Required reading for every Tiger Tracks team member and contractor. Three rules cover almost everything.
Rule 1
Platform Tier is Everything
Privacy is a platform setting, not a prompt. Use only approved Enterprise/Team accounts. Free or personal tiers are strictly prohibited for company work.
Rule 2
Redline-Only Protocol
Keep real client data in your prompts — that's what makes AI useful. Only redact the specific high-risk items: credentials, account IDs, SSNs, bank info.
Rule 3
The Junior Engineer Principle
Treat AI agents like a junior contractor. Least privilege, human approval on all outbound actions, IT sign-off before connecting to any system.
Most Important Rule
Approved vs. Prohibited Platforms
The only thing that protects client data is which platform tier you use. Writing "keep this confidential" in a prompt does nothing.
✓ Use These
Claude Team or Enterprise
Anthropic — DPA-backed
ChatGPT Team
OpenAI — data siloed
Gemini for Google Workspace
Google — enterprise tier only
✗ Never for Work
Personal ChatGPT (Free / Plus)
May train public models on your data
Personal Claude (Free / Pro consumer)
No DPA, no data isolation
Any other free/personal AI tool
Perplexity, Copilot personal, etc.
What's On This Site
Site Overview
Everything you need — across three tabs. Here's what lives where.
📋 Policy Tab
1. Approved Platforms
Enterprise tiers vs. prohibited accounts. Why platform tier is the only real security control and what DPAs guarantee.
View → Platforms
2. Daily Scenarios
Quick-reference table: 13 real AM scenarios rated Safe ✅, Caution ⚠️, or Hard Stop 🛑 with one-line action rules.
View → Cheat Sheet
3. Agent Security
The Junior Engineer Principle. Least privilege, outbound approval, no direct client messaging, IT sign-off required.
View → Agents
4. Meeting Recordings
Rules for AI transcription on client calls: approved tools only, mandatory disclosure, sensitive topic exclusions.
View → Meetings
5. Redline Protocol
The core of the policy. 6 data categories — what you can include vs. must redact for client data, contracts, credentials, financials, PII, and strategy.
View → Redline Protocol
6. Output Review
AI output is always a draft. Verify accuracy, check for bias, IP issues, and be transparent about AI-generated deliverables.
View → Output Review
7. Incident Response
If you accidentally share a credential or sensitive data: STOP → DELETE → ROTATE → REPORT (within 2 hours). Non-punitive policy.
View → Incident Response
8. Talking Points
Ready-to-use scripts for when clients, network contacts, or candidates ask how Tiger Tracks uses AI.
View → Talking Points
9. Clean Slate
Onboarding workflow: audit your personal accounts, delete flagged content, and confirm you're ready for enterprise access.
View → Clean Slate
10. Roles & Responsibilities
Who owns what: all employees, Sr. Director of Client Success, IT/Security, Legal — and what each role is responsible for.
View → Roles
AM Prompting Guide
Account Manager-specific guidance: exact budget authorization, pre-flight checklist, and safe vs. unsafe prompt examples for sensitive accounts.
View → AM Guide
🖥️ IT Portal Tab
Enterprise AI Account Request
Request your IT-provisioned Claude, ChatGPT, or Gemini Workspace credentials. Requires completed Sanitization Form first.
AI Agent Approval
4-step process to connect an AI agent to company systems: Request → Review → Provisioning → Connection using a Service Account.
Service Account Rules
Agents must use IT-provisioned Service Accounts — never personal admin logins. Least privilege, named accounts, quarterly review.
New to Tiger Tracks?
Where to Start
If you just joined or need to get enterprise AI access, follow this sequence.
1
Read the 3 Core Rules above
Platform tier, Redline-Only Protocol, Junior Engineer Principle. These cover 95% of daily decisions.
2
Read the Daily Scenarios Cheat Sheet
Bookmark it. It answers "can I put this in ChatGPT?" for the 13 most common situations.
3
Clean Slate — Audit & Sanitize Your Personal Accounts
Before getting enterprise access, audit every personal AI account you've used for work. Run this prompt in each one, then complete the 4 steps below.
"Please review our entire conversation history and flag any messages that contain: (1) passwords or API keys, (2) bank account or routing numbers, (3) full names combined with contact details, (4) client contract values or unreleased campaign data."
①History Audit — Run the prompt above in every personal AI account
②Data Deletion — Delete any threads with credentials, bank info, or unredacted client data
③Secret Rotation — If you ever pasted a live password or API key, change it in the actual platform now
④Memory Scrub — Use each platform's memory management to clear sensitive commercial or P&L details
4
Request Your Enterprise AI Accounts
Once your Sanitization Form is submitted, request Claude, ChatGPT, and/or Gemini Workspace access via the IT Portal.
✓
You're ready
Use AI freely and confidently. The help desk bot (bottom-right) is always available if you have a question mid-prompt.
Internal Policy Reference
AI Usage & Security Policy
We're AI-forward. Use it with real client data — safely. Three rules cover almost everything.
Rule 1
Platform Tier is Everything
Privacy is a platform setting, not a prompt. You MUST use our approved Enterprise/Team tiers. Free or consumer "Pro" accounts are strictly prohibited for company work.
Rule 2
Redline-Only Protocol
Keep real data intact — client names, ROAS, contract terms. Only redact the specific high-risk elements: credentials, account IDs, signatures, SSNs, and bank info.
Rule 3
The Junior Engineer Principle
Treat AI agents like a junior contractor. Grant least privilege, require human approval for outbound actions, and get IT approval before connecting agents to any system.
Section 1
Approved Platforms
The platform tier is the only real security control. Writing "keep this confidential" in a prompt does nothing.
🛑
Hard Stop: Use of personal accounts, free tiers, or consumer "Pro" plans for ANY company work is strictly prohibited. This includes your personal ChatGPT, Claude, or Gemini accounts.
✓ Approved
Claude Team or Enterprise
Anthropic — DPA-backed, data siloed
ChatGPT Team
OpenAI — no training on your data
Gemini for Google Workspace
Google — enterprise data protection
✗ Prohibited
Personal ChatGPT (Free / Plus)
May train public models on your input
Personal Claude (Free / Pro consumer)
No DPA, no data isolation guarantee
Any other free AI tool
Perplexity, Copilot personal, etc.
Section 2
Daily Scenarios — Quick Reference
From completely safe to absolute hard stops. All assume you're using an approved enterprise platform.
Scenario
Status
Key Rule
✅
Drafting ad copy variations using real client name and brand guidelines
Safe
Enterprise tier + no credentials
✅
Uploading a performance CSV to analyze ROAS trends
Safe
Black out login emails / account IDs first
✅
Summarizing a client NDA or contract for key terms
Login emails, Account IDs, browser cookies, session tokens visible in screenshots or CSVs
→ Action
Black out credentials before uploading any CSV or screenshot
"Analyze Nike's Q4 ROAS of 4.5x on $50K spend and recommend optimizations."
📄 Contracts & Legal Documents
✓ Allowed
Contractual terms, scope of work, entity names, payment terms
✗ Must Redact
Signature pages, home addresses, bank/wire routing info, SSNs, tax IDs
→ Action
Strip first and last pages if they contain PII or sensitive metadata
"Summarize the NDA for Red Bull focusing on non-compete and termination clauses."
🔑 Credentials & API Keys
✓ Allowed
Placeholder text only — e.g., REDACTED_API_KEY
✗ ABSOLUTE HARD STOP
No live passwords, API keys, tokens, login URLs, or auth material — ever, on any platform
→ Action
Replace with placeholders so AI can help with logic without seeing the actual secret
auth_token = "REDACTED" — then ask AI to debug the auth flow
💰 Client Financials & Budgets
✓ Allowed
Budget strategy discussions, media spend modeling, forecasting methodology, client-approved summaries
✗ Must Redact
Exact contract values tied to individuals, unreleased pricing models, any financial data not approved for external use
→ Action
Use rounded figures or ranges when exact amounts aren't necessary
"Our client has a $50K monthly budget. Help me model a channel mix for 20% ROAS growth."
👤 PII (Personal Info)
✓ Allowed
Real names alone in a business context on enterprise tiers (e.g., referencing a contact by name)
✗ Must Redact / HARD STOP
Name + phone/email/address combinations. Absolute stop: SSNs, bank accounts, tax IDs
→ Action
Remove any name + contact detail combination before inputting
"Summarize notes from my meeting with Sarah Smith."
🧠 Client Strategic Info
✓ Allowed
Abstracted strategic scenarios, general competitive landscape discussions
✗ Must Redact
Unreleased campaign strategies, confidential product launch plans, NDA-covered info not approved for external processing
→ Action
Abstract the scenario without identifying the specific client if info is highly sensitive
"Help me build a Q3 growth strategy for a DTC brand in the wellness space."
Section 4
Agent & Framework Security
Treat an AI agent exactly like granting a junior contractor automated access to your systems.
⚠️
Written IT/Security approval required before any AI agent is connected to company systems, ad platforms, Slack, or email.
🔒
Least Privilege
Only grant the minimum permissions necessary for the agent to complete its specific task. No broad access.
👁️
Human Approval on Outbound
Require human review and approval for all outbound actions — sending emails, posting to Slack, deploying code, adjusting live ad campaigns.
🚫
No Direct Client Messaging
Agents must never communicate directly with clients without explicit human review. Zero exceptions.
📝
IT Approval Required
Written approval from IT/Security is required before connecting any agent to company systems, APIs, or external platforms.
Section 5
Meeting Recordings & AI Transcription
AI transcription tools capture everything said — including sensitive client data. Follow these rules on all client-facing calls.
✓
Approved Tools Only — Only use IT-approved, enterprise-tier transcription tools. Free consumer accounts (e.g., personal Otter.ai) are strictly prohibited for company meetings.
✓
Mandatory Disclosure — Always inform all participants that the meeting is being recorded and transcribed by AI before starting. If a client asks you to turn it off, comply immediately.
✓
Sensitive Topics — Do not use AI transcription for meetings involving contract negotiations, unreleased campaign results, legal disputes, or any meeting where the client has requested confidentiality.
✓
Accidental Disclosure — If a participant accidentally shares credentials or sensitive PII verbally during a recorded meeting, manually delete that portion of the transcript afterward.
Section 6
Output Review Standards
AI output is always a draft. The human who submits, publishes, or acts on it is fully accountable for the final result.
🎯 Accuracy
Verify all facts, figures, and calculations. AI hallucinations happen — especially with numbers and statistics.
⚖️ Bias
Review for unintended bias in tone or recommendations before sending to clients or leadership.
Ensure output does not inadvertently plagiarize or infringe on third-party intellectual property.
🏷️ Attribution
If a significant portion of a deliverable is AI-generated, be transparent about it internally.
Section 7
Incident Response
If sensitive data is accidentally entered into an AI tool or an agent executes an unauthorized action, follow this protocol immediately.
1
STOP
Close the browser tab or app immediately. Do not enter any further prompts or attempt to "ask the AI to forget it." That does nothing.
2
DELETE
If the platform allows, delete the specific chat history or prompt containing the sensitive data as quickly as possible.
3
ROTATE
If a password, API key, or token was leaked, log into the affected platform immediately and change the password or revoke the key.
4
REPORT
Notify IT/Security via Slack within 2 hours. Include: what was leaked, which tool was used, and what steps you've already taken.
💚
Non-Punitive Reporting Policy: Honest mistakes reported promptly are treated as learning opportunities, not disciplinary issues. Hiding a mistake or failing to report it is a policy violation.
Section 8
Answering External Questions
Use these talking points when clients, contacts, or candidates ask about our AI usage. Be confident and transparent.
💬 Client: "Are you putting our data into ChatGPT?"
"We are an AI-forward agency and we do use AI to process data and generate insights faster. However, we never use public or consumer tiers. We use enterprise-tier AI platforms (like ChatGPT Team/Enterprise) backed by strict Data Processing Agreements. This guarantees your data is completely siloed and is never used to train public models. We also use a 'Redline-Only Protocol' internally — we strip out sensitive credentials and PII before any data touches an AI system."
💬 Network contact: "How is Tiger Tracks using AI?"
"We use it across the board — from generating ad copy variations and expanding keyword lists, to summarizing contracts and analyzing performance trends. It doesn't replace our team; it gives them a massive head start so they can focus on strategy rather than manual execution."
💬 Potential hire: "Will I be expected to use AI?"
"Absolutely. We expect everyone here to use AI to multiply their output. If you're hired, we'll provision you with enterprise AI accounts and train you on our Redline-Only Protocol, so you know exactly how to use real data safely without slowing down."
Section 9
Clean Slate Transition
Before being granted access to Tiger Tracks enterprise AI accounts, every team member must complete this one-time audit of their personal accounts.
Privacy Auditor Prompt
Run this in each of your personal AI accounts before closing them:
Please review our entire conversation history and flag any messages that contain: (1) passwords or API keys, (2) bank account or routing numbers, (3) full names combined with contact details, (4) client contract values or unreleased campaign data. List each instance with a short description.
Clean Slate Checklist
✓
Run the Privacy Auditor Prompt in all personal AI accounts (ChatGPT, Claude, Gemini, etc.)
✓
Delete or sanitize any flagged conversations containing client data, credentials, or PII
✓
Confirm you will no longer use personal AI accounts for any company work going forward
✓
Received and set up IT-provisioned enterprise AI account(s)
✓
Read and understand the Redline-Only Protocol for the six data categories
✓
Completed AI usage training with Team Lead
Section 10
Roles & Responsibilities
Who owns what in our AI security framework.
Role
Responsibilities
All Tiger Tracks Employees
Follow the Redline-Only Protocol · Use only approved enterprise platforms · Review all AI outputs before sharing with clients · Report incidents promptly
Sr. Director of Client Success
Ensure team is trained on this policy · Model appropriate AI usage · Escalate any client contract concerns before using AI on restricted accounts
Review client MSAs and vendor DPAs to confirm AI processing is permitted
📋
MSA Check: Ensure our Master Services Agreements permit the use of third-party AI processors. If a client's contract restricts this, escalate to your manager before using AI on that account.
Addendum · AM Guide
Account Manager Prompting Guide
High-precision guidance for using exact financial figures and sanitizing sensitive account strategy.
✅
Explicit Permission — Exact Budgets: Account Managers are authorized to use exact budget figures (e.g., "$42,381.17") for pacing, forecasting, and ROAS modeling — provided the prompt is executed within an approved Enterprise/Team tier.
The AM Pre-Flight Checklist
Before hitting "Send" on any prompt containing client data, run this 5-second mental check:
1
Tier Check: Is the "Team" or "Workspace" badge visible in the AI tool UI? If not, stop — you're on the wrong account.
2
ID Scrub: Are there any Account IDs, Pixel IDs, or Manager Emails in the text/CSV? If yes, black them out before sending.
3
Strategy Scrub: Are there any unreleased pitch details, new product names, or M&A info? If yes, abstract it (see examples below).
💡
If you answer Yes / No / No — you're clear to proceed with exact budgets and real client names.
Sanitized Strategy Examples
For sensitive accounts, abstract unreleased details to avoid exposing pitch concepts.
Client
❌ Unsafe Prompt
✅ Safe Sanitized Prompt
Hims
Draft a media plan for Hims' upcoming unannounced weight-loss chewable product launching in Q3.
Draft a media plan for a DTC men's health brand launching a new consumable product in Q3.
Aura Health
Aura Health is pivoting their messaging away from mindfulness to focus entirely on clinical sleep disorders next month. Give me 5 ad angles.
A mental wellness app is shifting its positioning from general mindfulness to clinical sleep solutions. Give me 5 ad angles.
Onboarding Requirement
AI Sanitization Completion Form
This form must be completed and submitted before you will be granted access to Tiger Tracks Enterprise AI tiers. Complete each step honestly — this protects you, your clients, and the company.
IT Administration
IT Portal
Request enterprise AI accounts, get agents approved, and track your access. All requests go to IT/Security for review.
🔑
Enterprise AI Account
Request your IT-provisioned Claude, ChatGPT, or Gemini Workspace access. Requires completed Sanitization Form.
🤖
AI Agent Approval
Connect an AI agent to company systems. Requires IT review of DPA and a dedicated Service Account.
📧
IT / Security Contact
Report an incident, ask a policy question, or escalate a concern about AI use on a client account.
Agents must use a dedicated Service Account — never a personal admin login. Read-only, least privilege, IT-provisioned.
AI Agent Approval Workflow
All AI agents that access company systems must go through this 4-step process before connection.
1
Request
Submit the Agent Request Form below. Include the tool name, what system it needs access to, and why.
2
Review
IT reviews the tool's Data Processing Agreement and permissions scope. Typical review time: 2 business days.
3
Provisioning
IT provisions a dedicated Service Account with restricted permissions — read-only to a specific resource, never full admin.
4
Connection
You connect the agent using the Service Account credentials only. Personal admin accounts must never be used.
Service Account Requirements
🛑
Hard Stop: Agents must never be connected using a personal Admin account. Always use an IT-provisioned Service Account.
🔒 Least Privilege
Service accounts get the minimum access needed — e.g., read-only to one Google Drive folder, not full domain admin.
🏷️ Named Accounts
Each agent gets its own Service Account. Shared credentials between agents or team members are prohibited.
📋 IT Provisioned
Only IT can create Service Accounts. Do not create your own or use existing admin logins.
🔄 Quarterly Review
IT reviews all active agent connections quarterly. Unused or unauthorized connections are revoked.
Enterprise AI Account Request
AI Agent Request Form
✅
Request submitted! IT/Security will review and respond within 2 business days at elizabeth@tigertracks.ai.
🛡️
Security Help Desk
Online · Powered by Claude
👋 Hi! I'm the Tiger Tracks AI Security Help Desk. Ask me anything about our AI usage policy — approved platforms, what to redact, how to handle incidents, anything.