← All sheets
GL-A-004Sheet 004FOR INFORMATIONA · ARTIFICIAL INTELLIGENCE

Your prompt is a data export. Who's on the receiving end?

SECTION · WHERE THE PROMPT LEAVES · ANY APP THAT CALLS A MODEL

Drawing sheet 004: Your prompt is a data export. Who's on the receiving end?

General notes

  1. 01Send a customer's message to a model and it leaves your infrastructure for another company's.
  2. 02Under GDPR that company is a sub-processor: the rule that says you must list everyone who touches your customers' data.
  3. 03Most teams can name their database vendor. Fewer can say which model provider is on the list, or what it received.

Inside your app

  • The customer's name
  • Their email and phone
  • The card they typed by mistake
  • Your system prompt

The provider

  • The model
  • Request logs
  • Abuse monitoring
  • Whoever they sub-contract

As posted

Your prompt is a data export.

Send a customer's message to a model and it leaves your infrastructure for another company's. Under GDPR that company is a sub-processor you must list.

Most teams can name their database vendor. Fewer can name the model provider.

Sheet 004.

Read with

  • Sheet 005 · "Who sees our customer data?" Four answers. One survives an auditor.
  • Sheet 010 · A phone number that can never ring.