Using AI Safely in a Small Business
If you run a business or a nonprofit, you have probably already been offered an AI tool for writing, answering email or “running the office.” You may have already dabbled with some of that.
Some of that is useful. But some of it can put customer information, money, or your reputation at risk if you treat the tool like a trusted employee.
Some of that is useful. But some of it can put customer information, money, or your reputation at risk if you treat the tool like a trusted employee.
You do not need to become a tech guru. You just need a few clear habits. Here is what we tell clients when they ask what is safe, what is not, and what to watch for.
Go straight to the real sites
Fake look-alike sites and ads sometimes outrank the real ones in search. Type the address yourself, or bookmark it, instead of clicking the first result.
– ChatGPT: chatgpt.com (OpenAI: openai.com)
– Claude: claude.ai (Anthropic: anthropic.com)
– Gemini: gemini.google.com
– Microsoft Copilot: copilot.microsoft.com
– Grok: grok.com
– Meta AI: meta.ai
– Perplexity: perplexity.ai
– Claude: claude.ai (Anthropic: anthropic.com)
– Gemini: gemini.google.com
– Microsoft Copilot: copilot.microsoft.com
– Grok: grok.com
– Meta AI: meta.ai
– Perplexity: perplexity.ai
Get the mobile apps only from the Apple App Store or Google Play, published by the real company. Don’t install AI apps or browser extensions from ads or pop-ups.
1. What AI Is Fine For (and What It Is Not)
What it looks like: Using a tool like ChatGPT, Claude, Gemini, Grok, or Copilot to draft an email or social media post, brainstorm menu specials, rewrite a clumsy paragraph, or summarize something you already published on your own website.
Why it matters: AI is good at first drafts and rough organization. It is not a lawyer, an accountant, or a real live employee or customer. It also does not know your business the way you do, and it can invent details that sound confident.
What to do: Use it for drafting, brainstorming and summarizing your own public information. Then rewrite in your voice and check every fact before anything goes out. Never treat an AI draft as finished copy.
2. What Never to Paste Into an AI Chat
What it looks like: Dropping a customer list, a reservation spreadsheet, a payroll file, a credit-card authorization, a password, a medical detail, or a confidential contract into the chat window “just so it can help.”
Why it matters: Whatever you paste is leaving your computer.
THIS IS IMPORTANT → On many personal plans, conversations may be used to improve the model unless you change the settings. Even when training is turned off, the provider still processes and may temporarily store what you send. Once customer or employee information is in someone else's system, you have less control than you think.
THIS IS IMPORTANT → On many personal plans, conversations may be used to improve the model unless you change the settings. Even when training is turned off, the provider still processes and may temporarily store what you send. Once customer or employee information is in someone else's system, you have less control than you think.
What to do: Never paste customer personal or payment information, passwords, employee or health details, or confidential contracts into a public AI chat.
If you need help with sensitive material, strip names and numbers first, or ask us and we will help you choose a safer approach.
If you need help with sensitive material, strip names and numbers first, or ask us and we will help you choose a safer approach.
3. Free Plans, Business Plans and Data Training
What it looks like: A free or personal account (like the free version of Gemini available to Gmail users or the free tiers of Claude, ChatGPT, etc.) used for business work, with no one on the team sure whether chats are used to train the model.
Why it matters: Personal and free plans often allow training on your conversations by default, with an opt-out in the privacy or data settings. Most business and team plans do not train on your workspace data by default, and many let you turn related sharing off. The exact labels change, and they differ by vendor.
What to do: Prefer a business or team plan for work that touches the business. Check the privacy or data-control settings and turn off training on your content where the option exists. DO NOT assume a personal account is “private enough” for client work.
4. AI Email Assistants and Hidden Instructions
What it looks like: An AI assistant that reads, sorts or drafts replies to your inbox.
IMPORTANT → Some phishing emails now carry hidden text aimed at the AI, not at you. It might include instructions to click a link, reply with information, or forward messages. You might never see that text.
IMPORTANT → Some phishing emails now carry hidden text aimed at the AI, not at you. It might include instructions to click a link, reply with information, or forward messages. You might never see that text.
Why it matters: The danger is not only a bad summary. It's that your AI assistant might follow those hidden instructions to take an action you didn't approve. Scammers write those hidden instructions on purpose (sometimes called prompt injection) because filters are less likely to catch them than a normal phishing email.
What to do: Keep AI assistants from sending money, sharing passwords or forwarding mail without asking you first. Never give an inbox assistant the power to pay bills, reset accounts or send messages on its own. If something looks urgent or odd, open it yourself or forward it to us.
5. Fact-Checking Before You Publish
What it looks like: Polished newsletter copy, a blog post or a social caption that mentions awards you never won, years you were not open, reviews that were never written, or local details that are simply wrong.
Why it matters: AI tools invent facts. They will also invent citations, quotes and “customer stories” that sound real. Search engines care whether the page is helpful and accurate. A confident mistake on your site still belongs to you.
What to do: Read every AI draft line by line before it goes live. Check names, dates, prices, hours, addresses and any claim about your history or your customers. Do not publish AI-written reviews or testimonials. If you would not put your name under a sentence, it does not belong on the site.
6. Voice-Cloning and “The Boss Needs Gift Cards” Calls
What it looks like: A phone call or voicemail that sounds exactly like an owner, manager or family member, asking for money, gift cards or a wire transfer right away, and asking you not to tell anyone. The Federal Trade Commission has warned that scammers use voice cloning in gift-card and emergency scams, and the FBI’s Internet Crime Complaint Center has described criminals using AI-generated voices to impersonate people you trust.
Why it matters: A few seconds of public audio, from social media or a website video, can be enough to fake a familiar voice. Urgency and secrecy are the tell. Real bosses do not ask staff to buy gift cards to “cover payroll” or “fix a vendor problem” over the phone.
What to do: Agree on a verification step with anyone who can authorize money: a code word, a second channel, or a call back on a number you already have. NEVER buy gift cards, send a wire or share account codes because of an unexpected call, even if the voice sounds right. Hang up and reach the person another way. The same rule applies to sign-in codes: share one only with someone you already trust who is helping with something you asked for — not with a stranger who contacted you first.
7. Fake AI Apps and Browser Extensions
What it looks like: An ad or download for a “free ChatGPT,” a “Copilot for your browser,” or an extension that promises to write emails, fill forms or “boost SEO” with one click.
Why it matters: Fake tools are a common way to steal logins, inject ads or read what you type. The real products do not arrive as a random install from a social ad.
What to do: Install AI tools only from the vendor's own site or the official app store listing you already trust. Do not download AI helpers from pop-up ads, email links or unknown extensions. If you are unsure whether something is genuine, ask us before you install it.
8. AI-Written Website Copy and Google
What it looks like: Worry that Google will punish a page “because AI wrote it,” or the opposite hope that AI copy alone will rank.
Why it matters: Google has said what matters is helpful, reliable content for people, not whether a person or a tool typed the first draft. Thin, inaccurate or copied pages fail either way. Clear pages that answer real questions, in your voice, with correct local details, do the job.
What to do: Use AI as a drafting assistant if it helps, then edit heavily. Add what only you know: your hours, your story, your photos, your staff. Do not publish raw AI output and hope search will sort it out.
Sources on voice-cloning scams: FTC on harmful voice cloning; FTC on gift-card scams; FBI IC3 (Dec 2025).
The One Rule to Remember
If an AI tool asks you to paste something sensitive, send money, share a password, or trust a voice on the phone without checking, stop and ask a person you trust first. Share a login or sign-in code only with someone you already know who is helping with something you asked for—not with a stranger who reached out of the blue. Checking with us is free for Seaport clients.
Send questions to [email protected]. A screenshot of a setting or a suspicious email works fine. We would rather look at a hundred cautious questions than have you clean up one expensive mistake alone.
Frequently Asked Questions
Is it safe to use free ChatGPT, Claude, Gemini or Copilot for my business?
For light drafting of non-sensitive material, many owners do. For anything with customer or employee information, prefer a business plan and turn off training on your content where the settings allow. When in doubt, leave the sensitive parts out of the chat.
Can I paste my customer email list so AI can write a campaign?
No. That is personal information you are responsible for. Write the campaign yourself with AI help on the wording, or use your email platform's own tools inside an account you control.
Someone left a voicemail that sounded exactly like our owner. What should we do?
Do not call back the number in the message or send money. Reach the owner on a number you already have, or walk down the hall if they are in the building. If it was a scam attempt, keep the recording and tell us; you can also report it at ReportFraud.ftc.gov or ic3.gov.
Will Google penalize my website for using AI?
You won't get penalized for using a tool. Google cares whether the page is useful and accurate. Pages full of vague, wrong or duplicated text can make it unclear whether a person or AI wrote them, and that's where you can run into problems.
Should our staff use personal AI accounts on their phones for work?
Prefer shared, business-managed access with clear rules about what may never be pasted in. Personal accounts make it harder to control training settings and harder to know where business information went.
More guides for business owners
Fake domain renewals, vanity awards, Google listing calls, phishing and hosting scare emails, and what to do when one shows up.
Know who manages your domain, hosting and Google accounts—and how to reach them if something changes.
Strong unique passwords, your browser’s built-in saver and two-step sign-in—without the scare tactics.
A calm checklist for the moment the site will not load, before you pay anyone for a “fix.”
Ownership, hosting, timelines and red flags, without the sales pitch.