> Site index: [llms.txt](https://ortelian.com/llms.txt) with all pages and descriptions.

# How do AI agents handle private information in chat, email and meeting recordings?

Source: https://ortelian.com/notes/how-ai-agents-handle-private-information-in-chat-and-meetings/
Markdown: https://ortelian.com/notes/how-ai-agents-handle-private-information-in-chat-and-meetings.md
Author: Laurens Nys
Published: 2026-11-06

Connect only what every workspace user may see. Give each agent the tools its job needs, keep outside actions behind a person, and record every run.

They only see what you connect, and only through the tools you give them. Private one to one chats, personal mailboxes and private meeting recordings should stay out of a shared workspace unless everyone in that workspace is allowed to see them. Outside actions, such as sending an email, wait for a person by default. Every run is recorded. The work is to decide what may be imported, not to hope the agent will keep secrets on its own.

## Why the question comes up

Buyers ask this early when an agent is meant to read Slack, email or call recordings. On one call, a mid market software company wanted to know how an agent would handle private information in chat and call recordings. On another, a sustainability consultancy asked whether the agent could read all their meetings, including private one to ones in the recording tool. Both questions are the same: once an agent can see a channel, who else can see what it saw, and what can it do with it.

## What "private" means for an agent

An agent has no separate sense of privacy. It works from the data and tools it is given. If a private recording or a restricted Slack channel is imported into a shared workspace, the agent can use it the same way it uses any other imported record. The limit is set when you connect the system, not by the agent guessing what is sensitive.

That is why the first decision is which sources to connect, not which prompt to write. Connect only the channels, mailboxes and recordings that the people in the workspace are allowed to see. Leave private one to ones, HR conversations and personal mailboxes out unless that group is meant to see them.

## Five rules that keep private information under control

1. **Connect only what every workspace user may see.**

   Inside a workspace, everyone sees everything that was imported, even records they cannot open in the source tool. If a channel or recording is not safe for that group, do not connect it. See

   [Trust](https://ortelian.com/trust/)

   .
2. **Give each agent only the tools its job needs.**

   Connecting a system does not grant access by itself. Scoped tools, not open computer access, are how an agent reaches chat, email or a recording store. Detail is on

   [the platform](https://ortelian.com/platform/)

   .
3. **Keep agents read only until a write is granted.**

   Reading a meeting transcript is different from sending a follow up. Writes and actions that leave the company wait for a person by default. How to set those points is in

   [approvals and control for AI agents](https://ortelian.com/notes/approvals-and-control-for-ai-agents/)

   .
4. **Do not let the agent widen its own access.**

   Agents cannot create tools or grant themselves access. Text in your data or in a model's answer cannot change their permissions.
5. **Record every run, action and approval.**

   When something looks wrong, you need the trail: what was read, what was drafted, who approved it. That record is also how you check whether a private source was connected by mistake.

| Source | Usually safe to connect for a shared agent | Keep out of a shared workspace |
| --- | --- | --- |
| Chat | Public or team channels the whole workspace may read | Private one to ones, HR or leadership channels |
| Email | Shared team inboxes the role already uses | Personal mailboxes, confidential legal threads |
| Meeting recordings | Team meetings the group already attends or may replay | Private one to ones, interviews, sensitive HR calls |
| What the agent can do with them | Read, draft, prepare a brief for a person | Send, share or export without approval |

## What tends to go wrong

- **Connecting everything "for context".**

  A private one to one in the recording tool becomes visible to every workspace user and to every agent that can read that source.
- **Assuming the agent will filter.**

  Agents do not invent access rules. If the recording is connected, it is in scope.
- **Letting an agent send from a shared mailbox without approval.**

  Sending an email leaves the company. That step waits for a person unless your team has allowed that specific action to run on its own.
- **No trail.**

  Without a record of what was read and what was sent, nobody can tell whether a leak came from the connection, the draft or a person.

## How Ortelian approaches it

On [the platform](https://ortelian.com/platform/), agents reach your systems through scoped tools, never with open computer access. Each agent gets only the tools its job needs. Connecting a system does not grant access by itself. Agents are read only until a write is granted. Actions that leave the company, such as sending an email or an invoice, wait for a person by default. Agents cannot create tools or grant themselves access. Every run, action and approval is recorded.

On [Trust](https://ortelian.com/trust/), the access rule is explicit: each customer sits in its own workspace, and inside a workspace every user sees all imported data. Connect only data that all of your workspace users may see. Models run with zero retention and do not train on customer data. Credentials never reach a model. The workspace, world model and backups stay in the EU; sign in and agent mailboxes run in the US. EU only model routes are available on request.

We agree access, model providers and data handling for your deployment before work starts ([how we work](https://ortelian.com/how-we-work/)). The same discipline that keeps private information out of the wrong hands also keeps company context consistent for the agents that should use it: see [the company context layer](https://ortelian.com/notes/the-company-context-layer/).

## Questions people ask

### Can an AI agent read private Slack or Teams messages?

Only if those messages are in a source you connected to the workspace. Private one to ones and restricted channels should stay disconnected unless everyone in the workspace may see them.

### Can an AI agent listen to all our meeting recordings?

Only the recordings you import. Private one to ones and sensitive HR calls should stay out of a shared workspace. Team meetings the group already shares are the usual starting point.

### Will our private emails be used to train a model?

Not with Ortelian. Providers are bound in writing to zero retention and no training on customer data. Credentials never reach a model.

### Can an agent send an email from what it read in a meeting?

Only if your team has allowed that action to run without approval. By default, sending an email waits for a person.

### Who inside our company can see what the agent read?

Everyone in the workspace sees everything that was imported. That is why the connection decision matters more than the prompt.

## Sources

- Ortelian,

  [Trust](https://ortelian.com/trust/)

  ,

  [Platform](https://ortelian.com/platform/)

  and

  [How we work](https://ortelian.com/how-we-work/)

  .
- Ortelian,

  [Approvals and control for AI agents](https://ortelian.com/notes/approvals-and-control-for-ai-agents/)

  and

  [The company context layer](https://ortelian.com/notes/the-company-context-layer/)

  .