Initializing secure session…
⚠ Sign-in failed. Please try again or contact IT support.
?
Page 1 of 3
15%
Security Awareness
Physical Access & Facility Security
Understanding Access and Site Security
Guidance for maintaining secure and well-managed access practices in the workplace.
Recap
Keep your laptop, workspace, and company information secure—wherever you work
Common Facility Access Security Scenarios
1
Proxy Biometric
Swiping in for someone else, or lending your access card or ID badge, bypasses access logging and violates security facility policy.
2
Access Card Handover
Lending access cards or ID badges to colleagues or visitors compromises individual access controls.
3
Unauthorised Visitor Entry
Allowing unescorted or unregistered visitors into restricted areas creates potential physical security risks.
4
Lost or Stolen Access Cards
Not reporting a missing badge immediately leaves an active credential in unknown hands, risking the security walls of the workspace.
Understanding Potential Security Risks
Risk & Impact Considerations Overview
Organisational Considerations
  • Unauthorised access can affect the security and integrity of facilities, systems and information.
  • Weak access practices may increase exposure to disruption, loss or operational interruption.
  • Security gaps can affect team confidence, trust and overall assurance.
  • Escalating issues can lead to broader compliance, policy and governance considerations.
Client & Stakeholder Impact
  • Confidential or sensitive information may be exposed when access controls are not followed.
  • Trust and confidence may be affected if access processes are not managed consistently.
  • Business obligations across privacy, compliance and service expectations may be impacted.
Individual Considerations
  • A lapse in access practice can contribute to wider operational and reputational concerns.
  • Gaps in accountability or site awareness may create legal, policy or employment issues.
  • Personal responsibility for following secure access routines supports a safer workplace.
  • The impact of a security issue can extend beyond the immediate moment and create future friction.
Good Practice & Considerations
Good practice
  • Use your own access credentials and keep them within your control.
  • Wear identification in line with workplace procedures while on site.
  • Keep access devices and identification securely managed and readily traceable.
  • Follow visitor sign-in and escort processes as part of standard site access controls.
  • Maintain a tidy and secure workspace in line with organisational standards.
  • Report unusual activity or visible concerns promptly to the appropriate contact.
  • Support a consistent approach to security awareness across the workplace.
  • Recognise that secure site practices help protect people, clients and daily operations.
Areas to be mindful of
  • Avoid using another person’s access credentials or recording attendance on their behalf.
  • Avoid sharing access tools or allowing them to be used outside normal workplace controls.
  • Avoid allowing unregistered or unescorted visitors to move through restricted areas.
  • Avoid bypassing sign-in or escort requirements when attending site facilities.
  • Avoid overlooking suspicious activity or routine security concerns that may require escalation.
  • Avoid leaving devices or identification unattended in shared or public areas.
  • Avoid assuming that minor access exceptions are inconsequential without awareness of broader impact.
  • Avoid allowing security issues to remain unreported when stronger controls may be needed.
October 2026 Edition
Using AI securely to protect Client data and Intellectual property
Using AI Without Giving Away the Crown Jewels  ·  ~10 min read

Think Before You Prompt!

Using AI Securely to Protect Client Data & Intellectual Property

AI tools can make us faster helping us research, summarize, write, analyze, code, troubleshoot and generate ideas. But there is an important security rule:

Anything you give an AI tool is data you have disclosed to that tool. Willingly, whether knowingly or recklessly.

A prompt isn’t always “just a question.” It may contain client information, source code, business plans, personal information, credentials, screenshots or other intellectual property. Anything that you may upload/ embed / disclose.

Our goal is not for you to stop using AI. It is to use AI without putting our clients—or ourselves—at risk.

Executive Snapshot
Top RiskData disclosure, IP leaks, & client confidentiality breaches through unapproved AI tools
Trending ThreatPasting sensitive code, customer PII, credentials, or business plans into public AI
Do This NowUse approved AI tools, strip sensitive client data, & follow the 3-question checklist
AvoidPutting client data, credentials, source code, or IP into unapproved AI tools
The Golden Rule & 3-Question Checklist
THE GOLDEN RULE

If you would not post it on a public website, do not put it into an unapproved AI tool.

Before entering information into an AI application, ask yourself:

  1. Is this our information to share? Client information belongs to the client. Having access to it does not automatically give us permission to submit it to another service.
  2. Does the AI really need this information? Remove names, account numbers, identifiers, confidential details, and unnecessary context whenever possible.
  3. Is this an approved AI tool? Use only company-approved AI services for company work and follow the applicable client requirements.

If the answer to any of these is NO or UNSURE — STOP!

WHAT SHOULD NEVER GO INTO PUBLIC OR UNAPPROVED AI?

Unless specifically authorized and appropriately protected, do not paste or upload:

  • Client confidential or proprietary information
  • Personally Identifiable Information (PII)
  • Protected Health Information/ePHI
  • Financial or account information
  • Client source code or proprietary algorithms
  • Passwords, API keys, tokens, or credentials
  • Internal architecture or security configurations
  • Vulnerability reports or penetration-test results
  • Contracts and confidential business documents
  • Client datasets, screenshots, or database extracts
  • Unreleased product information or intellectual property
Remember: removing the client's name does not necessarily make the information safe. The remaining information may still identify the client, person, system, or project.
• Using AI securely to protect Client data and Intellectual property
The AI Security Playbook
Best Practices, Prompting Strategies, and Incident Reporting
A. AI HAS MORE THAN A PROMPT

When using AI, think about the entire information lifecycle.

1

Prompt

2

Uploaded File

3

AI Processing

4

Output

5

History/Logs

6

Copy/Share

That means security is not about what you type.
A spreadsheet uploaded for analysis, a screenshot attached to a question, source code pasted for debugging, or an AI-generated summary copied into another application can all create security or privacy exposure.
B. USE AI THE SMART WAY
❌ Instead of this:
"Review this client database export and tell me why these 14 customers have incorrect financial balances."
✅ Try this:
"Here is a fictional example of the data structure and calculation logic. Help me identify potential causes of a balance-calculation error."

Same problem-solving objective. Much less sensitive information exposed.
Similarly, instead of uploading 500 lines of proprietary source code, isolate the generic technical problem whenever practical.

C. MINIMIZE — Strip Before You Prompt
Remove → Generalize → Anonymize → Ask
🏷️Strip Client Names & Identifiers
🎭Replace Real Data with Fictional Placeholders
🔐Obfuscate Internal URLs, IPs & Credentials
🚫Remove Confidential Intellectual Property
D. AI Can Be Confidently Wrong

Understand the Limits of AI Output

  • AI-generated information can sound authoritative even when inaccurate, incomplete, or fabricated. Never assume an AI answer is correct simply because it sounds convincing.
  • For important work: VERIFY FACTS → CHECK SOURCES → REVIEW CODE → APPLY HUMAN JUDGMENT
  • You—not the AI—remain responsible for the work you deliver.
  • Be especially careful with: Legal or regulatory interpretations, Security recommendations, Financial calculations, Software code, Client deliverables, Facts attributed to sources, Decisions affecting people or customers.
Remember: You are responsible for what you deliver — not the AI.
DEVELOPERS: AI DOESN'T NEED YOUR SECRETS

AI coding assistants can be extremely useful—but source code may contain far more than code.

Watch for: API keys • passwords • connection strings • certificates • tokens • client identifiers • proprietary algorithms • internal URLs • database information.

Never use client code to train, fine-tune, evaluate or benchmark an AI model unless explicitly authorized.

Treat AI coding assistants like any other external service receiving company or client information.

F. Watch What AI Gives Back

Check Output Before You Use It

  • Insecure code
  • Invented facts
  • Copyrighted or inappropriate material
  • Unexpected, sensitive information
  • Malicious or unsafe instructions derived from external content
  • Incorrect security configurations
Golden Rule of Verification: AI-generated does not mean security-reviewed. Review the output before putting it into production, sending it to a client, or using it to make a major decision.
• Using AI securely to protect Client data and Intellectual property
The AI Security Playbook (Continued)
Incident Reporting, Final Review, and Self-Check
SOMETHING WENT WRONG?

Suppose you accidentally paste client information into an unauthorized AI application. Do not hide it. Do not assume removing the chat solved it.

Report:

  1. WHAT was submitted
  2. WHERE it was submitted
  3. WHEN it happened
  4. WHO/WHICH CLIENT was affected
  5. WHAT ACTION you have already taken, if any
Early reporting gives the Security and Privacy teams the best opportunity to limit the impact. Follow the company's normal Information Security Incident Reporting process at once.
THE 10-SECOND AI SECURITY CHECK

Before clicking Send, ask:

AApproved? Am I using an approved AI service?
IInformation? Does my prompt contain information that should not leave our/client environment?
SSensitive? Have I removed unnecessary sensitive information?
AAccurate? Will I independently verify the output?
FFinal destination? Where will the prompt, files and AI-generated output go?
AI SAFE: A few seconds of thought can prevent an expensive mistake.
FUN FACTS & FOOD FOR THOUGHT
AI does not know something is confidential just because you do.Security classifications and contractual obligations do not automatically follow information when someone copies it into another service.
"Anonymous" is not always anonymous.Project names, transaction details, dates, job titles, or technical information can sometimes reveal who or what the information relates to.
Your prompt can be intellectual property too.A sophisticated prompt may contain proprietary business logic, processes, method or know-how.
Deleting is different from never disclosing.Once sensitive information has been submitted to an external service, deleting your conversation does not change the fact that the disclosure occurred.

ONE THING TO REMEMBER THIS MONTH

AI is a tool—not a trusted recipient of everything you know.

  • Use approved tools.
  • Minimize the data.
  • Protect client information.
  • Protect intellectual property.
  • Verify the output.
  • Report mistakes quickly.
THINK BEFORE YOU PROMPT.
My AI Security Check-in
Monthly Quiz
AI Security Challenge
Answer all 5 questions — results shown only after final submission.
Question 1 of 5Approved Tools & Code
Priya asks an approved AI tool to improve a generic Python function containing no client data or credentials.
  • AAcceptable
  • BSecurity Incident
Select an option to continue
Question 2 of 5Data Anonymization
John removes the client's name from a spreadsheet containing customer account numbers and uploads it to his personal AI account.
  • ASafe — the client's name was removed
  • BNot safe — the data itself remains sensitive
Select an option to continue
Question 3 of 5Prompt Sanitization
Maria asks AI to draft a presentation using fictional examples instead of uploading the client's confidential strategy document.
  • AGood practice
  • BUnnecessary precaution
Select an option to continue
Question 4 of 5AI Code Verification
An AI coding assistant generates code that looks correct. What should the developer do?
  • ADeploy it — the AI already checked it
  • BReview and test it using normal secure-development practices
Select an option to continue
Question 5 of 5Incident Reporting
You accidentally paste confidential client information into an unauthorized AI service. What should you do?
  • ADelete the conversation and say nothing
  • BImmediately report it through the company's Information Security Incident Reporting process
Select an option to continue
🏆
Quiz Complete!
0/5
Here's your detailed breakdown.
Your Answers — Detailed Breakdown
✅

Quiz Already Submitted

You have already completed the R-Shield AI Security Challenge.

HR Admin Dashboard

Submissions

All quiz responses from Relanto employees & contractors. Export to CSV anytime.

⚙️

Setup required: Open this file in a text editor and set two values at the top of the <script> block:
SUPABASE_URL and SUPABASE_ANON_KEY (from your Supabase project → Settings → API).
Also set AZURE_CLIENT_ID and AZURE_TENANT_ID from your Azure App Registration.
Until then, responses are stored locally in this browser for demo.

0
Total Submissions
0
Perfect Scores (5/5)
—
Average Score
0
Submitted Today

All Responses

# Name Email Timestamp Q1 Q2 Q3 Q4 Q5 Score