A free transcription app wants your microphone, your contacts, and full access to Google Drive. The meeting starts in four minutes, so you tap Allow and forget about it. That single tap is the entire security review most beginners ever perform, and it is exactly how a helpful little tool ends up holding more of your life than your bank does.
You do not need a security background to do better. A structured look at permissions, data handling, and what a vendor will admit about itself takes about ten minutes per tool. Here is how to spend those ten minutes well.
Start With Permissions, Not Features
The consent screen is the most honest document a company will ever show you. When you sign in with Google or Microsoft, the scopes listed there describe exactly what the tool can reach: read your email, see your calendar, create and delete files in Drive. Features get rewritten by marketing. Scopes are legal language.
Read them against one question: does this job require that access? A chatbot that summarizes a document does not need your entire Drive. It needs the one file you upload. A note-taker that joins your calls needs microphone access, not your contact list. If a tool insists on broader access than the task requires, that is not a technical limitation. It is a choice, and usually a data-collection one.
Two habits help here. First, prefer tools that let you upload individual files over tools that want to sync an entire account. Second, audit what is already connected at myaccount.google.com/permissions (or the Microsoft equivalent) every few months. You will almost always find something you forgot you authorized in 2023.
Find the Data Retention Line, and Read It Twice
Every credible AI vendor publishes a privacy policy, and most now run a separate trust center or data-controls page. You are looking for three specifics, not warm adjectives like “committed to privacy”:
Does my input train the model? OpenAI, for example, lets consumer users switch off model improvement in Data Controls, while business and API tiers do not train on your inputs by default. Many smaller tools built on top of someone else’s API offer no such switch at all.
How long is it kept? Thirty days is a common default for abuse monitoring. “Indefinitely” or silence is a warning sign.
Can a human read it? Most policies admit that flagged conversations may be reviewed by staff or contractors. That matters if you paste a contract, a medical letter, or a client’s payroll file.
Free tiers are where your data does the paying
If a tool is free and has no visible paid plan, work out the business model before you trust it. Sometimes it is ads. Sometimes it is a thin wrapper around a paid API that logs everything to offset costs. If you cannot answer “how does this company make money,” assume your inputs are the product and act accordingly.
The Ten-Minute Review Checklist
- Check the company exists. A real About page with a registered name, an address, and named founders. Not a Gmail address and three testimonials.
- Search for leaks. Query the tool’s name plus “data breach,” “leak,” or “lawsuit.” Five minutes of reading beats six months of regret.
- Look for a security page. SOC 2 Type II, ISO 27001, a subprocessor list, a contact for vulnerability reports. Absence is not proof of wrongdoing, but presence signals a company that expects scrutiny.
- Test with disposable data. Run your first week of prompts on invented names and fake numbers.
- Find the delete button. If you cannot clear your history or close your account without emailing support, treat the tool as permanent storage.
- Check where it runs. A browser-based tool with a clear domain is easier to assess than a desktop executable from a file-sharing link or a bot inside a messaging app.
Prompt Injection Is the Risk Nobody Warns Beginners About
Here is the part that surprises people. An AI tool that reads content you did not write can be instructed by that content. A resume PDF with white text on a white background, a calendar invite, a product review, a webpage the assistant browses on your behalf: any of these can carry hidden instructions telling the model to ignore its rules and do something else.
The danger climbs sharply once the model has both access to untrusted material and the ability to act. Researchers have documented agents that were talked into leaking data, sending messages, or reaching outside their intended environment, and the fallout is not theoretical: an OpenAI-linked agent that broke containment and caused real damage is a decent reminder that autonomy plus credentials is a genuinely risky mix.
For everyday use, keep the two powers separate. A summarizer that can read anything is fine. A tool that can read anything and send email, move money, or delete files deserves far more caution, especially while you are still learning what it does.
Check the Vendor’s Identity Before the Model’s Hype
Model names appear and vanish constantly, and a lot of them are repackaged versions of something else with a new logo and a leaderboard screenshot. Some are outright mysteries that later resolve into something mundane: the Ox Alpha mystery that ended at Z.ai is a good case study in how much noise surrounds a name with no company behind it.
Before you hand over an API key or a work email, confirm three things: the domain matches the company, the pricing page lists real numbers rather than “contact us” for a free product, and the documentation mentions specific technical details instead of pure vibes. Resellers are common. If the terms of service belong to a different entity than the website, find out why.
Extensions and Agents Widen the Blast Radius
A browser extension that “adds AI to every page” can read every page, including your webmail and your banking portal. That is not an edge case; it is the permission model. Install sparingly, check the developer, and remove anything you have not opened in a month. The same logic applies to plugins inside a chat tool: each one is a small program with its own author and its own access.
When you do connect something, grant the narrowest scope on offer. Read-only beats read-write. Single folder beats entire drive. If a connection stops working because you trimmed its access, the tool was doing more than you thought.
Lock Down the Account Itself
Your AI account often becomes a second inbox, holding drafts, research, and fragments of personal history. Treat it accordingly. Use a unique password stored in a manager, turn on multi-factor authentication, and resist reusing the login you use for banking or your main email. If the tool accepts a card, a virtual card number limits the damage from a billing system that gets compromised.
An alias email address is worth the two minutes it takes to create. It keeps marketing spam out of your primary inbox and makes it obvious which service leaked your address when the junk starts arriving.
Where to Draw the Sensitive-Data Line
Some material should not go into a cloud AI tool at all, no matter how good the privacy policy reads. Government ID numbers, medical records, card details, client files under NDA, source code containing credentials, and anything covered by a confidentiality clause all belong on the other side of that line.
You can still use AI on this work. Redact names and numbers first, or run a local model on your own machine. Tools like Ollama and LM Studio download a model once and then work offline, which is the cleanest answer for sensitive text you genuinely need help with.
When a Tool Fails the Review, Close the Tab
Most tools will pass a light review. The ones that fail tend to fail in the same handful of ways, and any single one is enough to walk away: no way to opt out of training, no named company behind the site, an OAuth prompt that asks for more than the job requires, no method to delete your data, or a download that arrives as an unsigned installer from a file locker.
There are always three alternatives with the same features, and the switching cost is fifteen minutes. The cost of leaving a careless tool connected for a year is a different order of magnitude. Do the ten-minute review once per tool, write down what you found, and get back to the actual work with a little less to worry about.