How KGTeams handles client information.

1. Core privacy rule

KGTeams is designed to use the minimum amount of client information necessary to perform an approved task. Privacy should be enforced before information reaches an AI system, not fixed after unnecessary information has already been sent.

• •Client ownership: client business information remains the client's information.
• •Data minimization: retrieve, send and store only what is needed for the current task.
• •Client isolation: one client's information must never be used in another client's context.
• •Least privilege: people, AI Employees and integrations receive only the access needed for their role.
• •Human control: sensitive decisions, approvals and material workflow changes remain subject to authorized human review.

2. Storage and processing are different

A system can process information without becoming the permanent home of that information. An AI model may need to process selected context to answer a question even when the client keeps the permanent record in Lark, Google Drive, an ERP, CRM or another client-controlled system.

KGTeams distinguishes where data is stored, which systems temporarily process it, and who controls the accounts, credentials and permissions.

Where practical, KGTeams favors client-controlled source systems and avoids unnecessary duplicate copies of client data.

3. Data categories

Green - routine operational data: information that can normally be used for an approved workflow, subject to the client's permissions.

Restricted - confidential business or personal data: process only when necessary, authorized and the approved provider/settings are appropriate.

Never send as ordinary AI context: passwords, authentication codes, private API keys, secret tokens, full payment-card credentials, banking login credentials, client-prohibited information, or unrelated sensitive information.

4. AI Employee behavior standard

• •Ted explains workflow possibilities, collects requests, routes approvals and tracks status. Ted does not claim a technical change is complete unless the system confirms completion.
• •Priya helps teach and analyze business processes. Priya asks only for information relevant to the process being trained.
• •Ollie supports onboarding. Ollie collects only the onboarding information required for the current stage and makes clear why it is needed.
• •Andy supports business analysis. Andy works from approved business context and avoids pulling unrelated company records.
• •The same rules apply to every future KGTeams AI Employee unless a stricter role-specific standard is approved.

5. Requests, approvals and auditability

AI Employees should distinguish between received, under review, awaiting approval, assigned, in progress, testing, ready for review, completed and closed. A request must not be described as completed merely because it was submitted or escalated.

• •Material process changes require the appropriate approving manager or authorized owner.
• •Every actionable request should have a clear owner and status.
• •Important decisions and approvals should be recorded in the approved source system.
• •Where useful, KGTeams may retain minimal operational metadata without duplicating the underlying confidential record.

6. Client-controlled systems

KGTeams prefers a model in which the client controls its business systems, credentials and production data wherever practical. KGTeams may be granted access to build, configure, test or support an AI Employee, but the client should be able to control or revoke that access according to the agreed deployment model.

7. Provider and model controls

KGTeams does not assume every AI or cloud provider has the same training, retention, residency or access rules. Before confidential client data is enabled in a production workflow, the relevant provider terms and settings should be checked for the actual plan and deployment being used.

• •Verify training-use settings and opt-outs for the specific account or workspace.
• •Understand retention controls before sensitive information is introduced.
• •Identify material third-party subprocessors and integrations.
• •Make client-facing promises only when the relevant control can be verified.

8. Access and permissions

• •Use role-based access where available.
• •Do not give an AI Employee broad access merely because an integration technically allows it.
• •Do not expose one client's records to another client, employee or AI Employee without explicit authorization.
• •Store production credentials in approved secret-storage mechanisms, not chats or ordinary documents.
• •Review access when roles change, a project ends or a client requests removal.

9. Retention, deletion and offboarding

KGTeams should retain information only for as long as there is a legitimate operational, contractual or legal reason to keep it. Deletion requests are handled according to the systems involved and any applicable agreement. Deleting information from one interface does not automatically mean every provider backup, log or subprocessor copy has been deleted.

Offboarding should cover data export where applicable, revocation of access, credential rotation, disabling integrations, transfer of client-owned materials and closure of outstanding requests.

10. Incident handling

If KGTeams suspects unauthorized access, cross-client exposure, credential leakage, an incorrect permission or unintended processing of sensitive information, the workflow should stop where appropriate and be escalated immediately to the responsible human owner. The incident should be documented, contained and communicated according to the client agreement and applicable requirements.

11. Build now

• •Minimum-necessary retrieval for every AI Employee.
• •Client-by-client separation of records and permissions.
• •Clear warning not to paste passwords, API keys or payment credentials into AI chats.
• •Approval routing for material workflow changes.
• •Accurate request statuses and no false claims of completion.
• •Remove website language that promises privacy controls KGTeams cannot verify.

12. Open deployment decisions

• •Which system is the permanent source of truth for the client.
• •Which AI/model provider processes each type of request.
• •Whether the applicable account or workspace permits model-training opt-out.
• •Retention, deletion, backup and data-residency behavior.
• •Whether a client-owned API/account should be used for production AI processing.
• •What minimal operational metadata KGTeams needs to retain for support and billing.