Two employees use the same AI assistant. One goes through a personal subscription, the other through a business account processed in Europe. On screen, nothing changes. For the company’s data, these are two different situations.
IndustryHub has published a detailed analysis, offer by offer. Here is the essence of it, without the jargon.
Three questions are enough
A product’s name does not tell you where the data goes. Three questions do: which contract, which place, which trace. The trace is the access log: a record that shows afterwards who sent what.
Five options, from the most exposed to the most controlled
- Personal account, free or paid. Paying does not change the category: an expensive subscription is still an individual’s account. Whether conversations are used to train the model depends on each employee’s setting, and the company has no business contract, no account administration and no access log.
- Business account. By default, data is no longer used for training. But processing in Europe is not guaranteed, and the access log depends on the offer.
- Business account, processing in Europe, access log on. All three conditions count. If one is missing, the option falls back to the previous level.
- Qualified European cloud. In France, the benchmark is SecNumCloud, the qualification from ANSSI, the national cybersecurity agency. It requires protection against non-European laws, and it covers a specific service, not a brand.
- Model installed on your premises. No AI provider receives the data. In return: a server to size, in-house skills, and models that often lag behind on the hardest tasks.
The trap: hosting in Europe settles the place, not the law. An American provider remains subject to the CLOUD Act, a law that also covers data stored abroad. A European region at such a provider is therefore not enough for the most sensitive data.
One program, four answers
Take a standard electrical diagram, classed as confidential, and Claude Code, an assistant for developers. The answer changes with the way it is connected.
These answers come from a deliberately cautious grid. A company may decide that a business account is enough for its everyday diagrams. That is a decision to take and put in writing, not to leave to each employee.
An assistant sees what the user sees
Microsoft 365 Copilot presents any content the person is allowed to view. A folder shared too widely becomes reachable with a simple question. File access rights should therefore be reviewed before connecting an assistant.
What to check in your organisation
- The account is in the company’s name, not an employee’s.
- The contract and its data processing agreement are on file.
- Training is switched off for the whole organisation.
- The place of processing is written into the contract, not just the place of storage.
- The access log is on, and someone knows how to read it.
- File access rights have been reviewed.
Choosing an option is not a question for the IT department alone: it is a business decision that depends on how sensitive the documents are. A small organisation does not need the heaviest solution for everything. It needs to know which data goes where, and to put that in writing.
Key points
- A tool’s name guarantees nothing: the contract, the place and the access log make the difference.
- A paid subscription is still a personal account.
- Europe settles the place, not the law that applies to the provider.
- For the most sensitive data, IndustryHub recommends a qualified cloud or a model installed on your premises.
- The rule is decided and written down at company level, not employee by employee.
These offers change often: this summary draws on IndustryHub’s analysis, based on provider pages consulted on 31 October 2026. The signed contract prevails. This text is not legal advice. Source: IndustryHub, “AI accounts and hosting: what really changes between the plans”, which lists all the provider references.