Sources
Where our best practices come from
Our guides are built on public best practices from government safety agencies, independent security experts, trackers of privacy and AI laws, and the AI companies' own policies. When one of them changes something that affects your business, we update the guides. Buyers get updates to what they bought free for the first year. After that, they can choose to renew for $19 a year. Nothing renews automatically.
Government safety guidance
Free, public best practices from the agencies whose job is keeping businesses and their customers safe.
Federal Trade Commission (FTC)
The U.S. consumer protection agency. Its business guidance explains the rules on AI claims, online reviews, and customer data.
ftc.gov Last checked October 2026
NIST Small Business Cybersecurity Corner
The national standards agency's plain guide to basic security for small offices. Its AI risk guide also helps us check the kit.
CISA
The U.S. cyber defense agency. Its guidance on keeping data safe when you use AI tools becomes simple rules in our guides.
Independent security experts
People and groups who study how AI tools get tricked or misused, and who share what they find openly.
OWASP
A nonprofit with hundreds of volunteer security experts. Its top 10 lists of AI risks are the checklist we test our rules against.
Simon Willison
An independent software developer who explains new ways AI tools can be tricked, in plain words and often early.
MITRE ATLAS
A nonprofit's public record of real attacks on AI systems. We use its true stories as examples, retold simply.
SANS OUCH!
A free monthly security newsletter written for everyone, not specialists. Useful for training your staff.
Privacy and law trackers
Where we watch for new state laws on AI, so the rules in our guides stay accurate.
IAPP State AI Law Tracker
The largest association of privacy professionals. Its free tracker shows which states have passed AI laws that apply to businesses, including Washington and Colorado.
iapp.org Last checked October 2026
Consumer scam warnings
New scams reach small businesses and their staff quickly, including ones that use AI to fake a voice or a face.
FTC Consumer Alerts
Short, dated warnings about the latest scams and privacy risks, written for the public.
FBI Internet Crime Complaint Center
The FBI's public warnings about new kinds of fraud, such as callers pretending to be officials.
AARP Fraud Watch Network
Free scam alerts twice a month in plain words, open to everyone, not just members.
The AI companies' own policies
What each tool does with the information you type in. We read these pages ourselves rather than relying on news stories.
ChatGPT
OpenAI's release notes, where changes to memory and data settings are announced.
help.openai.com Last checked October 2026
Claude
Anthropic's privacy center, which explains what Claude keeps and whether it learns from your chats.
privacy.claude.com Last checked October 2026
Gemini
Google's privacy hub for Gemini, covering activity settings and when people at Google may review chats.
support.google.com Last checked October 2026
Microsoft Copilot
Microsoft's release notes for Copilot at work, including how business data is protected.
learn.microsoft.com Last checked October 2026
Grok
The privacy policy for Grok, which states how your information is used and whether it trains the tool.
x.ai Last checked October 2026
How we use these
We watch these sources and run a full check every month, starting November 2026. When something changes that affects a rule in our guides, we update the guide and list the change on the SafeStart updates page. If we get something wrong, we fix it and note it in our corrections log.
See a mistake on this page? Report a correction. Fixes are listed in our corrections log.