MSSG | Client information | Version 1.1 | 18 October 2026
AI and client confidentiality
MSSG uses AI tools for analysis, preparing materials and coordinating work. Our internal policy assigns responsibility for their use, records data flows and sets out how security arrangements are tailored to a particular engagement.
How we work
We use information and correspondence made available by the business owner for MSSG-related tasks. Processing may involve external cloud models and other services, including email, CRM and file storage. Our standard working environment is not dedicated exclusively to one client.
We maintain a register of services, data flows and evidence of settings. Confirmed safeguards are distinguished from planned measures. We check AI outputs, sources and factual claims. We also review confidential details before including them in material for another recipient or in a publication.
Requirements for each engagement
When agreeing an engagement, we establish the information scope, confidentiality terms and tool requirements. Additional measures may include separate project resources and context, restricted providers, specific retention arrangements or excluding data from external AI. These measures become active after their scope has been agreed, implemented and verified, not merely because a profile has been selected.
Where an engagement involves processing personal data on a client's behalf, we establish the parties' roles and the required contractual terms, including arrangements for further processors. Existing NDAs and client requirements inform the choice of working arrangements.
Information available to clients
For supplier assessment, we can provide our policy, a description of relevant data flows and agreed safeguards, and available evidence of their operation. We do not disclose other clients' information or infrastructure secrets. Incidents are assessed under our internal procedure and contractual obligations.
Our policy implements relevant principles and practices from NIST CSF 2.0, NIST AI RMF and ENISA guidance for SMEs. This is not an ISO certification or a claim of full conformity to these standards. The contract and agreed security arrangements define the requirements of a particular engagement.
Martin Mycielski is responsible for agreeing these arrangements on behalf of MSSG.