Is your AI setup safe? Let your own Claude check.

The prompt

You are helping me run a security check on how my company uses AI. I am not a security expert, so use plain words and explain any term the first time you use it.

Rules for you:
- Read only. Do not change a setting, send a message, delete or move anything.
- Never print a password, an API key or a token. If you find one somewhere it should not be, tell me where it is, not what it is.
- Ask me 1 question at a time and wait for my answer.
- When you do not know, say "I could not check this" and tell me who can.

Step 1. Ask me which of these my company runs on: Microsoft 365, Google Workspace, or something else. Then ask which AI tools we use (Claude, ChatGPT, Copilot, a legal AI product, others) and on which plan, and whether anything client-related goes into them.

Step 2. List the tools and connectors you can reach in this conversation (email, calendar, files, chat, a CRM, a case or practice management system). For each one, tell me whether you can read, write, or both. This is my real access map, so be exact.

Step 3. Walk me through these 11 questions, one at a time. For each, check what you can see yourself first, then ask me only for what you cannot see.
1. What does each AI tool actually do for us, and what kinds of data does it handle (client names, contact details, case facts, health or financial records)?
2. Where does that data live? Which company hosts it, in which country, on whose account: ours or a vendor's?
3. How does data move between our systems and the AI? Name every hop, and every place a copy is kept.
4. Who can sign in to each tool? Can anyone create their own account, or only people we add?
5. Does sign-in need a second step (an authenticator app or a code), and is it enforced for everyone or only offered?
6. What can the AI write or change in our systems, and what can it not touch? Can it send, delete or overwrite anything without a person approving it?
7. Where are our passwords and API keys kept? Has one ever been pasted into a chat, an email or a shared document?
8. What do the AI tools run on (a vendor's cloud, our own computers, a server)? Who keeps that updated, and what is open to the internet?
9. When someone leaves the company, what exactly do we do to remove their access, and how fast?
10. How long is data kept, how do we delete it, and what happens to it if we stop using the tool or the vendor?
11. Which outside people or companies have access to our systems for this (consultants, vendors, contractors), and with what level of permission?

Adapt the checks to my setup:
- On Microsoft 365: ask about or check multi-factor sign-in for every user, who the admins are, sharing settings on OneDrive and SharePoint, which third-party apps have been granted access, and whether Copilot is switched on and for whom.
- On Google Workspace: ask about or check 2-step verification enforcement, who the super admins are, Drive sharing outside the company, which third-party apps have access, and whether Gemini is switched on and for whom.
- On anything else: ask me what the equivalent is, and help me find the setting.
- For Claude itself: ask which plan we are on, whether our conversations can be used for training under that plan, which connectors are switched on, and who can switch them on.

Step 4. Give me a 1-page result with 3 lists:
- Fine as it is, with the reason.
- Fix this week, each with the exact steps or the exact setting name.
- Ask my IT person or vendor, each written as a question I can forward.
Then name the single biggest risk in 1 sentence.

This is a first check, not a legal or compliance opinion. If we handle regulated data (health records, payment data, privileged client files), say so and tell me which professional I should speak to.