The AI Defaults

Understanding the use of frontier AI applications and the default settings SMEs should consider when using these tools.

Your team is most likely already using AI. The question is whether the settings protecting your data, the data your users input to these tools are controlled and understood by your company, or left at the vendor’s default.

ChatGPT, Claude and Copilot are now everyday tools in most small and mid-sized businsses. They draft e-mails, improve productivity with summarisation and analyse spreadsheets. Very few of the businesses using them have looked at what happens to the information their users type in. The answer depends far less on the tool you use, and far more on plan selection and the setup.

Why this sits outside IT for most, today

In most SMEs, AI tools are bought directly from a frontier model provider (if using ChatGPT or Claude), rather than an IT provider. It’s the first tool in a technology shift that is not licensed by your MSP or IT provider. Copilot is the tool that does remain with the IT provider.

If you are using a frontier model, the result can be no central admin, no single view of who is using what, and client data spread between personal and business accounts.

We expect these licenses to move into the IT provider channel over time, as Microsoft once did. No frontier provider has given a timeline for this yet, and the responsibility for getting the defaults and controls right sits within your business.

Three ideas worth understanding

Chat vs API

There are two ways to use these AI models. The chat tool is the app your team logs into online, types and interacts with the LLM.

The API is a connection that software uses to talk to a model behind the scenes, for example when a CRM or bespoke tool adds an AI feature.

They run under different contracts, tiers and data rules. Most SMEs use the chat tool, and don’t fully understand the difference with the API.

A simple way to think about the difference, imagine there was no chat interface, but you could write something in a text file and click “send to AI” that concept would use the model API to find the model, send your data to the model and get a response to show you an output, it’s just that we see that within the chat systems provided by the model providers.

Zero Data Retention (ZDR)

With ZDR, the model provider processes your request for no data retention and keeps nothing once an answer or output from the model is returned back to you.

Without ZDR, the provider keeps a copy of your prompts and responses for a set period

ZDR has to be requested, approved by the model provider and is only available on the API, not on the chat interfaces most use. The API useage is also required to be at the Enterprise level for Anthropic (Claude).

For chat, your protection can only come from being on a buisness plan with the correct configuration, but its still not full ZDR.

An example of ZDR

Data Sovereignty

This is where your data is stored and processed and the relevant laws that apply to it. For UK and EU businesses, that quesstion now covers every prompt, or chat, that contains client information, not just where your files and data live.

Where your data goes

The plan decides where your data goes, not the brand.

The same model can sit behind all three columns. What changes is the contract engagement time, and who in your business decides how data is handled.

The defaults to check

Claude

Pro and Max are consumer plans, even though they are paid. If “Help improve Claude” is left on, chats are used by Anthropic for training and kept for upto five years.

Turning it off in:

Settings > Privacy

Helps to stop new chats being used for training and brings retention back to 30 days.

Team and Enterprise run under Anthropic’s commercial terms, so your chats are not used for training by default. That is the right starting point, but it is not the end of the job. A handful of defaults still decide whether data goes back to Anthropic or out to other systems, and only an Owner can change them.

Organisation Settings > Data and privacy
  
  Retention periods and audit logs (only if you are on the Enterprise plan)

  Allow members to export their own data - we recommend this is set to Off

  Share chats externally - we recommend this is set to Off

  Share chats that use connectors - we recommend this is set to Off

  Rate chats - we recommend this is set to Off
  

If you are on Claude Team

Get Techary’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

These all live under Organisation settings in claude.ai.

• Rate chats (Data and privacy). This toggle sends the whole conversation to Anthropic, where it is kept for up to five years and may be used for training. Owners can switch this off for everyone. For most SMEs handling client data, that is the one setting to change today.
• Memory (Capabilities). Owners decide whether memory is available at all. Each person then opts in and controls their own. Owners cannot see individual memories, and turning memory off for the organisation permanently deletes everyone’s.
• Connectors (Connectors). An Owner adds a connector, such as Microsoft 365 or Google Drive, and each person then signs in with their own account. Owners can also limit which actions a connector is allowed to take.
• Cowork (Cowork). Claude’s task agent is on by default for Team plans, and so is “Automatically approve” mode, which lets Claude act without asking each time. Decide whether that suits how your business works.
• Web search and Claude in Chrome. Both can be turned off by Owners if you do not want Claude reaching out to the web or acting in a browser.
• Incognito chats. These are kept out of chat history and memory, but on Team they are still retained for at least 30 days and included in admin data exports. Worth telling staff, so nobody assumes incognito means invisible.
• SSO and domain capture. Use these to bring anyone using a personal Claude account with a work email into the Team workspace, where your settings apply.

If you need custom retention periods or tighter admin controls, those sit on the Enterprise plan.

ChatGPT

On personal accounts (Free, Plus and Pro), training is controlled under Settings, Data controls, “Improve the model for everyone”. Turning off Memory does not opt you out of training. They are separate settings.

Settings > Data Controls

On Business and Enterprise, training is off by default.

The setting SMEs tend to miss is connectors, which link ChatGPT to tools like SharePoint, Google Drive and your CRM. On Business plans connectors are switched on by default, while on Enterprise they start off.

Admins should review which connectors are enabled and who can use them, and check memory at workspace level as well as for individual users.

Again, a key is looking to enforce SSO on any access to this tool.

Copilot

Copilot is the easiest to get right and the easiest to get wrong. Signed in with a work account, Copilot Chat comes with Microsoft’s enterprise data protection, with no admin action needed. Signed in with a personal Microsoft account, the same app runs under consumer terms.

Make sure staff sign in with their work account, and use Tenant Restrictions to stop personal accounts being used on company devices.

If you have Microsoft 365 Copilot licences, check whether Anthropic models are enabled in your tenant, since that affects which providers process your data.

Across all three:

• Enforce SSO to the application, this reduces shadow usage of users using your work accounts to login to unapproved plans
• Domain capture amongst the business instance of the tool so work accounts can only sign in to your approved plan
• Turn off training on any consumer account you cannot yet move
• Review connectors, memory and retention settings in the relevant administrator console
• Keep a policy on what data may and may not go into AI tools internally

If you are looking for help in navigating these tools, Techary provide a range of services to SMEs to help implement AI tooling.

Reach out today to contact and find out more about how we can help ensure your data is protected.

Correct at the time of writing

These tools can change quickly. Plans, defaults and retention periods have shifted several times in the past year alone. Everything here was correct at October 2026, but we recommend checking the vendors’ own privacy pages before acting on any information.

The principle doesnt change though, the defaults decide where the data goes, and are set by the plan.

Sources

• Anthropic: How long do you store my organization’s data?
• Anthropic: How long do you store my data? (consumer plans)
• Anthropic: Data retention practices for covered models
• Anthropic: Is my data used for model training?
• Anthropic: Claude chat search and memory, including owner controls
• Anthropic: Use connectors to extend Claude’s capabilities
• Anthropic: Use Claude Cowork on Team and Enterprise plans
• Anthropic: What is the Team plan?
• Microsoft: Data protection when using Copilot Chat for work or school
• Microsoft: Manage Microsoft Copilot Chat
• Microsoft: Which Copilot is right for your organisation
• OpenAI: ChatGPT Business release notes
• OpenAI: ChatGPT Enterprise and Edu release notes