Contracts that say yes to everything hold where the risk is real and give where it isn't.

Drafted a new data rights and AI section for the platform's Terms of Service, updated the Privacy Policy and Information Security page, disclosed the LLM provider as a sub-processor, and built a gap tracker so IT and Finance could confirm every statement before it went live. Open items were named, not buried: a contractual no-training commitment from the model provider, a stated retention period, and which negotiated enterprise MSAs needed amending.

An enterprise general contractor's GRC team wanted to restrict aggregation. Benchmarking only works if usage is combined across projects, so the right to aggregate stayed. The concession went where it actually cost nothing: no identifiable client data goes into models, and only aggregated, de-identified data comes out.

Deleting data at termination and opting a project out of aggregation are different obligations with different costs. Kept them in different clauses so a fee attached to one couldn't leak into the other.

"Derivatives" in the confidentiality definition plus a return-on-request clause meant a client could demand destruction of aggregated analytics. Carved aggregated, de-identified data out of Confidential Information. Same review caught a survival clause that silently dropped the confidentiality and client content sections.

Clients self-serve deletion of live data any time. Backups purge on the standard retention cycle. Before signing, I checked that the contract matched what the security team had already told the client in writing and what the Privacy Policy says.

Negotiate data use, AI/ML usage and privacy terms with banks and credit unions whose counsel drafts for their examiners. Every ask has a regulatory driver. The work is finding language that satisfies the supervisory interest without expanding our risk.

Flag and paper any AI vendor that touches consumer financial data, on both the customer and vendor side, so our commitments to banks and our vendors' commitments to us actually line up.

48 hours from confirmation, with a reasonable-belief trigger and a preliminary report at day five. Pre-confirmation 24-hour clocks turn every SOC alert into a reportable incident and a paper trail of breaches that never happened.

On-site audits of a multi-tenant platform expose every other customer. An independent Type II report is what examiners actually want to see, and experienced bank counsel accept it once the architecture is explained.

Own the DPA and BAA program and track Regulation E, Regulation Z and privacy guidance as it applies to dispute resolution, pushing changes into templates and standard positions.