Four levels decide what may be sent to an AI. PUBLIC can go anywhere, INTERNAL to systems you control, CONFIDENTIAL only with contractual guarantees against training and disclosure, and RESTRICTED is never sent. The classification is made on the source, not on the individual request.
You have financials, HR data, meeting notes, competitor analyses and customer segmentations.
You want an AI to analyse some of it. The question is how much.
The answer is not all of it. But it is more than most people assume, provided the classification was done in advance.
The four levels
PUBLIC
Anything already publicly available.
Examples: industry reports, competitors' published accounts, your own published case studies, public market analyses, prices you have published yourself.
Can go anywhere. There is no security boundary because there is nothing to protect.
INTERNAL
Company-specific but not confidential.
Examples: internal strategy notes, meeting minutes without personal data, your own segmentation model, process documentation, internal roadmaps.
Can go to systems you control. In practice that means processing inside the EU, an audit trail, and a contract stating that data is not passed on.
CONFIDENTIAL
Things that damage the business if they become known.
Examples: your business model and how it earns, partner terms, pricing decisions not yet announced, HR assessments, acquisition considerations.
Note that exact figures do not belong here. Revenue itself, gross margin and EBITDA are RESTRICTED, see below. The line is precision: that you earn through subscriptions is CONFIDENTIAL, what those subscriptions brought in last year is not.
Here the conditions must be written down rather than assumed. Three things need to be in place: processing happens somewhere you have agreed to, data is not used to train models, and there is a record of what was sent when.
Note that this does not require the model to run on your own server. That is a widespread misunderstanding. It requires the conditions to be contractual rather than implied. A local model without logging is no more confidential than a cloud model with a proper agreement.
RESTRICTED
Data that never goes to a model.
Examples: national ID numbers, card details, passwords and tokens, health information, private contact details tied to names. And exact financial figures: annual and monthly revenue, gross margin, net margin and EBITDA.
Not sent. Not to EU systems, not to local ones. If an analysis needs the context around such data, it works with aggregated or pseudonymised versions.
The boundary between CONFIDENTIAL and RESTRICTED is the only hard one, and the rule of thumb turns on two things: personal data is always RESTRICTED, and so are exact figures. Descriptions, terms and assessments are CONFIDENTIAL.
The second half surprises most people, since a revenue figure is about the business rather than about a person. But those exact fields are marked RESTRICTED in the platform's classification and stripped before anything is sent, so an analysis resting on them will be missing them without saying so. Note that ratios are not a way around it: gross_margin, net_margin and ebitda_margin are themselves RESTRICTED, as are customer acquisition cost, lifetime value and exact pricing. If an analysis needs to reason about the economics, describe the model rather than the numbers. Revenue model and cost structure are CONFIDENTIAL and may go in; it is the figures that may not.
What enforces the classification
A classification without enforcement is a spreadsheet nobody opens. In practice there are three layers, and they do different things.
Field level. Fields marked sensitive are stripped based on which kind of model is at work, before anything leaves the system. This is the only categorical layer. It does not guess, it looks up, and that is why RESTRICTED can be guaranteed.
Credentials. A scanner catches keys, passwords, tokens and certificates in free text.
Personal data in transit. Names, emails, phone numbers, national ID, IBAN and card numbers are handled by the layer closest to the provider.
The last two are pattern matching, and it is worth being precise about what that means: they can fail in both directions. They do not catch everything, and they sometimes block something harmless. They are a safety net under the classification, not a replacement for it.
That is also why skipping the classification and relying on the scanner does not work. A document called "customer list Q3" contains personal data whether or not a national ID number appears in it.
Classify your data in half an hour
1. Write down your data categories. For most companies there are five to eight: market data, internal strategy notes, financials, payroll and HR, customer data, contracts.
2. Give each category a level. One line per category. Meeting minutes are INTERNAL. Salary totals are CONFIDENTIAL. The customer list with contact details is RESTRICTED.
3. Agree the rule for doubt. If you are unsure, take the level above. That costs a little friction and no risk at all.
4. Tell the people who supply the data. Whoever uploads a document should know its level before uploading it. Not afterwards.
Point 4 decides whether this works. The classification is not a document, it is a habit in the five people who actually put files into the system.
What you get out of it
Without classification you send everything and hope. You do not know, and you cannot document it.
With classification you send what is safe, and you can account for it. If a question arrives from an auditor or a data protection authority, you can show what was sent, when and by whom. That documentation is both security and compliance, and it exists only if the classification was there beforehand.
What the EU AI Act requires on top of that is covered in the EU AI Act for SMEs, and how it plays with GDPR day to day is in GDPR and AI-assisted strategy.
Why RESTRICTED is bound to the node type on our side
The usual way to implement classification is as a setting. That holds until somebody is in a hurry.
In 360° Sprint, RESTRICTED fields are therefore bound to the node type itself. They are never sent to any AI provider, regardless of who is working in the system, and it cannot be switched off. That is a constraint, and it is deliberate: a security level that can be configured away is effectively a security level that has been configured away.
On top sit the secrets scanner and the handling of personal data in transit. There is also a check on the response on the way out, but it is not active on every path through the system, so treat it as a supplement rather than a guarantee.
Where processing happens, and why that is a question of place rather than of the vendor's nationality, is developed in AI and data security in the EU.
If you have not classified anything yet, start with one question: which data would be a problem if it became public tomorrow? That is at least CONFIDENTIAL. The rest falls into place quickly.
Classification is the first step. The rest of the decision is in can we use AI on our own data.
What the classification makes possible in strategy work itself is in AI for business strategy.