I'm trying to get the green light to turn on the AI Connector at my company, but they are quite concerned with the risks of data leakage. Is there any other documentation I can bring to this discussion other than what's here: https://suiteanswers.custhelp.com/app/answers/detail/a_id/1021122? My general line of thinking is that aside from any holes in the MSA/contract language with Oracle (which is a whole other discussion) the real risk is on the MCP side related to the company/model we're connecting to NetSuite, since it's ostensibly operating under the same permission sets in NetSuite that I've given certain users already. Does that seem reasonable? Are there other considerations I'm missing?

Not sure which MCP you are connecting to but Claude does have a setting which allow them to use your data for learning purpose. You need to opt out of it.

Yeah the real issue is the use of the data on the LLM side. Here is the NIST framework for LLM use in enterprise apps. It is quite heavy. https://www.nist.gov/itl/ai-risk-management-framework

Yeah, makes sense, although shockingly, I actually trust my user base pretty far in that respect. Even when I am generating reports or searches for them, they are extremely diligent about checking to make sure that the results they've got are actually answering the question they asked, and aren't missing specific pieces they need. Definitely not the case at every place I've been, but the quality of people here is one of the reasons I'm at where I'm at still. And anyway, the initial use case here is just turning it on for me and one other admin on my team to play around with and see if there's significant value here versus the AI tools we already have in place.

Deploy different SuiteApps and assign each to a specific vertical. For example: – Manufacturing SuiteApp: includes 2 tools – Supply SuiteApp: includes 3 tools Then configure the MCP connection using each SuiteApp’s specific URL so that each vertical only sees its own tools. For more details, check out our blog on creating custom tools.

Your concerns are valid. Using Claude.ai or any LLM's website is really not secure for business. Yes, you can turn off "storing" data, but that can and I have seen it be turned back on automatically. We ONLY interact LLM's through the API where data contractually cannot be stored/trained on.

Researchers find ChatGPT vulnerabilities that let attackers trick AI into leaking data https://thehackernews.com/2025/11/researchers-find-chatgpt.html