Using AI safely - Our privacy concerns
We’ve been asked quite often what role AI plays in our Databeamer service. The
short answer: we hardly use it. And we certainly do not use it to scan or
analyze your data, to train models or to create user profiles. Not openly, and
not quietly in the background.
But as AI tools are now everywhere, we also want to give you some advice. If you
care about privacy, data security, and digital independence, it’s worth taking a
closer look at some aspects of how AI-powered services actually handle your
information.
AI is useful but also a risk for your privacy
Artificial intelligence can be powerful and even helpful. But in many of today’s
tools, it also comes with hidden trade-offs.
Most AI powered tools today (even those branded under different names) rely on
the so-called frontier large language models (LLMs) and are mainly created by
American or Chinese companies. This therefore creates privacy and security risks
related to the EU AI Act and GDPR. European alternatives do exists, but at the
moment they are still less common/not well known (see for example Finalist’s
tech blog for 10 European
alternatives).
In most cases, these models run in the cloud, meaning the service provider sends
your prompts and data to those external systems for processing.Technically it is
possible to self-host such a LLM. True self-hosting (running a copy) is very
rare, as it requires high maintenance and is very costly.
Some companies use the LLM by pseudo self hosting: the company server acts as an
intermediaries or proxy, but the LLM still runs on the frontier AI’s (e.g.
OpenAI) infrastructure. This can create the appearance of local hosting and may
offer limited compliance benefits (such as filtering personal data) but data
still flows to OpenAI’s servers.
Most services opt for the hosted API options which ensures that all computation,
data and prompt handling occurs entirely on the LLM makers servers. The trade
off is clear: when data is processed through those external clouds, it leaves
your controlled environment. The companies behind these AI models may store,
analyze, or reuse that information in ways you cannot fully oversee or control.
In practice, this often means your data leaves the EU and is handled by large
non European technology providers.
Be careful with AI that connects everything
Many users rely on Microsoft or Google for email, documents, and scheduling.
Both companies now promote their AI assistants ( Copilot and Gemini) as helpful
productivity tools. But convenience can come with a cost. Have a look at
Microsoft Copilot as an example.
Microsoft Copilot example
Copilot can automatically access and cross-reference your data across your
entire Microsoft 365 application suite (among others Outlook, Teams, Word, and
OneDrive, depending on your subscription). For businesses, this can mean that AI
suggestions are built from sensitive internal information (e.g. emails,
presentations, or chats).
Copilot offers some options to control what it remembers about you and whether
your conversations are used for model training. However, these are opt-out
settings, so it is uncertain how many users will actively change them. In
addition, opting out of model training does not prevent your conversations from
being used for advertising or other purposes. Changes to these settings may take
up to 30 days before they become fully effective.
For better governance of your privacy and security, Microsoft offers an add-on
suite called Microsoft Purview Suite. Purview is only available for higher-tier
business licenses and requires active setup, meaning many smaller businesses or
personal users don’t have these protections by default. So unless your IT team
has carefully configured Microsoft Purview, Copilot can “see” and probably reuse
that content across your organization.
And even when Purview is enabled and configured, it still depends on employees
correctly labeling documents and emails as sensitive so Copilot will skip them.
But will every employee consistently do this? And what about older or archived
content that remains accessible to Copilot by default? Even with a high level of
privacy awareness in your organization, this is an easy step to overlook.
Bing Copilot and personalized ads
If you use Copilot through Bing or Edge, your prompts can also be used for ad
personalization. Microsoft even notes that the “personalization” settings for
Copilot do not affect whether you receive personalized
ads.
So, your AI interactions might influence what ads you later see online.
Expanding to other providers
Microsoft also now allows enterprise users to activate Claude (Anthropic) within Copilot.
The reason is that this is part of Microsoft’s move to diversify beyond OpenAI.
But when you enable, your data is not longer in Microsoft space but moves to
Antropic (actually even trough AWS). So when you enable this, you lose your data
governance & control, audit and compliance rules and more and adding the rules
and jurisdiction of another American company. If privacy and compliance are
important to you, this means you’re losing visibility, auditability, and EU
governance.
“Privacy Washing”: The illusion of control
Generative AI models rely on massive amounts of data to learn and improve. This
makes any user data that model providers can access extremely valuable. However,
there is growing scrutiny over what types of data are collected, how it is
obtained, and where it is stored, with legal questions emerging around
copyright, privacy, and data protection. The EU’s investigation into Googles
Gemini
is a good example for this.
To get away with this, "Big Tech" has mastered the art of privacy washing:
presenting themselves as privacy-conscious while quietly collecting vast amounts
of user data. You might see dashboards full of toggles and controls to
customize, but even with all privacy settings maxed out, these companies often
continue collecting usage data, metadata, and behavioral signals.
Be cautious with AI-powered browsers like Atlas
A newer trend we’re seeing is the rise of AI-powered browsers, such as Atlas,
which comes with built-in AI features like ChatGPT integration. Atlas actively
tracks user browsing behavior, clicks, and interaction patterns to personalize
your online experience. While it claims not to store passwords or full personal
data, it’s unclear what information it does retain and for how long.
Its “agent mode”, where the AI can autonomously perform actions on your behalf,
has also raised security concerns in independent research. For instance, a
recent study by the University of Sydney highlighted potential vulnerabilities
related to AI-driven automation and data
exposure.
In practice, this could mean that such a browser might have visibility into
everything shown on your screen, including unencrypted messages or file content
displayed within secure platforms like Databeamer.
So for now we certainly do not recommend using the Atlas AI Browser to access
Databeamer or actually any other website.
Keeping the human touch
Not everything needs to be automated. We believe that humans (and not
algorithms) should remain at the center of collaboration, decision-making and
certainly creativity. Technology should assist, not replace, and should
certainly not exploit the people who use it.
That’s why we’re deliberate about AI. When we add it, it will be because it adds
genuine value to you, and because we can guarantee it respects your privacy,
your sovereignty, and your trust.
A look ahead
We don’t believe in using AI just because it sounds innovative. But we do
continue to explore responsible, EU-based AI technologies that could enhance
productivity while keeping every process local, auditable, and under user
control.
In our field, we see potential future uses that could genuinely make your work
easier. For example we are now working on:
- Generating form templates automatically from a spoken or written prompt (as part of our ‘open request’ functionality);
- Generating rules or regex patterns (as part of our validation functionality within file requests).
When we introduce AI for features like this, it will be:
- Transparent about what it does.
- Optional and consent-based.
- Designed so your data never leaves the EU and never trains a general-purpose model.
Because AI should work for you and not the other way around