Should I open a company account, or is personal enough?
Everyone uses their own account — is that a problem? It works in the short term, and over time company data accumulates in personal accounts. 🔐
This is not a cost preference but a question of ownership and oversight: the company’s work should sit in the company’s account.
Short answer: once more than a couple of people use it regularly, move to a company account. The threshold is not headcount but how critical the work is. ⚖️
What happens on personal accounts?
BU BÖLÜMÜN ÖZETİ
- The data stays with the person
- Settings go unchecked
- Rules cannot be written
- Cost is invisible
Three things accumulate invisibly. 👻
The data stays with the person
Uploaded documents, written briefs and accumulated conversations live in a personal account. When they leave, it all goes. 🚪
Settings go unchecked
Whether inputs are used for training is left to individual preference. The company does not know where its data goes. 🔍
Rules cannot be written
Which documents may or may not be uploaded cannot be set centrally; the logic sits in the data security guide. 📋
Cost is invisible
If everyone pays with their own card, total spend appears nowhere and arrives as scattered expenses. 💳
What does a company account give?
BU BÖLÜMÜN ÖZETİ
- Central data settings
- Access management
- A shared workspace
- One invoice and visibility
Four things; three of them are not about money. 🏢
Central data settings
Keeping inputs out of training is usually the default on business plans and is managed from one place. 🔐
Access management
Opened when someone joins, closed when they leave. A departing employee’s access ends automatically. 🔑
A shared workspace
Ready briefs, templates and shared areas. What one person learns becomes the team’s asset. 📚
One invoice and visibility
Total spend and usage in one place. Idle seats become visible. 📊
When do you move?
BU BÖLÜMÜN ÖZETİ
- Signal 1: sensitive documents
- Signal 2: regular use
- Signal 3: output goes to customers
One of three signals is enough. 🚦
Signal 1: sensitive documents
If customer data, contracts, price lists or personnel information are being uploaded, the move is not postponed. 📄
Signal 2: regular use
If several people use it as part of the job, this is no longer a habit but a process. 🔁
Signal 3: output goes to customers
If generated text enters proposals, reports or publications, quality and responsibility belong to the company. 📤
How is the move made?
BU BÖLÜMÜN ÖZETİ
- Step 1: who uses what, and why
- Step 2: set up the company space
- Step 3: carry the accumulation across
- Step 4: write a one-page rule
One week, four steps. 🪜
Step 1: who uses what, and why
A short inventory: person, tool, job. That list usually surprises; the shadow-use logic sits in the shadow AI guide. 📋
Step 2: set up the company space
Accounts on the company domain, data setting off, roles defined. Setup is an hour’s work. ⚙️
Step 3: carry the accumulation across
Useful briefs and templates get copied into the shared area. What is not moved is lost. 📦
Step 4: write a one-page rule
What may be uploaded, what may not, how outputs are checked. An account without rules is risky even when it is corporate. 📄
What goes in the rule page?
BU BÖLÜMÜN ÖZETİ
- Never uploaded
- May be uploaded
- Verification requirement
- The responsible person
Five lines, one page. 📄
Never uploaded
Identity and contact details, health data, signed contracts, customer lists. This is the most important line. 🚫
May be uploaded
Public information, anonymised text, your own product and process documents. The boundary is clear. ✅
Verification requirement
Every output going outside is checked by a human; the method sits in the verification guide. 👁️
The responsible person
Who opens accounts, who closes them? Without a name, the rule is not applied. 👤
What should I do today?
BU BÖLÜMÜN ÖZETİ
- Step 1: build the inventory
- Step 2: check for sensitive documents
- Step 3: write the rule page
- If you want help
Three steps, one week. 🪜
Step 1: build the inventory
Who, with which tool, doing what? A three-column table is enough. 📋
Step 2: check for sensitive documents
If there are any, the decision has already been made. 🔐
Step 3: write the rule page
Five lines, one page, announced to the team. Rules matter as much as the account. 📄
If you want help
Let us set up the move and the rule page: use the consult your expert form. For your current usage see the business AI usage audit; the whole sits on the AI consultancy page. 🎯
Related reading from the archive: AI and data security · business AI usage audit.
📝 Notes From the Field
At one company a departing employee’s personal account held months of accumulated briefs and templates; none could be handed over. The replacement had to learn the same work from scratch. After moving to a company space the situation did not repeat — because the accumulation now sat with the company, not the account.
📖 Short Glossary
Company space: account structure managed on the company domain with central roles and settings. Data setting: the option governing training use of inputs. Inventory: the who-uses-what-for-which-job list. Rule page: what may be uploaded, what may not, and who is responsible.
⚡ Quick Summary
On personal accounts data stays with the person, settings go unchecked, rules cannot be written and cost is invisible. 🔐 A company account gives central settings, access management, a shared space and one invoice. One of three signals is enough, and the move comes with a one-page rule.
🎯 Next Step
Let us set up the move and the rule page: use the consult your expert form. The plan decision sits in the paid version guide; for your current usage see the usage audit.
Frequently Asked Questions
Sık Sorulan Sorular
One person, general questions, no sensitive documents: a personal account is fine. 🙂
Not if sensitive documents are involved. What decides is how critical the work is, not headcount; a team of three working with customer contracts needs the corporate structure.
It usually means the company setup was built badly: if access was slow or the tool restricted, people carry on the old way. The fix is not a ban but making the corporate route easier.
Limit what leaves: identity and customer information is never sent, and work is done with anonymised text. Where your sector carries specific obligations, take legal advice.
Source: Turkish DPA (KVKK) — recommendations on personal data in AI
