Hi, basic question- Does using NetSuite with MCP pose a data compliance risk for a public company?

It depends, but likely yes. You have to turn off "storing/training data" within the llm settings. However, those terms and conditions governing that setting have changed many times in 2025. I personally, don't put any sensitive business data into an AI llm website because I've also seen my security setting flip off. Instead, what I do, is access llms through their API where I can guarantee my data is never stored/trained on (a business approach, where a website is a consumer approach). I use claudes API in our own AI application.

Yes it can be a compliance risk for a public company if NetSuite data, especially sensitive customer or financial information, is sent to an external LLM that might store or reuse it, because that could expose private details or violate regulatory requirements. In practice you should keep control of what’s shared, avoid sending unmasked sensitive data into general LLMs, and use enterprise-grade tools with clear data handling guarantees to stay compliant.