Is it safe to connect AI to our other systems or share data between platforms?

What a connector is

On its own, an AI assistant only knows what you type into it. A connector (or integration) lets it reach into another tool: shared files, email, a calendar, a CRM or a database. That is where much of the value can come from, because the AI can work on current information instead of copies.

Many connectors now use MCP, the Model Context Protocol. Its official site describes it as an open standard for connecting AI applications to external systems, and compares it to a USB-C port: one common plug that many tools can use. A standard plug makes connecting easier. It does not decide what is safe to connect; you still do.

Would it help to sort your planned AI connections into allow, ask and deny before anyone switches them on? Book a free AI Value Briefing and we will look at it with you.

The AI acts with the user's access

In many products the AI sees what the signed-in person can see. Microsoft, for example, states that Copilot only surfaces organisational data to which an individual user has at least view permission. That is reassuring, but it has a consequence: if a salary spreadsheet or a board paper has been shared with the whole company by mistake, an AI search can surface it in seconds.

• Review sharing on sensitive folders and sites before switching on AI search.
• Give each connector the least access that does the job: one folder, one mailbox, read-only first.
• Add write access (sending, editing, deleting) only for a proven task, with a person approving each action.

When content can give orders

A connected AI reads emails, documents and web pages written by other people. Some of that text may contain hidden instructions, which security experts call indirect prompt injection (OWASP LLM01). If the AI can also send or change things, a planted instruction could become a real action.

The answer is not clever wording in the AI's instructions, which can be bypassed. It is limits: fewer tools, narrower permissions and human approval for high-impact actions, as OWASP recommends for excessive agency. The security guidance in the MCP specification makes the same point for connections, advising a minimal set of permissions at the start and extra permissions only when a task needs them.

Data flowing between vendors

Connecting two platforms often means data leaves one vendor and reaches another, sometimes through a third. Each company that handles your data for a vendor is called a sub-processor.

Details matter. Microsoft's own page notes that third-party agents have their own privacy statements and terms, and that models provided by Anthropic as a sub-processor within Copilot are currently excluded from its EU Data Boundary (Microsoft Learn). Neither point is a problem in itself, but each is something your IT and data protection teams should know before switching a feature on.

• Ask each vendor for its current sub-processor list and where they process data.
• Check whether a connector stores copies of your data or only passes it through.

Approval and audit logs

Connections are easy to add and easy to forget. A simple routine keeps them under control:

1. IT approves each connector before use and keeps a list of what is connected, by whom, with what access.
2. Connectors use a separate account with limited rights where possible, not a person's full administrator access.
3. Activity logs record which connector was used, by whom, and what it read or changed.
4. Access is reviewed on a fixed schedule, for example every three months, and unused connectors are removed.

Goes deeper in our free AI Field Guide: 13. Connectors and integrations: letting AI use your tools safely, 26. Guardrails and permissions: what AI may and may not do, 19. AI that acts for you: browser and computer use, 10. Data safety: what never to paste, and other rules. Ask for these guides.