# How do we protect confidential data when using LLMs in production?

Design so that the model only sees what the task needs, and assume that anything it sees can come back out. Concretely: choose a deployment with contractual terms that fit your data, such as an enterprise API with no training on inputs, a defined retention period and processing in the EU where required, or a model you host yourself; minimise and pseudonymise what goes into prompts; in retrieval systems, enforce the user's own access rights on the documents the model may retrieve, so it cannot summarise files the user is not allowed to open; keep secrets, keys and system credentials out of prompts and context; filter outputs for personal data and secrets before they reach users or logs; limit what tools the model can call and require approval for actions; and log prompts and responses in a protected way for investigation, with retention set to match. Test against prompt injection and data-extraction attempts before launch and after each change. From the Pro plan, NetSenX shows which servers send data to which external AI services and how much, which helps confirm that production traffic goes only where the design says.

FAQ: [AI use and AI security](https://netsenx.com/en/faq/ai) · https://netsenx.com/en/faq/how-to-protect-confidential-data-when-using-llms-in-production

## Read next

- https://netsenx.com/en/shadow-ai-detection
- https://netsenx.com/en/ai-transparency

## Related questions

- [What is the Model Context Protocol (MCP)?](https://netsenx.com/en/faq/what-is-the-model-context-protocol)
- [What is a shadow MCP server and why is it a risk?](https://netsenx.com/en/faq/what-is-a-shadow-mcp-server)
- [How do I discover AI agents running in our company?](https://netsenx.com/en/faq/how-to-discover-ai-agents-running-in-our-company)
- [Should AI agents be treated as privileged automated users?](https://netsenx.com/en/faq/should-ai-agents-be-treated-as-privileged-users)
- [Can an over-permissioned AI agent leak customer data?](https://netsenx.com/en/faq/can-an-over-permissioned-ai-agent-leak-customer-data)