Checklist for Agencies Uploading Client Documents to AI Tools

·2 views

Agencies should not upload client documents to an AI tool until they know where the text is sent, how long it is retained, whether it is used for model training, who else processes it, and what their client contract permits. These answers vary widely between personal chat accounts and business products built on commercial APIs. The article offers a vendor-neutral checklist covering storage, training, model providers, sub-processors, location, access, deletion, export, contracts, and independent assurance. It stresses that the guidance is practical rather than legal advice, and that client contracts and counsel decide what is permitted. Discovery material can be more sensitive than it appears, and some of it may count as personal data under laws such as the GDPR.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why iPhone photos are saved as HEIC files and how to convert them to JPG

Since iOS 11, iPhones have stored photos in the HEIC format by default, which preserves quality at about half the file size of JPG. Many Windows applications, upload forms and print services do not accept HEIC, which causes compatibility problems. Users can switch the camera to the Most Compatible setting to shoot JPGs going forward, though files will be larger. Existing photos can be converted using transfer settings, Mac Preview or Finder, Windows Paint with extensions, or Linux command-line tools such as heif-convert. The article's author also promotes a free browser-based converter that processes files locally without uploading them.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Caching Bank Directories Safely Across Multiple Payout Providers

Bank lists are strong caching candidates because they are requested often, can be large, and change infrequently. Caching them incorrectly is easy, especially when several payout providers each use their own bank codes, names, and supported institutions. The article recommends provider-scoped cache keys that include country and a version, and warns against merging directories by bank name in the transfer path. It also advises paginating fully, preserving provider-issued identifiers, and treating stale data as acceptable for browsing but not for account validation. Overall, reference data should be scoped by its source and separated from the data used for transaction validation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Preventing Duplicate Push Notifications When Background Jobs Retry

Notification systems must account for task queues that typically offer at-least-once execution, since retries can cause customers to receive repeated messages. To stop two workers from sending the same campaign, the approach locks the campaign row and moves it to a sending status within a single database transaction, so only the worker that claims it proceeds. Targets are built from active, validated device tokens with duplicates removed, and each delivery is recorded under a deterministic key with a unique constraint before the push provider is called. Delivery records track pending, accepted, and failed outcomes, and campaign totals are derived from these rows rather than optimistic counts. The result is that each campaign-device pair is submitted at most once within the application's own retry model, though exactly-once delivery cannot be guaranteed across every external push platform.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

KYC Should Be Modeled as an Auditable Evidence Workflow, Not a Simple Flag

A single is_verified field cannot capture a genuine KYC process, which typically involves personal details, identity documents, liveness checks, address proof, database and sanctions screening, and staff review. Each step should be tracked with its own status, so one rejected or resubmitted step does not erase evidence from completed ones. Overall approval should follow from required steps and policy rather than whichever provider responds last. Provider integrations should be handled through adapters that normalize outcomes and keep restricted raw responses, with media stored behind protected references and sensitive identifiers kept out of logs. Every review action should be recorded in an audit trail capturing actor, change, reason, and timestamp.

0 comments Read more at DEV Community