EKAP & private AI

The Hidden Cost of Sending Company Documents to Public AI Tools

It's an easy habit to fall into: someone needs a quick answer, so they paste a contract, a policy document, or a chunk of customer data into a public AI chatbot. It feels harmless, and it's fast. It's also a much bigger risk than it looks.

Where the risk actually is

• Loss of control — once information is pasted into a third-party tool, you no longer control where it goes or how it's handled, and that depends entirely on that provider's own terms
• No access control — a consumer AI tool doesn't know or care whether the person using it is authorised to see the information they've just pasted in
• No audit trail — there's typically no record, from your side, of what was asked or what internal information was shared
• Inconsistent handling across staff — one person's caution doesn't help if a colleague doesn't think twice about it

Why this happens even in careful organisations

It's rarely carelessness — it's usually that the internal alternative is slower or doesn't exist. If finding an answer the proper way means searching several systems or asking around, a fast public AI tool becomes tempting, policy or no policy.

The alternative: a private, internal option

A self-hosted knowledge assistant solves the actual underlying problem — getting a fast answer — without the trade-off. EKAP, for example, runs entirely on your own infrastructure, checks access permissions before retrieving anything, and cites its sources so answers can be verified. Staff get the speed they were looking for from public tools, without the exposure.

We don't claim EKAP is certified or compliant with any specific standard (ISO 27001, GDPR, SOC 2) — it's designed to help you keep control of your own data, and formal compliance sign-off remains your organisation's responsibility.