What AI data tools actually send to the model
Pasting a spreadsheet into a chatbot is the fastest way to analyse it and the easiest way to breach a data policy without noticing. The question worth asking is narrow: what exactly leaves the building?
"We take privacy seriously" is not an answer. Here is what to establish, and how we answer it ourselves.
The four questions to ask any AI data tool
- What is transmitted? The whole file, a sample, or only metadata such as column names? The difference between "all 40,000 customer records" and "three rows" is the difference between a breach and a prompt.
- Where does it go? The vendor's own servers, or straight to a model provider? Each hop is another organisation holding your rows.
- Is it retained, and is it trained on? Consumer chat tiers often retain by default. Business and API tiers usually do not. These are different products with the same logo.
- Can you verify it? Open network tab, ask a question, read the request. A vendor whose answer survives that is telling the truth.
What Malytics sends
When you ask the built-in AI a question, the prompt contains column statistics and the first three rows, limited to the first six columns — labelled in the prompt itself as illustrative shape, never as evidence.
Nothing is sent until you ask. Loading, cleaning, charting and querying all happen with no network request carrying your data at all.
You do not have to take that on faith. Open your browser's network tab and watch. That is the point of doing the work client-side: the evidence is on your machine.
Why a sample is enough
People assume an AI must read every row to say anything useful. For the questions people actually ask — which column is the date, what is driving the drop, write this up — the model needs the shape of the data, not its contents. The numbers themselves are computed locally and handed to the model as facts to narrate.
That split matters for correctness as much as privacy: a model that is shown computed figures cannot invent a different one. A model asked to do arithmetic over pasted rows frequently does.
If even that is too much
- Bring your own key so requests go to your own model account under your own agreement.
- Do not use the AI features. Loading, cleaning, SQL, charts, dashboards and statistics all work without them.
A reasonable default policy
If you are writing one for a team: personal data and anything contractually restricted should not be pasted into a consumer chat tier. Tools that compute locally and send only a sample are usually acceptable, because the thing that would cause the harm never leaves. Ask for it in writing, then verify it in the network tab.
Try it on sample data Open Malytics
No account needed to try it. The sample loads in your browser and nothing is uploaded.