AI Data Exposure and Vendor Risk Assessor

Sending data to an AI vendor is now a routine decision made with almost no structure, and the anxiety is real: is the proprietary corpus that is our moat about to train a competitor's model, is customer data leaving our control, what does this vendor actually retain? The honest answer is usually nuanced — some data is completely fine to send to an enterprise zero-retention tier, and some genuinely should never leave your environment — but teams rarely have a way to tell which is which. AI Data Exposure and Vendor Risk Assessor runs that assessment. Describe the data, the use case, and the vendor and tier, and it classifies each data element as moat, regulated, contractual, or low-sensitivity; maps the real exposure vectors for that tier — training on inputs, retention, sub-processors, output memorization, jurisdiction — and distinguishes default consumer behavior from enterprise and self-hosted terms, which are often opposite; lists the exact questions to get in writing from the vendor before anything is sent; and gives a tiered recommendation per data type: send freely, send with specific controls (redaction, minimization, a no-training agreement, region restriction), or keep in-house. It is even-handed, not anti-AI — the right answer is often that the data is fine on an enterprise no-training tier, and it says so — and it reserves the highest bar for the true moat, whose value depends on exclusivity. The download includes three reference files: the data-sensitivity worksheet, an exposure-vectors and vendor-questions guide, and a worked sample assessment. It is decision-support, not legal advice, and it does not assert what any named vendor does with your data — terms vary by tier and change, so it tells you what to verify directly. Works with Claude Code, Cursor, Codex CLI, Gemini CLI, and any SKILL.md agent.