Free tier, paid tier: why the same AI tool gives two different answers about your data

When a practice principal asks whether an AI tool is safe to use, the conversation almost always starts in the wrong place: which brand is better. Claude or ChatGPT. Whoever the accountant down the road recommended.

The brand matters less than the account. The same product, from the same vendor, can treat your text differently depending on which tier someone signed up for — and nobody in your team chose their tier based on your obligations. They chose it because it was free, or because it was the one their nephew mentioned.

What actually differs between tiers

Set the marketing aside and there are five questions worth asking. They're the same five for any vendor, which is why they're worth learning once.

1. Is what I type used to train the model? This is the question people mean when they ask whether something is "safe". The answer commonly differs between consumer and business plans.
2. How long is it retained, and where? Retention for abuse monitoring is not the same as retention for training, and both are different from what's visible in your own chat history.
3. Who inside the vendor can see it, and under what circumstances?
4. Where is it processed? For some Australian obligations, the answer matters. For most work, it matters less than people assume — and less than the retention answer.
5. Can an administrator turn any of this off, and would you know if someone turned it back on?

The fifth one is the one that separates a business account from a personal one. Individual settings that any user can change are not a control. A setting an administrator owns is.

Why the free tier is where the risk collects

Not because free tiers are careless. Because of who uses them and for what.

A free account is a personal account. It's signed up with a personal email, it lives on a phone as often as a work laptop, it has no administrator, and it leaves no trace in your systems. When someone changes roles or leaves, nothing happens to it. If you needed to establish what went into it during an audit or a complaint, you could not.

That's the real exposure. Not that the vendor is doing something sinister with a paragraph of a client letter, but that you have no visibility, no control and no record — for work that was done on your behalf.

The reframe that usually resolves it

Here's what gets missed in the confidentiality argument: most of the work that's costing your team time doesn't involve client information at all.

The tender response. The policy document. The induction pack. The monthly summary written from numbers you've already de-identified. The standard letter that explains a process to a client, with no client in it. The job ad. The scope of works. The follow-up sequence after a quote.

That work is where the hours go, and it's almost entirely outside the confidentiality problem. Which means the argument about tiers, while worth resolving, is not the thing blocking you from getting value — and treating it as a blocker costs you a quarter.

The objection is "my client data is confidential." The answer is that most of the time-sink work involves no client data at all. That reframe is where useful training starts.

We go further into this on the accounting and bookkeeping track, where it's the single most common objection, and in allied health, where the privacy module genuinely is the product rather than a disclaimer at the end.

What good practice looks like

• One named tool and one named account type for work. Not a list of options.
• The never list written in your own documents' terms, not generic categories. Our never list guide is the starting point, and it's meant to be edited.
• Admin-owned settings where the tier allows it, checked on a schedule rather than once at setup.
• A clear statement of what stays with a qualified person regardless of the tier: clinical judgement, financial advice, tax positions as distinct from tax admin, safety sign-off. No tier changes that line.
• A review date. This is the fastest-moving content in the whole subject, which is why our page on tiers and what happens to your data carries a visible review date and deliberately doesn't reproduce vendor terms.

The one thing not to do

Don't write a policy that says "do not use AI tools". It reads as decisive and it fails quietly: the work moves to personal phones, the visibility goes to zero, and the first time you hear about it is when something has already gone out the door.

A rule people can follow beats a rule that sounds strict. The useful version names the tool, names the account, names what never goes in, and names who to ask. That's a page, not a manual — and it's the thing we build first when the exposure is real, which is what the policy and audit engagement is for.