Read-only is not enough alone, because a tricked assistant can still read something and put it in an answer. Keep sensitive data out of reach of any role that does not need it.

Keep an audit log you control

An audit log says who asked for what, in which system, what changed and when. Chat history is not that record, because people can delete their chats. On Claude, a deleted chat leaves the history at once and back-end storage within 30 days. What vendors keep varies:

NetSuite: the Execution Log on each integration record shows the request time, duration, status, user email, response code, method and URL path. It is kept for 21 days in production and 7 days in sandbox.
Claude: audit logs are for Enterprise organisations only. An export covers the past 180 days and lists events such as sign-ins and changes to projects and files. Chat content is not in it. Enterprise can also pull activity, chats and files through the Compliance API. That page does not mention connector tool calls, so ask what your plan records.
ChatGPT: for Enterprise and Edu, the Compliance API includes conversations that use apps.
Business Central: operations run as the signed-in user, so the trail names a person.

Ask how long each log is kept and whether you can export it to a place you control. A 21-day log cannot answer a question about last quarter.

Mask or leave out personal data

Most business questions do not need names. "Sales by branch last week" needs totals, not a customer list. Send the assistant the least data that answers the question.

Expose reports or views that leave out phone numbers, national ID or iqama numbers, bank details and home addresses.
Use order or customer numbers instead of names when a question is about patterns.
Give staff roles that cannot reach salary or HR records unless their job needs them.

Saudi guidance points the same way. SDAIA's PDPL FAQ says the personal data an organisation collects should be limited to the minimum needed for the stated purpose.

Vendor connector or build your own?

A connector from the software's own maker usually carries the vendor's access rules. NetSuite, Business Central and Shopify document how theirs follow user permissions. The cost is that each one covers a single system.

Anything else, whether you build it or a third party runs it, starts unverified. Anthropic says it has not verified custom connectors and that server developers can change tool behaviour without notice. OpenAI freezes a connector's tool list when an admin approves it, and says you are responsible for vetting any custom or third-party connector. Before you use one, ask:

Who runs it, and who can see the traffic that passes through?
What does it log, and for how long?
Can it be limited to reading only?
How are changes to it announced to you?
Where is it hosted?

The wider options are in How to connect your company data to Claude, ChatGPT and Copilot.

Saudi Arabia: personal data and sending it abroad

This is general information, not legal advice. Check with your legal adviser before you connect personal data to a service hosted abroad.

SDAIA's FAQ says the Personal Data Protection Law (PDPL) covers the processing of personal data relating to Saudi citizens and residents by any party outside the Kingdom (Article 2).
SDAIA's Regulation on Personal Data Transfer Outside the Kingdom sets the rules for sending personal data to a party abroad. In outline: transfers to countries or bodies on a list SDAIA publishes as offering adequate protection, and, in the cases the regulation lists, transfers backed by appropriate safeguards such as standard contractual clauses, binding common rules or an accreditation certificate. A risk assessment is required before some transfers, including continuous or large-scale transfers of sensitive data. SDAIA publishes the text in Arabic.
Whether your use of an AI assistant counts as a transfer, and which route fits, depends on your data and contracts. That is a question for your adviser.

Do not assume the processing happens in Saudi Arabia. Anthropic's data residency documentation offers global or US-only inference and US storage. OpenAI's business data page lists storage regions for eligible Enterprise, Edu, Healthcare and API customers: the U.S., Europe, UK, Japan, Canada, South Korea, Singapore, Australia, India and the UAE. Saudi Arabia is not on that list. Ask each vendor in writing where your data is processed and stored, and keep the answer.

Questions people ask

Is read-only mode risk-free?

No. It stops the assistant changing your systems, but the data it reads still enters the conversation, and hidden instructions can still push an assistant to include data in an answer. Combine read-only with narrow roles and only the data the question needs.

Can ChatGPT or Claude process our data inside Saudi Arabia?

As of 17 October 2026, neither vendor's public data residency documentation lists a Saudi region. Ask each vendor in writing, and plan on the basis that processing happens abroad.

Is it safe to use a free or personal account for company data?

We would not. Training defaults and admin controls differ from business plans, and personal ChatGPT plans share data for training unless you opt out. A business plan lets an admin decide who can add connectors.

Do we need a developer to do this safely?

Not for a software maker's own connector, which you set up by signing in and approving permissions. For your own database or a system without a connector, yes, or a provider who runs it for you and answers the questions above.

Where Vootlabs fits

Vendor controls cover one product each, so a company with a store, a point-of-sale system and accounting ends up with three sets of roles, three sets of prompts and three logs. Vootlabs is designed to apply one set of access by role, approval before any change and a full audit trail across every system you connect, whichever assistant your team uses.

Vootlabs does not change where Claude or ChatGPT process data, so the Saudi questions above stay yours to settle with your adviser. We are onboarding a limited number of companies in a design-partner programme, and we would like to hear how you want your controls to work.

Book a demo Join the design-partner programme

Sources

Plans and menu names change. Check the live vendor page before you act. All pages below were read on 17 October 2026.

By the Vootlabs team. Last verified 17 October 2026.