Home / Data protection
Data protection
Safety is not a slogan. It is a method.
Most AI risks in small organizations do not come from the technology itself. They come from people using it without rules: pasting client details into a public tool, trusting an answer without checking it, or not knowing what to do when something goes wrong. Our method addresses each of these points.
Our method
Six steps, in every project
We map what must never go into an AI tool
With you, we list the types of information your organization handles and classify them in three levels: public, internal, and confidential. Confidential information, such as client files, health information, financial details or anything covered by professional secrecy, stays out of AI tools unless a tool has been specifically approved for it.
We review each tool before recommending it
For every AI tool, we look at the same questions:
- Can your content be used to train the provider's models, and can that be turned off?
- Is there a business plan with stronger data commitments?
- Who in your team has access, and how are accounts managed?
- How long is data kept, and can it be deleted?
Your policy says clearly what is allowed
Your AI use policy lists approved tools, allowed uses, forbidden uses, and who to ask when in doubt. It is short enough to be read, and concrete enough to be followed. Staff receive a one-page reminder.
Important outputs are checked by a person
AI makes mistakes and can state wrong things with confidence. Anything sent to a client, a funder or a partner, and any decision that affects a person, is reviewed by a staff member before it goes out. Our automations are designed with that check built in.
Every automation is tested with sample data first
Before an automation touches real work, we run it on fictional or anonymized examples, check the results with you, and only then switch it on. You approve each automation before it goes live.
Your team knows what to do if something goes wrong
If confidential information is entered in the wrong tool, or an automation sends something it should not, your policy describes the steps: stop, report to the right person, record what happened, fix the cause. Simple, written down, and known by everyone.
Example: a client document is pasted into a public chatbot
- Stop. Close the conversation and delete it if the tool allows it.
- Report. Tell the person named in your policy the same day, without blame.
- Record. Note what was shared, in which tool, and when.
- Fix. Assess the risk, notify if required, and adjust the rules or the training.
Our own practices
How we handle your information
We apply to ourselves the rules we recommend to you.
- Minimum access
We only ask for access to the tools needed for the project, and you can remove it at any time.
- Your accounts, your data
Automations run on accounts that belong to your organization, not to us.
- Anonymized examples
For training and testing, we work with anonymized or fictional documents.
- Confidentiality agreement
We sign a confidentiality agreement on request, before any access to your information.
Legal context
What we promise, and what we do not
Depending on your organization, privacy laws such as Alberta's Personal Information Protection Act (PIPA) or the federal Personal Information Protection and Electronic Documents Act (PIPEDA) may apply, along with the rules of your professional order.
We do not give legal advice and do not guarantee legal compliance. Requirements depend on your tools, your data and your obligations. What we give you is a clear, practical framework that makes good practices easy to follow, and that we recommend you review with your own advisors if you are a regulated organization.
Start with our free AI use policy template →FAQ
Questions about your data
Will TagVolt see our client information?
Only what the project needs. We test with sample or anonymized data, automations run on your own accounts, and you can remove our access at any time. We sign a confidentiality agreement on request.
Is an AI use policy enough to comply with PIPA?
Not on its own, and we do not guarantee legal compliance. The policy is a practical framework that makes good practices easy to follow. Regulated organizations should review it with their own advisors.
What if someone pastes sensitive information into an AI tool?
Your policy describes four simple steps: stop, report it the same day, record what was shared, then fix the cause. Acting quickly and calmly matters more than blaming anyone.
Do you use our data to train AI?
No. We do not train AI models. We check your tools' settings so that your content is not used for training wherever that option exists.
Where is our data stored?
In your own accounts and tools. Storage location depends on each vendor; we check it and tell you before recommending a tool.
What happens when we stop working with you?
You remove our access, and everything stays in your accounts: policy, automations and guides.
What if the AI makes a mistake?
It is planned for. Anything that goes to a client is checked by a person, every automation is tested with sample data before it goes live, and your policy says exactly what to do if something goes wrong.
About TagVolt Agency. An Edmonton team serving organizations across Alberta, in English, French or both, at fixed prices. More about us →
In 30 minutes, know where your team stands with AI
A free call to map how AI is used in your business today, the rules to set first, and where it can save you time.
Book a free AI check (30 min)With a member of our team, in English or French. No obligation.
- 10 min · What your team really usesTools, accounts, and the information that goes into them.
- 10 min · The rules that matter firstThe two or three rules to put in place right away.
- 10 min · The first task worth automatingOne concrete idea, and what comes next.