Can we put contracts, prices and customer lists into an AI?
Short answer
The GDPR protects people, not companies. But prices, contracts, customer lists, strategy and project names are trade secrets, and they are only protected if you take reasonable steps to keep them secret. Putting them into an AI service that may use them for training can weaken that protection – and breach confidentiality clauses. Use business plans with no training, and hide what the AI doesn't need: names, amounts and your secret words.
What the AI sees
| Customer | Location | Topic | |
|---|---|---|---|
| Sarah Murphy | sarah.murphy@example.com | Cork | Refund |
| Daniel Kelly | daniel.kelly@example.com | Galway | Delivery |
| Claire Walsh | claire.walsh@example.com | Limerick | Complaint |
| Thomas Camilleri | thomas.camilleri@example.com | Sliema | Delivery |
| Emma Byrne | emma.byrne@example.com | Dublin | Refund |
Enquiry Hi, my name is Sarah Murphy and I returned order 7012345678 two weeks ago, but I still haven't received my money. Please transfer it to IE29 AIBK 9311 5212 3456 78. Kind regards, Sarah
| Customer | Location | Topic | |
|---|---|---|---|
| [PERSON_1] | [EMAIL_1] | [STED] | Refund |
| [PERSON_2] | [EMAIL_2] | [STED] | Delivery |
| [PERSON_3] | [EMAIL_3] | [STED] | Complaint |
| [PERSON_4] | [EMAIL_4] | [STED] | Delivery |
| [PERSON_5] | [EMAIL_5] | [STED] | Refund |
Enquiry Hi, my name is [PERSON_1] and I returned order [ID_1] two weeks ago, but I still haven't received my money. Please transfer it to [IBAN_1]. Kind regards, [PERSON_1]
Sarah Murphy and Emma Byrne are waiting for a refund and should get a reply today. Thomas Camilleri has waited 10 days for a parcel. Suggested reply to Sarah Murphy: "Dear Sarah Murphy, thank you for your patience. Your money is on its way and will be in your account within 5 working days."
[PERSON_1] and [PERSON_5] are waiting for a refund and should get a reply today. [PERSON_4] has waited 10 days for a parcel. Suggested reply to [PERSON_1]: "Dear [PERSON_1], thank you for your patience. Your money is on its way and will be in your account within 5 working days."
| Candidate | Born | ID number | Employer | Experience |
|---|---|---|---|---|
| Louise Brennan | 1985-03-12 | 1234567TA | Shannon Timber Ltd | 12 |
| Michael Doyle | 1992-11-02 | 2345678KB | Liffey Logistics Ltd | 4 |
| Maria Borg | 1988-06-21 | 0123488M | Grand Harbour Metals Ltd | 9 |
| David Fenech | 1979-01-30 | 0456779M | Valletta Pharma Ltd | 18 |
CV Louise Brennan has 12 years' experience in budgeting and monthly reporting at Shannon Timber Ltd. She implemented a new ERP system and leads a team of three. Contact: louise.brennan@example.com.
| Candidate | Born | ID number | Employer | Experience |
|---|---|---|---|---|
| [PERSON_1] | 40–49 years | [ID_1] | [VIRKSOMHED_1] | 12 |
| [PERSON_2] | 30–39 years | [ID_2] | [VIRKSOMHED_2] | 4 |
| [PERSON_3] | 30–39 years | [ID_3] | [VIRKSOMHED_3] | 9 |
| [PERSON_4] | 40–49 years | [ID_4] | [VIRKSOMHED_4] | 18 |
CV [PERSON_1] has 12 years' experience in budgeting and monthly reporting at [VIRKSOMHED_1]. The person implemented a new ERP system and leads a team of three. Contact: [EMAIL_1].
Louise Brennan and Maria Borg have more than 5 years' experience and should be invited to interview; ask Maria Borg about experience with ERP systems. Michael Doyle has 4 years' experience; the requirement is 5. A person makes the decision.
[PERSON_1] and [PERSON_3] have more than 5 years' experience and should be invited to interview; ask [PERSON_3] about experience with ERP systems. [PERSON_2] has 4 years' experience; the requirement is 5. A person makes the decision.
| Supplier | Contact | Account | Expires |
|---|---|---|---|
| Atlantic Components Ltd | Peter Walsh | IE64 IRCE 9205 0112 3456 78 | 2027-01-31 |
| Malta Data Hosting Ltd | Anna Grech | MT84 MALT 0110 0001 2345 MTLC AST0 01S | 2026-12-31 |
| Midlands Precision Ltd | Simon Nolan | IE12 BOFI 9000 0112 3456 78 | 2028-06-30 |
| Celtic Packaging Ltd | Nicole Ryan | IE02 AIBK 9310 6512 9876 54 | 2027-03-31 |
Terms Atlantic Components supplies specialist components for Project Skellig. The price is adjusted annually by the consumer price index plus 3%. Liability is capped at 10% of the annual contract value. Contact Peter Walsh about any changes.
| Supplier | Contact | Account | Expires |
|---|---|---|---|
| [VIRKSOMHED_1] | [PERSON_1] | [IBAN_1] | 2027-01-31 |
| [VIRKSOMHED_2] | [PERSON_2] | [IBAN_2] | 2026-12-31 |
| [VIRKSOMHED_3] | [PERSON_3] | [IBAN_3] | 2028-06-30 |
| [VIRKSOMHED_4] | [PERSON_4] | [IBAN_4] | 2027-03-31 |
Terms [VIRKSOMHED_1] supplies specialist components for [PROJEKT_1]. The price is adjusted annually by the consumer price index plus 3%. Liability is capped at 10% of the annual contract value. Contact [PERSON_1] about any changes.
Atlantic Components Ltd renews automatically unless it is terminated by 31 October. It is important for an internal project, so renegotiate the price rather than terminate. Celtic Packaging Ltd also renews automatically; the deadline is 31 December.
[VIRKSOMHED_1] renews automatically unless it is terminated by 31 October. It is important for an internal project, so renegotiate the price rather than terminate. [VIRKSOMHED_4] also renews automatically; the deadline is 31 December.
Fictional data. Choose ‘Contracts’ to see suppliers, account numbers and project names hidden.
Secret words
Names are found automatically, but no machine can guess that a project name like ‘Northlight’ or a product in development is secret. That is why you can add your own words in GoalCube. They are hidden everywhere, in upper and lower case and other spellings, and the log never stores the word itself.
What to do
- Identify your secrets.Project names, products in development, customers, prices, acquisitions.
- Check your contracts.Are you allowed to share the terms with a third party such as an AI provider?
- Use plans with no training.And with a data processing agreement and confidentiality.
- Add secret words.In GoalCube they are hidden in every dataset, however they are spelt.
- Put it in your policy.What must never go into an AI?
What the law says
- Article 2(1) Directive (EU) 2016/943 – definition of a trade secret
- Information is only a trade secret if reasonable steps have been taken to keep it secret.
- Directive (EU) 2016/943 on trade secrets
- The EU rules behind the national trade secrets laws in every EU country.
Questions and answers
Are company names protected by the GDPR?
No, but the names of contact persons are. And a sole trader is often a person.
What are secret words in GoalCube?
Your own words – such as ‘Project Northlight’ or a new product line – that are always replaced with a code before the AI sees the text.
Can the AI leak our prices to others?
Not if the service doesn't train on your data and you don't share them. With GoalCube, the AI only sees codes for names and secret words.
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.