Security and privacy for customer service
13 September 2026

Security and privacy for customer service


A customer service manager checks the purchase order table to answer a customer query, and considers how an enterprise AI system will affect this process, ensuring the system meets security and privacy requirements, and handles data correctly, to prevent prompt injection and protect sensitive information.

A customer service manager reviews the purchase order table to answer a customer query about a delayed shipment, and wonders how an enterprise AI system for customer service will affect this process. The system will be able to answer questions about the organisation's own data in real time, but the manager needs to consider the security and privacy implications before deployment.

Processing and storage of data

The first question to settle is where the data will be processed and stored, and whether the system will train on this data. Most people assume that the data will be stored in a single location, but in reality, the data may be split across multiple systems, such as the customer relationship management system, the enterprise resource planning system, and the knowledge base. The customer service manager needs to ensure that the data is handled correctly, and that the system is not training on sensitive information.

This requires careful consideration of the system's architecture, and how it will interact with the various data sources. The manager should work with the procurement team to ensure that the system meets the organisation's security and privacy requirements, and that the data is handled in accordance with relevant regulations. This may involve reviewing the system's data processing agreements, and ensuring that the data is encrypted and anonymised where necessary.

Prompt injection as a data-boundary problem

Prompt injection is a potential security risk that occurs when an attacker is able to inject malicious prompts into the system, in order to extract sensitive information or disrupt the service. This is a data-boundary problem, as it relies on the system's ability to distinguish between legitimate and malicious prompts. The customer service manager needs to ensure that the system has robust controls in place to prevent prompt injection, and that the system is able to detect and respond to potential security threats.

This requires careful consideration of the system's security controls, and how they will be implemented in practice. The manager should work with the security team to ensure that the system meets the organisation's security requirements, and that the controls are regularly reviewed and updated. This may involve implementing additional security measures, such as authentication and authorisation controls, to prevent unauthorised access to the system.

Customer service data

The system relies on a range of customer service data, including ticket history, knowledge base articles, product and order records, and escalation history. This data is used to answer customer queries, and to provide a personalised service to customers. The customer service manager needs to ensure that this data is accurate and up-to-date, and that it is handled in accordance with relevant regulations.

The ticket history, for example, provides a record of all customer interactions, and allows the system to provide a personalised service to customers. The knowledge base articles provide a source of information that the system can draw on to answer customer queries, and the product and order records provide detailed information about the customer's purchases. The escalation history provides a record of all escalations, and allows the system to identify potential issues and provide a proactive service to customers.

Changes to customer service processes

The system will change the way that customer service processes are handled, as it will be able to answer questions about the organisation's own data in real time. This means that the same issue will not be answered from scratch each time, and that root causes will be fed back to the product team to improve the overall service. The customer service manager needs to ensure that the system is integrated with existing processes, and that the benefits of the system are realised in practice.

This requires careful consideration of the system's impact on existing processes, and how it will be used to improve the overall service. The manager should work with the operations team to ensure that the system is integrated with existing processes, and that the benefits of the system are realised in practice. This may involve implementing new processes, or updating existing ones, to take advantage of the system's capabilities.

Measuring the benefits

The benefits of the system can be measured using a range of metrics, including first contact resolution, time to answer, and repeat contact rate. These metrics provide a way to evaluate the system's performance, and to identify areas for improvement. The customer service manager needs to ensure that these metrics are regularly reviewed, and that the system is updated and improved over time.

The first contact resolution metric, for example, provides a way to evaluate the system's ability to answer customer queries on the first contact. The time to answer metric provides a way to evaluate the system's response time, and the repeat contact rate metric provides a way to evaluate the system's ability to resolve issues on the first contact. By regularly reviewing these metrics, the manager can identify areas for improvement, and ensure that the system is providing a high-quality service to customers.

Limitations of the system

The system is not a replacement for human customer service agents, and it is not suitable for all types of customer queries. In some cases, the system may not be able to provide a satisfactory answer, and the customer may need to be escalated to a human agent. The customer service manager needs to ensure that the system is used in conjunction with human agents, and that the benefits of the system are realised in practice.

If you have any questions about the system, or would like to discuss how it can be used to improve your customer service processes, please contact us. We will be happy to provide more information, and to discuss how the system can be used to meet your needs.

Frequently asked questions

How does an enterprise AI system affect customer service security and privacy?

The system must meet security and privacy requirements, handling data correctly to prevent prompt injection and protect sensitive information.

What is prompt injection and how can it be prevented?

Prompt injection is a security risk where attackers inject malicious prompts, which can be prevented with robust controls, authentication, and authorisation measures.

How does the enterprise AI system handle customer service data?

The system relies on customer service data, including ticket history and knowledge base articles, which must be accurate and up-to-date, and handled in accordance with regulations.

Can the enterprise AI system replace human customer service agents?

No, the system is not a replacement for human agents, but rather a tool to assist them, and it is not suitable for all types of customer queries, requiring human escalation in some cases.