Divide by Zero™ Ventures

CORE IDEA: Treat data like money. Know where it goes, what others may do with it and how the business will cope if the flow stops.

At closing time, a baker counts the cash, locks the safe and bolts the door. Nobody calls this financial governance—it is simply how a sensible business is run. Yet that same baker might upload customer orders or confidential supplier lists to a free AI tool without checking if the provider retains, reuses, or shares them. The result can quickly escalate from a simple oversight to a breach of confidence, lost intellectual property, or a costly privacy lawsuit.

The contradiction is telling. Money is handled deliberately; data, which increasingly determines where money goes, is often treated casually.

For the baker, a failure in cybersecurity isn’t just a technical glitch. It can mean losing secret recipes, access to bank accounts and funds, or customers’ trust after a data leak. A seemingly minor oversight can also create legal and financial liability.

The habit extends well beyond bakeries and AI. An employee may move a client spreadsheet to a personal cloud account, send it to the wrong recipient or paste it into a chatbot for convenience. A consumer may upload a sensitive document to an unfamiliar service. In every case, the information enters a system with its own terms, settings and access rules. Security is only one question. The others are what the service may do with the data—and who else may see it.

A breach need not involve a hacker forcing a digital lock. In August 2025 the BBC reported that Grok conversations shared by link had appeared in search results, apparently because users did not realise that others could discover the links. The report did not establish that the conversations had been used to train the AI; search engines had indexed the shared pages. A baker discussing confidential supplier prices could thus discover that the conversation was searchable. In a large organisation the consequences would be wider. The scale changes; the question does not: who can see information once it leaves your hands?

Data resembles money because it enables action, and action creates value. Sales figures help the baker control costs and plan ahead. A stolen password opens an account; altered payment instructions divert funds; an automated attack can disable an ordering system and stop trade. Data is not a pile of inert records. It is the raw material of decisions and actions. Its value depends on who can use it, for what purpose and in whose interest.

What cybersecurity actually protects

Cybersecurity protects information, the systems that hold it and the routes along which it travels. For a business, that means keeping records private, sharing them only with authorised people, preventing improper changes and ensuring that essential services remain available. The baker’s financial statements, customer details and daily orders must be protected—and the systems that manage them must work when the shop opens. For individuals, the same principles protect identity, finances and reputation.

Sensitive data is information that should be seen or used only by authorised people. It includes the internal know-how that protects a company’s advantage, such as intellectual property and financial information, as well as essential records that support daily operations, including human-resources files and client databases.

Specialists call these principles confidentiality, integrity and availability. In ordinary language: keep sensitive information private, keep it accurate, move it safely and keep essential services running. Passwords, encryption, access controls and backups are means to those ends, not ends in themselves.

Attacks vary in speed and sophistication. An automated AI bot may strike in seconds; a social engineer may spend weeks building trust. Phishing emails and fraudulent invoices fall somewhere in between. The method matters less than the result: information is stolen, altered or made unavailable. A single altered bank-account number on an invoice can cost as much as a stolen password. And if the baker's ordering system goes down, trade stops and losses mount, even though no customer record has leaked.

Nor is cybersecurity confined to gifted hackers and science fiction. Sometimes the weak point is a notepad. A contractor entering an office after hours might find a user name, password and bank-account number written on a desk. One photograph would capture the lot. No advanced skill is required. A clean-desk policy and a password manager would make the same information much harder to exploit. A security system is only as strong as the least careful habit around it.

Who controls the valve?

To see where information goes, look beyond the app on the screen. The baker may rely entirely on standard services: storing orders in a cloud drive, receiving requests by email, managing accounting through an off-the-shelf online service and using a simple website hosted by a provider abroad. The setup may look simple and straightforward, but every service creates another place where information is stored, transferred or accessed—and another dependency if an account is compromised or a provider becomes unavailable. A multinational may manage thousands of users across many specially configured systems. Its environment is far more complex, yet the essential questions are the same: What information moves through each service? Who can reach it? What happens to the business when the service fails?

Think of a digital service as a network of pipes rather than a sealed container. A polished interface says little about where the connections lead. Depending on the product, its terms and its settings, information may be used for personalisation or service improvement, or shared with companies that help operate the service.

Using the service does not mean controlling every valve. What matters is what can flow out, for what purpose and under whose control.

Labels offer little comfort. A consumer account may leave users with rights to their content while granting the provider permission to process it under standard terms. An enterprise service may provide clearer contracts and stronger controls over access, retention and oversight. Neither label guarantees safety. The provider still handles the data, often with help from other companies. What matters is governed flow: clear rules and usable controls over where information goes and what others may do with it.

Intent does not determine impact

Suppose the baker uploads a customer list to a consumer tool to save time. The provider may handle it exactly as its terms permit. Nobody intends harm. Yet the owner may have surrendered the ability to limit or trace its use. Good intentions do not close an open valve.

Once the list leaves the shop’s approved systems, the baker may no longer know who holds it or where it has travelled. Information cannot always be recalled after disclosure. Lost control creates room for misuse.

The damage may reach far beyond privacy. The Grok episode showed how information can become public unexpectedly. After the 2015 Ashley Madison breach, The Guardian reported resignations and divorces, as well as a small number of reported deaths by suicide. Leaks affect livelihoods, relationships and wellbeing. Their human cost should not be reduced to a tally of exposed records.

The practical response is simple to state, though harder to enforce: know what information you hold and disclose only what the task requires. A seasonal promotion needs product descriptions and opening hours, not a customer list. A sales query may need totals, not individual transactions. In a large organisation, this discipline must be built into rules governing access, retention and approved services. Before connecting an AI assistant—or any service—to email or documents, ask what it can reach and whether it needs to. Give a service what the task requires, not everything it can access.

Treat data seriously

Responsible cybersecurity does not require a degree in computer science. It requires the habits already applied to money: knowing where information goes, who can use it and how it is protected.

Common sense is a useful first control. Before sharing any sensitive data, run through this quick checklist:

Storage: Know exactly where the information is stored.
Sharing: Understand how it is being shared.
Access: Be certain who has access to it at all times.

If those questions cannot be answered, sensitive information should not enter the service. For leaders, the stakes extend beyond a single account. After its people, an organisation’s accumulated knowledge is among its most valuable assets. Customer records, methods and plans deserve the same care as cash.

The same test works for a bakery and a global company: Is this information needed here, and do I understand where it may go? If not, stop. Check the service’s terms and settings, or disclose less. Data enables action; that action may serve interests other than yours. Data is money. Protect it by deciding who may use it, for what purpose and with whose authority.

Begin with one service you use today. Identify what it holds, who can access it, what the provider may do with it and how you would operate without it. Then make one change: remove unnecessary access, disclose less or establish a backup plan. Protecting information begins with knowing where it goes. The next step is choosing where it should not.

A practical guide to comparing services

Knowing where data goes is useful only if you can judge the service that manages it. The appendix turns the article’s questions into a practical comparison of common consumer and enterprise features. The distinction is not a matter of prestige or branding, but of terms, controls and accountability.

Disclaimer: This comparison is a guide to asking better questions, not a substitute for reviewing the terms and contracts of a specific service.

Would a fresh view of your data practices be useful?

Get in touch. Whether you are tracing where data goes, reviewing trusted services or testing comfortable assumptions, I would welcome the conversation.

Appendix | Consumer and enterprise services

This table compares terms and safeguards commonly associated with consumer and enterprise services. It is a guide, not a definitive classification or checklist. The examples reflect provisions often found in offerings from Google, Anthropic, Microsoft and OpenAI. Terms vary by provider, product, plan, settings and jurisdiction. Readers should verify the terms that apply to their service and seek professional advice where appropriate.

Dimension	Typical consumer app	Typical enterprise solution	Why it matters
Account and contract	Individual accepts standard terms.	Organization contracts and can negotiate or rely on business terms and a data-processing agreement.	Determines who is accountable and what remedies or commitments exist.
Purpose of processing	May include personalization, service improvement or advertising, depending on the service and settings.	Business data is commonly processed to provide the contracted service, subject to enterprise terms.	Security is not enough if data is reused for an unexpected purpose.
Identity and access	User manages password, recovery and sharing.	Central identity, enforced multifactor authentication, conditional access and role-based administration may be available.	A company can revoke access when a worker leaves or a device is lost.
Administration	Little or no organizational oversight.	Central console, policy enforcement and delegated administration.	The organization can apply the same rules consistently.
Logs and investigation	Limited user-facing history.	Audit, sign-in, administrator and content-activity records may be available by plan.	Investigators can reconstruct who accessed or changed information.
Retention and deletion	Individual deletes content under consumer rules; backups and account lifecycle follow the provider’s policy.	Retention, deletion, archive and legal-hold capabilities may be configured.	Records can be kept or removed according to law and policy rather than one employee’s preference.
Data location	Usually selected by provider; consumer may have limited choice.	Some plans/contracts offer data-region commitments or location controls.	Location can affect regulatory and contractual duties.
Subprocessors	Disclosed through general privacy materials.	Often covered by contractual lists, notices and data-processing terms.	Organizations can assess the supply chain.
Incident handling	General notices and consumer support.	Contractual notification, administrative reporting and enterprise support may apply.	The organization can coordinate response and communicate with affected people.
Recovery and continuity	Designed for individual convenience, with standard recovery options.	Enterprise backup, recovery, availability commitments and continuity features vary by service.	Business and public services may need recovery objectives beyond a personal account.
Advertising	Some consumer ecosystems use account or activity data for advertising; policies vary.	Core business productivity services often contractually separate customer data from advertising.	Commercial purpose can differ even when the same brand supplies both services.
AI model improvement	Consumer AI content may be eligible for model improvement unless the user opts out, depending on provider, mode and settings.	Major business AI offerings commonly state that business content is not used to train foundation models by default.	Confidential prompts and files need a governed processing purpose.
Exit and account control	A personal account usually remains under the individual’s control, subject to the provider’s terms.	The organization can normally disable the account, transfer work and manage records, subject to contract and law.	Company or client information should not remain stranded in a former worker’s personal account.
Content and intellectual-property rights	The user commonly retains rights in original content but grants the provider a contractual license to host, reproduce, transmit and operate the service. Terms vary.	Existing contracts state that the customer retains rights in customer data while granting the provider the rights needed to deliver and secure the service. A processing license is not necessarily a transfer of ownership. The precise permitted uses matter more than the label.	A processing license is not necessarily a transfer of ownership. The precise permitted uses matter more than the label.
Personal-data rights	The individual may have statutory rights over personal data, even where the platform or another party determines the processing purpose. Rights vary by jurisdiction.	The organization may act as controller or business and the provider as processor or service provider; employees, customers and other people may retain statutory rights in their personal data.	Personal data is usually governed through rights, duties and lawful processing - not treated simply as property that one party owns outright.
Operational control and custody	The individual usually controls the account, but the provider operates the infrastructure and can retain copies under its policy and legal duties.	The organization normally controls identities, permissions, retention and export; the provider retains technical custody needed to run the service.	Legal rights and practical possession are different. The party that can revoke access or export records may not own every item in them.
Provider processing license	Standard terms typically grant a license broad enough to store, copy, transmit, adapt format and otherwise process content to provide the service; some products permit additional uses under stated policies and settings.	The processing permission is generally tied more closely to the contract, documented instructions, section, support and legal obligations.	The key question is not merely “Who owns it?” but “What exactly is the provider allowed to do with it?”
Database and compilation interests	A user may own individual content while the provider has separate rights or interests in the service, software, organization of data, metadata or aggregated outputs, depending on law and terms.	The customer may control its records while the provider retains rights in its platform, tools, service-generated statistics or de-identified data where the contract allows.	Different legal rights can coexist without creating joint ownership of the underlying customer content.
Deletion and residual copies	Deleting an item or account may remove it from ordinary use but not instantly from backups, security records or legally required retention.	Contracts and retention settings more often define export, return, deletion, backup expiry and exceptions for legal holds or security evidence.	“Deleted” should be understood as a managed process, not necessarily instantaneous physical erasure from every system.
Government requests and legal holds	The provider may preserve or disclose data when legally required and ordinarily controls the response under consumer terms, subject to applicable law.	The contract may include notice commitments where legally permitted; the customer may also preserve records for litigation, regulation or investigation.	Neither ownership nor deletion preference overrides every lawful preservation or disclosure duty.
Changes to terms and remedies	The provider can update standard terms subject to notice and applicable consumer law; the individual usually has limited negotiating power.	Material rights and duties are set by negotiated or standard business terms, data-processing documents and service commitments; termination rights may apply.	Material rights and duties are set by negotiated or standard business terms, data-processing documents and service commitments; termination rights may apply.

Selected Sources