Key takeaways
- Not all customer data carries the same risk — sorting it into a simple four-tier classification (public, internal, confidential, restricted) tells your team exactly what's fine to paste into AI tools and what isn't.
- Redaction — replacing a real name, account number, or address with a placeholder — turns a restricted piece of data into something usually safe to process with AI.
- An "approved tools" list matters as much as the classification itself: the same data that's fine on an approved business-plan tool can be a real exposure on a random free tool nobody vetted.
- 39.7% of AI interactions already involve sensitive data, according to Cyberhaven's research — most teams are already past the point where this needs a plan, not a hope.
- A one-page reference card that pairs each data tier with a clear rule beats a long policy document nobody opens.
Ask five employees whether it's okay to paste a customer's shipping address into an AI tool, and you'll probably get five different answers — including a few confident wrong ones. That's not a training failure so much as a missing framework: nobody has told them which categories of customer data are sensitive enough to matter, or given them a fast way to make a piece of text safe before they use it.
This guide gives you both: a data classification system with four tiers, and a practical redaction process your team can use in under a minute per document.
Why a classification system, not a blanket rule
"Never put customer data in AI" sounds safe, but it doesn't survive contact with a real workday. Someone needs to summarize a support ticket. Someone needs AI's help drafting a response to a customer question. A blanket ban either gets ignored — which is how you end up with the shadow AI problem covered in our shadow AI guide — or it blocks legitimate, low-risk work along with the risky stuff.
A classification system solves this by sorting data into tiers based on what happens if it leaks, then attaching a specific rule to each tier. Employees don't need to reason about risk from scratch every time — they just need to recognize which tier a piece of information falls into.
The four-tier data classification table
Most small businesses don't need the elaborate multi-tier systems built for hospitals or banks. Four tiers cover nearly every situation a small business runs into:
| Tier | Examples | AI tool rule |
|---|---|---|
| Public | Published marketing copy, public pricing, job postings, your own website content | Fine in any AI tool, including free consumer tools |
| Internal | Internal memos, non-sensitive meeting notes, general process documentation | Fine in approved business-plan AI tools; avoid free consumer tools |
| Confidential | Customer names with contact details, order history, vendor pricing, unsigned contracts | Approved tools only, and only after redacting direct identifiers when the task allows it |
| Restricted | Full account or payment numbers, government IDs, health information, passwords, signed NDAs | Never enter into any general-purpose AI tool, approved or not |
The line between "confidential" and "restricted" is the one worth drilling into your team, because it's the one that actually changes behavior: confidential data can often go into an approved tool once it's redacted; restricted data doesn't go in at all, full stop, redacted or not.
Cyberhaven's 2026 AI Adoption & Risk Report found that 39.7% of AI interactions already involve sensitive data — meaning most businesses are already past the classification stage without meaning to be. The gap usually isn't intent; it's that nobody defined the tiers, so employees default to "it's probably fine."
Redaction: making confidential data safe to use
Redaction means removing or replacing the specific piece of information that identifies a person, before the rest of the text goes anywhere near an AI tool. It's faster than it sounds, and it turns a lot of "restricted-adjacent" tasks into safe ones.
What to redact
- Full names — replace with "the customer" or a generic label like "Customer A"
- Account, order, or case numbers — replace with a placeholder like [ACCOUNT #]
- Addresses and phone numbers — remove entirely unless the task specifically requires geography (e.g., "customers in the Dallas area")
- Dates of birth, ages, and other identifying details not needed for the task
What to keep
Keep whatever the task actually needs to work: the nature of the issue, the product involved, the tone of the original message, the timeline. A support ticket that says "Customer A ordered [PRODUCT] on [DATE] and the shipment arrived damaged" gives an AI tool everything it needs to draft a good reply, without ever naming a real person.
Classification only works with an approved tools list
A data tier isn't a complete rule on its own — it needs to be paired with which tool the data is allowed to touch. "Confidential data, approved tools only" is only actionable if your team actually knows which tools are approved. Without that list, the same customer data that's reasonably safe on a vetted business-plan tool ends up on whatever free tool someone found first. See our guide to building an approved AI tools list for how to put one together, and our guide on ChatGPT specifically for how consumer and business plans differ on data handling.
Rolling this out without a big process
You don't need a formal data governance program to get the benefit of this system. A practical rollout looks like:
- Print the four-tier table. Post it somewhere people actually look — not buried in a shared drive folder nobody opens.
- Walk through five real examples from your own business — an invoice, a support ticket, a marketing email, a signed contract, a password reset request — and classify each one together as a team.
- Attach the redaction quick-check to any workflow where employees regularly paste customer text into AI tools.
- Name one person to answer "which tier is this?" questions when someone's not sure — see our AI champions program guide for how to structure that role.
- Review the list twice a year, since new categories of customer data show up as your business changes.
Applying the tiers by role
Different roles in a small business touch different tiers by default, and it helps to spell that out rather than leave every employee to guess where their own daily work lands.
| Role | Data tier most often handled | What to watch for |
|---|---|---|
| Front-desk / support | Confidential (names, contact details, order history) | Redact before summarizing a ticket or drafting a reply with AI |
| Billing / accounts | Restricted (payment and account numbers) | Never paste full account numbers into any AI tool, even an approved one |
| Marketing | Public / internal | Low risk, but keep unpublished campaign details out of free consumer tools |
| Operations / management | Internal and confidential mix | Vendor contracts and internal metrics usually count as internal, not public, even though they feel routine |
Walking through this table with your team, role by role, tends to surface a few surprises — usually a task someone assumed was "internal" that actually touches confidential customer data, or a habit of pasting a full document into an AI tool when only one paragraph of it was ever needed. Both are easy to fix once they're visible — and both are far more common than a business owner would guess before actually sitting down and walking through real examples with the team.
Beyond text: images, spreadsheets, and voice
Classification tends to get discussed purely in terms of typed text, but customer PII shows up in other formats just as often. A photo of a signed form, a spreadsheet export from your CRM, or a recorded customer call all carry the same tiers described above — a spreadsheet with customer names and order totals is confidential data whether it's pasted as text or uploaded as a file. If your team uses an AI tool that accepts file uploads or voice transcription, apply the same classification questions before uploading: what tier is this data, and is this an approved tool for that tier?
Common mistakes
- Redacting the name but keeping the account number. A record is still identifiable if any single unique field survives — redact all of them, not just the obvious one.
- Treating "internal" as equivalent to "public." Internal memos and process notes are still fine to keep off free consumer AI tools, even though they're not customer data.
- No restricted tier at all. Businesses that only think in "safe" and "risky" tend to miss that some data — health records, full ID numbers — should never go into any general AI tool, redacted or not.
- Skipping the tools list. A classification system without an approved-tools pairing just moves the ambiguity from "is this data safe?" to "is this tool safe?" — you still need both halves.
◆ Small Business AI Kickstart
Get AI ready today.
Before it's too late.
yforest AI Labs comes to your company, trains your team, and ships your first tools.
FAQ
What's the difference between confidential and restricted data?
Confidential data (like a customer's name and order history) can often go into an approved AI tool once it's redacted. Restricted data (full account numbers, health information, passwords) should never go into a general-purpose AI tool, redacted or not.
What does redaction actually mean in practice?
Replacing or removing the specific details that identify a person — full name, account number, address, phone number — while keeping the parts of the text an AI tool actually needs to do the task.
Do we need special software to redact data before using AI?
No. For most small-business tasks, manually replacing a name with "Customer A" and an account number with a placeholder before pasting text into an AI tool is enough.
How often should we review our data classification tiers?
Twice a year is a reasonable cadence, or sooner if your business starts collecting a new category of customer data it didn't handle before.
Does classification replace the need for an approved tools list?
No — they work together. Classification tells you what a piece of data is; an approved tools list tells you where it's allowed to go.
Sources
This guide is general information, not legal advice. Have a qualified attorney review any policy before you adopt it.