Keeping supporter data safe when you use Artificial Intelligence
It is the question every charity asks first, and it should be. Here is how the tools handle your data, where the real risks sit, and the five things we put in place before anything connects.
Is Artificial Intelligence safe for a charity’s data?
It can be, if three things are true: the tool is one whose data terms you have read, it can only see what it needs, and a person checks what it produces. Trust concerns about Artificial Intelligence more than doubled among charities between 2025 and 2026, and were highest among organisations working with marginalised communities. The Beacon incident showed what a breach in a sector platform means for supporters. None of this is a reason to stop. It is the reason to do it properly.
Where the risk actually sits
People pasting data into personal tools.
The most common breach is not a connected system. It is a member of staff putting a case note or a donor list into a free chatbot on their own account. A short policy and approved tools fix most of this.
Tools connected with more access than they need.
A connector that can see every object and field will, one day, surface something it should not. Access has to be scoped, written down and tested before anyone uses it.
Outputs acted on without a check.
An Artificial Intelligence draft that goes to a supporter or a service user without a human reading it is a risk whatever tool produced it. A person stays accountable for everything that leaves the organisation.
How the tools handle your data, in plain words
Each vendor publishes its own data terms. These are the themes that matter to a charity. Plans and features differ, so we confirm the current terms for your set-up before anything is switched on.
Agentforce (Salesforce)
Where it runs
Inside Salesforce. Agents and Agentforce Coworker retrieve only what the signed-in person is allowed to see, so your permissions and field-level security carry through.
Training and retention
Salesforce’s Einstein Trust Layer includes zero data retention agreements with the model providers, detection of harmful responses and an audit trail of every interaction.
Watch for
Data masking of sensitive values applies to certain features only. Salesforce documents that it does not apply to agents.
Our check
We confirm which protections apply to your edition and the features you use before anything is switched on.
Claude (Anthropic)
Where it runs
In Claude’s Team or Enterprise plans, connected to your systems through connectors that administrators approve. A connector only sees what the person can already see in the connected system.
Training and retention
Anthropic’s published terms say that inputs and outputs on Team and Enterprise plans are not used to train its models by default. Enterprise adds audit logs and retention controls. Charities get discounted plans.
Watch for
Personal and consumer accounts have different terms. Your policy, like ours, should rule them out for work.
Our check
We use Claude across Cirrico under our own published policy, connected to our own Salesforce, and we confirm the current terms with you at set-up.
Microsoft Copilot
Where it runs
Inside your Microsoft 365 tenant, under the permissions and compliance settings you already have.
Training and retention
Microsoft states that its product terms, data protection addendum and enterprise data protection cover Copilot, including when Anthropic’s Claude is the model, with Anthropic acting as a Microsoft subprocessor.
Watch for
Microsoft states that the Anthropic models in Copilot sit outside its European Union data boundary commitments, and that for organisations in the United Kingdom they are off until an administrator switches them on. Model choice is a decision to record, not a default to inherit.
Our check
We confirm the terms for your licence and which models are switched on in your tenant before anything is used for work.
The five things we put in place before anything connects
Step one
Data classification
A one-page list of what may go into an Artificial Intelligence tool and what never may: no service-user records, no safeguarding notes, no financial or health data unless a specific control covers it.
Step two
Scoped access
A named, read-only permission set or a dedicated integration identity so the tool sees only the objects and fields it needs. Where that is not possible for a tool, we say so and recommend a different route.
Step three
A short policy
Version one of an Artificial Intelligence policy and acceptable use rules for staff, written for your organisation, not copied from a template.
Step four
Human review
A rule that nothing produced by Artificial Intelligence reaches a supporter, service user or funder without a named person reading it.
Step five
A test that proves it
We show you a field the tool cannot see, and we keep the evidence. If it fails the test, it does not go live.
What should a charity’s Artificial Intelligence policy cover?
Half of charities have no policy. A good one is two pages and covers eight things.
Purpose: what the organisation wants Artificial Intelligence to do and not do.
Approved tools and accounts, and the rule against personal accounts for work.
Data that must never be entered, by category.
How a new use is proposed and approved, and by whom.
Human review of outputs, with the person accountable named.
Transparency with supporters, service users and funders about where Artificial Intelligence is used.
Training before use, for staff, volunteers and trustees.
Review every six months and after any incident.
We write a version one for you as part of Discovery and Planning. About Discovery and Planning
Frequently asked questions
Does Claude train on our data?
Can Artificial Intelligence see our safeguarding notes?
Where is the data processed?
Who is accountable if it gets something wrong?
Our commitments
We hold ISO 27001 and the Data Security and Protection Toolkit, our founder is our Data Protection Officer and Information Security Officer, and we use Artificial Intelligence ourselves under a published policy that says which tools we use, which data never goes in, and who stays accountable.