Virtual Assistant Confidentiality Checklist: Using AI Without Leaking Data

A virtual assistant can use AI without leaking client data by keeping a short approved-tools list, using only business-grade accounts that don't train on content, locking every account behind a password manager and multi-factor authentication, redacting what a task doesn't need, and adding an AI clause to the service agreement. Write the breach steps down before you need them.

Most NDAs were written before anyone pasted a client's email thread into a chatbot. They forbid sharing confidential information with third parties but never say whether an AI service counts, so the safe route is to settle it in writing with each client. The checklist below is built for someone working alone or with a small bench of sub-contractors, handling several clients' inboxes, calendars and files at once.

Follow me on Instagram@sagnikteaches

Sort every tool into three bands before touching client data

Start by listing every tool you use, including the ones inside other tools (the AI summary button in your email app, the transcription bot in a meeting app, the "improve writing" feature in your notes app). Then place each in one of three bands.

Connect on LinkedInSagnik Bhattacharya

Facts to base the bands on, from each vendor's own pages: business plans for ChatGPT, Claude, Gemini in Workspace and Microsoft 365 Copilot (now listed as Microsoft Copilot in Microsoft's documentation) don't train on your content by default. Consumer plans for ChatGPT and Claude let you opt out of your chats being used for training, and the setting is yours to switch off: in ChatGPT it is called "Improve the model for everyone" and it starts switched on for Free, Plus and Pro accounts. Vendor settings and names change, so look at the current privacy or data-controls page before you place a tool in the green band, and write the date you checked next to it.

Subscribe on YouTube@sagnikteaches

One practical wrinkle: ChatGPT Business and Claude Team each need at least two seats, so a solo VA pays for two (roughly $40 to $50 a month in all) or uses an individual plan with training off. In that case treat the tool as amber and redact, because an individual plan doesn't give you the admin and audit controls a client may expect.

Illustrative approved-tools list for a VA with four clients

Say a virtual assistant supports a law firm with four fee earners, an accountancy practice, an insurance broker and an electrical contractor. Her list might read:

• Law firm: AI off. The firm's policy bans it. Drafting by hand with the firm's own templates.
• Accountancy practice: green for the practice's own Microsoft 365 Copilot licence, used inside their tenant; amber for her own assistant with redaction.
• Insurance broker: amber only. Policy numbers and claim details never leave the broker's systems; she uses AI for generic email wording with placeholders.
• Electrical contractor: green for her business-plan assistant on quotes and scheduling messages, with customer addresses removed.

Four clients, four different rules, and one page of paper that lists them. The page is the control. If it's not written, it's a habit, and habits break at 11pm on a deadline.

Account security: the part that fails first

Most real leaks from a VA's desk are not clever. They are a shared password in a chat message, a phone with no lock, or a browser logged in on a family laptop. Make these non-negotiable.

1. One password manager for everything. Use a reputable one (1Password and Bitwarden are widely used; pick on your own research). Unique, long, generated passwords for every site. A single strong master passphrase, never reused, written on paper kept somewhere safe.
2. Multi-factor authentication everywhere it exists. An authenticator app or hardware key is stronger than text messages. Switch it on for your email first, since it resets every other account, then the password manager, the AI tools and every client system.
3. Never receive or send passwords in email or chat. Ask clients to use a password manager sharing feature or add you as a named user in their system. Shared logins hide who did what.
4. Named access for each client. Where the client's system allows it, ask for an account in your name, with the lowest permission that does the job. When the contract ends, they remove it and you remove your copies.
5. Device basics. Screen lock after a few minutes, full-disk encryption on, automatic updates on, no shared user profile with family, and a separate browser profile for work.
6. Check connected apps quarterly. In each AI tool and in your email account, open the list of connected apps and remove anything you no longer use.

For the sharing-logins problem specifically, see how to share AI tool logins safely with a password manager.

Redaction: what to remove before you paste

Redaction isn't deleting everything; it is removing what the AI doesn't need to do the task. The test is simple: would the output change if this detail were a placeholder? If not, swap it for one.

Remove or swap: full names, email addresses, phone numbers, home addresses, account and policy numbers, tax and national identifiers, dates of birth, bank details, case or claim references, logins and anything labelled privileged or confidential. Keep: the structure of a message, the tone needed, generic amounts if relevant, and role labels ("the client", "the supplier").

Before and after on a real-looking message

Illustrative original: "Hi [first name], following our call about the claim on policy [number], the loss adjuster wants photos of the water damage at [address] by Friday. Please also confirm the excess of $750 has been paid from the account ending [digits]." For a reply, the redacted version is: "Hi [CLIENT], following our call about the claim, the adjuster wants photos of the damage by Friday. Please also confirm the excess has been paid." The AI writes a clear, polite reply from that. You then put the real details back in your own document. Nothing that identifies the person, the policy or the account left your control.

A good habit is a text-expander snippet with a standard "redaction reminder" at the top of every prompt you write: "Placeholders in square brackets stand for real details I'll add later. Do not ask me for them." It stops the AI asking for the missing data, and it reminds you to remove it.

Files need extra care. A PDF can hide names in its metadata, a spreadsheet can carry hidden sheets, and a scanned page has none of the text-selection you'd use to redact it. For anything that isn't plain text, don't upload it to an amber tool at all; extract the one paragraph you need, redact, and paste that. The longer method is in how to anonymise client data before you paste it into AI.

Meeting bots, inbox assistants and other tools that read by themselves

The riskiest tools are the ones that read without being pasted into. A transcription bot that joins a client's video call, an inbox plug-in that reads every message, and a browser extension that sees every page all have access to far more than you'd ever paste by hand.

• Meeting recorders: never join a client's meeting with a bot unless the client has asked or agreed in writing, and everyone on the call is told it is recording. Delete transcripts on the schedule you agreed.
• Inbox assistants: use only the ones that run inside the client's own tenant (for example the client's Microsoft 365 or Google Workspace licence), where the client controls the settings.
• Browser extensions: keep a separate browser profile for client work with only vetted extensions. Some free "AI helper" extensions ask for permission to read and change data on every site you visit, so read the permission prompt before you click to add one.
• Automations: any workflow tool that moves client data between apps counts as a tool on the list. Check where it stores run logs; they often hold full copies of the content.

The service agreement clause

Put the AI terms in the contract, not just the NDA. Keep it short enough that a client reads it. The following wording is illustrative and should be checked by a solicitor before you rely on it:

The Assistant may use software tools, including artificial-intelligence tools, to help perform the Services. The Assistant will only enter Client Data into tools on the Approved Tools List, which is shared with the Client and updated by written notice. Client Data will not be entered into any tool that uses it to train models. The Assistant will remove personal and confidential details from content wherever the task allows. The Client may at any time require the Assistant to stop using AI tools on its data, and the Assistant will do so within [two] working days. The Assistant remains responsible for the accuracy of all work delivered, whether or not an AI tool was used, and will report any suspected loss of Client Data in line with the Incident Process.

Five points that matter in that clause. It names a list instead of a vague promise, so you can add a tool without redrafting. It rules out training on client data. It gives the client an off switch. It makes you responsible for accuracy, which reassures them and keeps you careful. And it links to the incident process.

If the client is the one holding customer data from the EU, the client is normally the data controller and you the processor, and their own paperwork may require a data-processing agreement naming sub-processors such as an AI provider. Don't improvise this; ask the client what they need and get a qualified adviser for anything complicated. For the NDA question when you share data outside your own team, see whether to sign an NDA before sharing data with an AI consultant.

A written breach process, ready before the bad day

When something goes wrong (a prompt sent with the wrong client's file, a lost laptop, a phished password), speed and honesty matter more than polish. Write these steps on one page and keep a copy offline.

1. Contain it (first 15 minutes). Change the exposed password, sign out all sessions, revoke connected apps, turn off the automation. If a device is lost, use remote wipe.
2. Write down what you know. Time, what data, which client, which tool, how many people affected, what you did. Facts only, no guesses.
3. Tell the client the same day. A short call followed by an email. Say what happened, what data was involved, what you've done and what you're doing next. Don't wait until you know everything.
4. Use the tool's own routes. Many AI vendors let you delete a conversation or file, and business plans have admin tools. Delete, and note the time. Don't assume deletion removes every copy at once; say so to the client.
5. Let the client decide who else to tell. Notification duties (to affected people or authorities) usually sit with the data owner, and sometimes have short deadlines. Support them with your records.
6. Review within a week. What failed? A habit, a setting, a missing rule? Fix the cause, update the approved-tools list, and tell the client what changed.

For a ready-made template, the AI incident response plan for small businesses has one you can adapt.

A realistic slip, and how the process handled it

An illustrative case: a VA working for an accountancy practice and an electrical contractor pasted a contractor's customer list into a chat window meant for the practice's work, because both chats were open. She noticed within minutes. Because the tool was a business plan, she deleted the chat, noted the time, and called the contractor that afternoon. The email she sent was four lines: what, when, what she'd done, and one change (a separate browser profile per client from then on). The contractor's reaction was relief at the speed, not anger. Compare that with the same slip discovered two weeks later by chance, and you can see what the process is for.

The onboarding questions to ask each new client

Settle the AI setting before the first task, not after the first problem. Five questions, asked in the kickoff call and recorded in your tracker:

1. Does your own policy, insurer or industry body restrict AI tools on your data? If yes, I'll mark you AI-off.
2. Which systems will I get access to, and will you add me as a named user?
3. Is any of the material especially sensitive (health, legal privilege, children's details, payment cards)? Those items get redaction or stay in your own system.
4. Are you happy for me to use the green-band tools on your work, and do you want to see the list?
5. Who do I call, and how fast, if something goes wrong?

Illustrative answers from the insurance broker in the earlier example: the broker's regulator-facing policy restricts uploading claim files to outside tools, so the setting becomes amber with generic wording only; named access is granted to the shared mailbox but not the policy system; the contact is the owner's mobile. Two minutes to ask, and it prevents every awkward conversation later.

A monthly ten-minute routine that keeps the checklist true

A checklist that is only read once is a document, not a control. Put a recurring reminder on the first Monday of each month and run through five questions:

• Has any tool on the approved list changed its data terms, plan name or default settings?
• Are there new connected apps, extensions or automations I haven't listed?
• Does every active client have an agreed AI setting (green, amber, off) recorded?
• Have I deleted old transcripts, exports and downloaded files for finished jobs?
• Did anything nearly go wrong, and did I write it down?

Illustrative cost: ten minutes a month is two hours a year, which is trivial next to the cost of explaining a leak to a client you've worked with for years. If you want to turn this into a selling point, add a one-page "How I protect your data" sheet to your onboarding pack. It reads well to a careful client and quietly screens out those who won't engage with it.

The same idea runs through team settings; shadow AI and how to stop staff pasting client data into free tools looks at it from the owner's side, which is useful if you hire sub-contractors and need to give them the same rules. For how to price the extra care into your packages, see virtual assistant pricing when AI does the drafting.

The checklist on one page

• Every tool sorted green, amber, red, with the date I checked its data terms.
• Approved-tools list shared with each client, with their AI setting (on, redacted only, off).
• Password manager in use; unique passwords; MFA on email, password manager, AI tools and client systems.
• No passwords sent by email or chat; named accounts with least access.
• Redaction snippet at the top of prompts; no files uploaded to amber tools.
• No meeting bots, inbox plug-ins or extensions without client agreement and tenant control.
• AI clause in each service agreement; solicitor-checked once.
• One-page breach process stored offline; contact details for each client to hand.
• Monthly ten-minute review in the diary.

Questions virtual assistants ask about AI and confidentiality

Does my NDA already cover AI tools?

Usually not clearly. Most NDAs forbid disclosing confidential information to third parties but never say whether an AI service counts. Rather than argue about it later, add a short clause naming which tools you may use and under what conditions, and get the client to agree in writing.

Can I use free ChatGPT or Claude for client work?

Only for tasks with no client information in them, such as rewriting your own template. For anything containing client or customer data, use a business plan that does not train on your content, or get the client's written approval and redact first.

Do I need to tell clients about every AI tool?

You need to tell them about every tool that touches their data. Keep a one-page approved-tools list, share it at onboarding and update it when something changes. Tools that never see client data, like a grammar checker on your own marketing copy, don't need to be listed.

What if a client's own policy bans AI altogether?

Follow it, and write it down. Mark the client as AI-off in your tracker, switch off any inbox or meeting features that read their mail, and tell them what you do by hand instead. Some clients will relax the ban later once you show your controls.

Further reads

• AI Tools Used by Virtual Assistants: A Stack for Five Clients — A tool stack for juggling five clients.
• Does ChatGPT Train on Client Data? Business vs Free Plans — Business versus free plans on training.
• AI Email Management for Virtual Assistants: Rules, Drafts, Handover — Inbox rules and drafts with a clear handover.
• Is It Safe for an Accountant to Use ChatGPT With Client Data? — How an accountant weighs the same risk.
• Reusing Past Client Work With AI Without Leaking Client Data — Reusing old client work without leaking details.
• How Virtual Assistants Use AI to Manage More Clients — Take on more clients without losing control.
• AI Virtual Assistant Services: How a VA Business Can Package Them — Three package tiers, the pricing sums, scope limits and disclosure wording for a VA business selling AI-assisted work.
• Chat Support Virtual Assistant Software: Which Fits a VA Business? — Which shared inbox or live chat tool suits a VA serving several client shops, what each really costs at eight clients, and whether AI drafts pay.
• Virtual Assistant for QuickBooks: Intuit Intelligence or a Human VA? — Compare QuickBooks' built-in AI assistant with a human virtual assistant by task, with cost per task, monthly caps and a four-week test.
• Virtual Assistant or AI for a Real Estate Agent: What Goes Where — Which real estate tasks suit AI and which need a virtual assistant, with costs, client-data rules and a 30-day trial plan.
• ChatGPT Prompts for Virtual Assistants: Inbox, Scheduling, Reports — Eight ChatGPT prompts for inbox triage, scheduling and client reports, each with a sample output and a client-approval step.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: OpenAI ChatGPT Business pricing page and Data Controls FAQ; Claude pricing page; Google Workspace generative AI privacy hub; Microsoft Copilot data, privacy and security documentation; general NDA and service-agreement practice for freelancers.