Start with data minimization
Do not send an entire customer record when the model needs one field. Remove identifiers, secrets, and unrelated history before the request. Smaller context is also cheaper and easier to inspect.
Controls that belong in the application
- Separate tenants and projects at the data layer.
- Use server-side credentials, never client-exposed admin keys.
- Allow only approved models and tools for sensitive workflows.
- Redact credentials and unnecessary personal information.
- Log who accessed what without copying sensitive content into logs.
- Set deletion and retention rules for prompts, outputs, backups, and vendor systems.
Test the privacy boundary
Try cross-tenant questions, prompt injection inside documents, requests for deleted records, and attempts to reveal system instructions. A privacy policy is necessary, but it is not a test that the implementation actually enforces the policy.