AI best practices: have some DOUBT

<aside> 🛠️

Check the tool, not just the data. Before you put anything into an AI tool, have some DOUBT.

</aside>

Why we're careful

AI tools are new, and many vendors skip security controls to reach the market faster
An AI tool's value often comes from how many things it connects to. The more tools we connect, the more we build a web of shared data, and one compromised integration can compromise the whole web
Our customers are mid-market companies. They're nervous, demanding and short on time, and they ask enterprise-level security questions. If we can't show we handle their information and our own carefully, they walk away

Data that deserves a pause

Code, keys and tokens, financial information, personal information and legal information. These need the most thought before they go into any AI tool.

Pausing doesn't always mean no. In Claude Enterprise, use only what the work needs. Keys and tokens never go into an AI tool. The data table in the AI policy shows what's OK and what's never.

Have some DOUBT

Letter	Ask yourself	At Float
D	Is the tool covered by our DPA, DPIA or internal privacy policy?	If it isn't, don't put personal information, customer data or other sensitive data into it
O	Can I use our tool (Claude)?	We have an enterprise contract with Claude, and Anthropic is a listed sub-processor. Use Claude first before you consider anything else. Gemini inside Google Workspace is also fine on your Float login
U	Am I unsure?	Use as little information as possible and err on the side of caution. Ask in #all-ai-share or file a request in the AI helpdesk
B	What's the business case?	What problem are you solving, and why can't Claude solve it? Many "we can't do that" answers are risk decisions, and a proper DPIA can unlock more than people expect
T	Is it saving time?	Are you saving time, or watching AI work? Check that a workflow helps before you automate it, then check back that it delivers what you said it would

If you can't avoid sensitive data

If the work needs sensitive or personal data and there's no way around it, we can support you. We have compliance tools to cover it, including DPAs and DPIAs. File a request in the AI helpdesk first.

Page ownership: SRE, Chris