How do you make sure the client's data is secure and private?

#132 · How to Deliver AI Chatbots to Clients in 2025 (Step-by-Step)

youtube ↗Agency Operations

How do you make sure the client's data is secure and private?

I mostly work with industries that aren’t heavily regulated—creative agencies, SEO agencies, ad agencies, digital marketing businesses, consultancies—where security isn’t a big concern and clients care more about growth. I avoid highly regulated fields like medical, legal, health, tech, finance because of top‑down regulations that make handling customer data complicated. If a client does care about privacy, I address their concerns as best I can: I explain where their data is stored, note that it’s purged every 30 days, and share relevant legal statutes. I don’t self‑host or build on‑prem solutions; for enterprise‑level needs like HIPAA‑compliant automations, you’d need alternatives such as Caragon, which come with higher costs (e.g., $400/month for 2,000 workflow runs plus 7¢ per run). That’s outside my current business model, so I focus on the lower‑friction, high‑ROI market.

securityprivacydata protection

Related answers

youtube ↗AI & Automation

How do you handle client privacy concerns when they're hesitant to put customer data into AI models?

No problem. I haven't run into this recently because I've more or less said I won't work in the healthcare niche. I avoid HIPAA and other compliance regulations, and I also avoid finance and legal niches because those clients are more scrupulous about regulations and focused on risk rather than reward. To get ahead of this question, I recommend not answering it directly but addressing the root problem: niche down into a 'wild west' industry that doesn't have these issues, so you don't have to solve them; you've unknowingly chosen this problem because the niches you're in care a lot about it. Now, I have faced situations where clients are hesitant to put data into AI models due to privacy concerns. You can get around this by obfuscating or anonymizing the data. For example, if a company wants customer support ticketing data, you have a dataset of questions from users of their SaaS app or exported from Intercom. Instead of feeding it directly into the model, you remove all customer information, email addresses, and any sensitive data from the questions. You can then use this anonymized data in another AI model—for instance, run something locally on your computer, trim out 99% of the irrelevant content, and send it to a big API like OpenAI to extract extra value. Generally, I perform some form of anonymization or data obfuscation, removing anything sensitive. I've only had to do this a couple of times, and that's how I handle those concerns. I didn't continue working with those clients because they were massive pains.

ai privacydata obfuscationniche down

youtube ↗AI & Automation

How should I handle data privacy when building AI automations for clients with sensitive data, especially when using APIs that send data to providers like Anthropic?

Treat client data as confidential. Use providers that offer a ‘do not train on my data’ option, such as Anthropic’s enterprise or higher‑tier plans, and explicitly check those boxes. If you need stricter privacy, run models locally or on privacy‑first inference providers that don’t retain data. Explain to clients that while most SaaS LLMs may use data to improve models, you can mitigate this by selecting plans that opt‑out of training and by using self‑hosted solutions when absolute confidentiality is required.

data privacyaiautomation

youtube ↗AI & Automation

In your experience, what are the limitations of using middleware/serverless automations (chaining tools like Make, ClickUp, OpenAI, etc.) in highly regulated industries like healthcare or finance — are the regulations too tight to provide the kind of flexibility and value you'd offer smaller businesses?

The regulations aren't too tight to do it, but they're definitely tighter than other situations, and honestly I just don't like dealing with it. In practice, if you want to do these automations in US healthcare you can't just use Make because it's not HIPAA compliant — you need a final compliance filter/check, and the same applies to financial regulations; it makes your life way harder, forces you onto alternative platforms, and requires things like anonymizing customer data. As a business owner you get to choose your niches, and in my case the juice usually isn't worth the squeeze, so I stay away from highly regulated industries and stick to less-regulated, typically smaller businesses (though I've worked with 8-9 figure companies too). It's a tradeoff: regulated/enterprise healthcare clients mean bigger ticket sizes, longer contracts, and slower-moving business, but also a whole new tech stack to learn, unfamiliar applications, data anonymization work, and real legal/regulatory risk. I can get the same benefits working with other kinds of businesses without those cons, so that's what I choose to do — though I could see situations where someone's genuinely set on going after that market anyway.

regulated industrieshealthcarefinancehipaamiddleware

youtube ↗AI & Automation

How can I overcome client distrust of AI, especially fears about data misuse or leaks, and explain data security when implementing AI solutions?

To address client distrust of AI, especially fears about data misuse or leaks, anonymize the data before sending it to the AI module—strip out personal identifying information (PII) like client name, business, earnings—and feed only the anonymized data to the AI to generate reports or statistics. Then take the AI output and use it as a variable in your report template, re‑adding the PII later in your automation platform (Excel/VBA/etc.) so the AI never sees the sensitive data. This way you maintain data security while still leveraging AI. I understand the concerns, but this approach lets you use AI safely without exposing client data.

data securityanonymizationpII