What everyday platforms do with a small organisation’s intellectual property — and what survives when the secret doesn’t.
If your members’ personal information leaks, machinery exists to tell you. Someone must notice, someone must tell you, and above a threshold of harm someone must tell the Privacy Commissioner as well.[1] The machinery is imperfect. It produces the one thing an organisation needs in order to learn: a signal.
If your method leaks, nothing tells you anything.
That is not an absence of law. Every duty that might apply — continuous disclosure for a listed issuer, notice to an insurer, a contractual clause, even the Privacy Act where the material happens to include a client list — is triggered by detection. Insider theft gets detected: it produces disputes, and disputes produce documents. Platform-mediated seepage does not. The specification pasted into an assistant, the drive indexed by a tool with more reach than the person using it, the negotiation transcribed by a notetaker nobody invited — these defeat detection itself. The tripwire is real. It sits behind a door this kind of loss never walks through.
And for the unlisted small or mid-sized firm, which is most of the New Zealand economy by firm count, most of those tripwires do not exist at all.
So the absence of a case list proves little. A loss channel that defeats detection produces exactly the silence we observe. That is an uncomfortable kind of argument, which is why what follows leans hardest on the places where there are bodies.
The everyday platforms a small organisation runs on — the group chat, the page, the community platform, the shared workspace, the assistant, the code host — carry a level of risk to commercially significant material that the same organisation would refuse outright in any other part of its operations.
That is a claim about risk, not about conduct, and the distinction is not politeness. Nobody at these companies is coming for your work. They are, for the most part, good tools, competently run, by organisations with security resources no New Zealand firm can match. The problem is not that they are bad at what they do. It is that what they are built for and what you are using them for have quietly diverged — and the terms you agreed to say so, plainly, in public.
Consider what you would accept elsewhere. You would not bank with an institution that could change your account terms by posting a notice, gave you five business days to object, and offered departure without refund as the only remedy. You would not instruct a lawyer who could not tell you which country your file was held in. You would not appoint an accountant whose engagement letter permitted them to train a product on your figures. You would not sign a lease letting the landlord read your correspondence to improve the experience of their other tenants.
Each of those describes a term in ordinary use. Published, not hidden. Not sinister — simply the terms on which a service is offered free or nearly free to several hundred million people, almost none of whom are keeping anything that matters in it.
Three properties together are what make this high risk in the sense a board should care about:
High consequence, undetectable, no recovery. Anywhere else in the business that profile earns a line in the risk register and a named owner. Here it usually has neither — not through inattention, but because nothing has ever produced the signal that would put it there.
It is tempting to reach for intent, and it would be a mistake.
What happened is duller and harder to argue with. A very large amount of capital was invested in systems that shape what people reach for by default; terms were drafted to be capacious rather than cruel; and the aggregate drift went one way. Individual harms have defendants. The drift has none. Hannah Arendt’s name for authority that is real while nobody is answerable for it was rule by Nobody, and whatever one makes of the borrowing, the practical test is simple: when the terms change under you, who do you ring?
You already know, because you have tried.
Two exposures are not attacks and never will be. They are the building the doors are set into.
Lawful use under the terms. Training, service improvement, human review, personalisation. Not a breach — the contract working exactly as written. This is what people mean when they say “we’re fine, we’re on the paid tier”, and it is the part they have read least carefully.
The clearest current example is not a consumer toy. In April 2026 GitHub’s terms were amended so that the licence you grant now runs to “training AI Features, and for the purpose of training, developing, and improving artificial intelligence and machine learning models and technologies of our Affiliates”. A second sentence in the same clause removes any doubt about whose models: use of your content to train “models and technologies of GitHub and our Affiliates is within the scope of this license and does not constitute a sale or other restricted transfer of Your Content”. The sentence that previously said the licence did not grant GitHub the right to sell your content is gone, and that last clause is what replaced it.[2] Copilot’s Free, Pro and Pro+ tiers train on interaction data by default.[3] Private repository content at rest is still excluded — the interaction data passing through the assistant is not. Nobody hid this. It was published, and almost nobody read it.
Legal compulsion. The US CLOUD Act compels American providers to hand over data they control, wherever it is stored. Residency is not jurisdiction: a European data centre operated by a US-owned company through an Irish subsidiary is still reachable. Compulsion has a second face that gets less attention — a preservation order in somebody else’s litigation can freeze retention of material you assumed was ephemeral.[4]
There is a third item in this category that is not confidentiality at all. A capability can be switched off. When that happens the exposure is to your availability, and an organisation that has routed a core process through a tool it does not control has an operational dependency it never priced.
Ranked by the strength of the public record, not by how alarming they sound.
This is where the bodies are. A continuous-integration provider disclosed in January 2023 that an attacker had stolen a valid, two-factor-backed single-sign-on session from an engineer’s laptop and used it to reach customer secrets — proof, in the vendor’s own post-mortem, that multi-factor authentication does not protect a session already issued.[5] A coverage tool shipped a modified uploader script for two months in 2021, exfiltrating environment variables — every credential in every build.[6] In March 2025 a compromised GitHub Action, in use across some 23,000 repositories, was found to have printed secrets to the logs of 218 of them.[7] In August 2025 a compromised build script did something newer: it invoked whichever AI command-line tools it found installed, with their safety flags disabled, and used them to hunt for secrets.[8]
Your entire deliberation history, searchable, retained by default, exportable by anyone holding a valid session.
In 2025 an individual agreed to plead guilty in a United States federal court to downloading, the previous year, approximately 1.1 terabytes of confidential material from thousands of a media company’s internal chat channels, having reached the victim’s password manager through a trojaned AI tool.[9] In 2021 a games publisher lost source code to attackers who bought a stolen session cookie for about ten dollars.[10]
In none of these was the chat platform itself breached. Every one was a stolen human credential or session. The exposure is not that the vendor is careless. It is that everything your organisation has ever said sits in one searchable place behind one person’s session, and that retention is on by default.[11]
The strongest exhibit here is the vendor’s own documentation. Microsoft’s guidance on restricting search for its assistant states that the control “isn’t a security boundary” and is “a short-term solution”, illustrates the problem with a worked example of the assistant surfacing a mis-permissioned site.[12] That stopgap closed to new enablement on 31 July 2026.[13]
Alongside it: a zero-click vulnerability in the same assistant class, CVE-2025-32711, allowing exfiltration without any user action.[14] An injection published to a public channel of a workspace assistant that pulled content out of private ones, to which the vendor’s first response was that this was “intended behavior”.[15]
The pattern is consistent: untrusted content enters retrieval scope; the assistant runs with the victim’s identity; the exfiltration rides the vendor’s own permitted domains. What is not established is a confirmed commercial loss through this route. It is a demonstrated attack class, not yet a demonstrated theft, and I will not dress it as one.
The measurable claim here is about governance, not volume. The best available measurement is that 72% of enterprise users of generative AI are using personal accounts to do it[16] — which means the governance, whatever it says, is not attached to the tool being used.
Consumer defaults compound it: several major assistants train on conversations unless you opt out, and one vendor retains human-reviewed conversations for up to three years, surviving deletion of the chat.[17]
What is not evidenced, and is repeated everywhere: any case of pasted material resurfacing from a model. The input is proven. The output is not. Anyone who tells you otherwise is repeating a story.
The negotiation, the board discussion, the idea nobody wrote down.
An Ontario privacy regulator has documented a case in which a departed physician’s notetaking account joined hospital rounds on a recurring invitation and distributed the transcript to sixty-five recipients.[18] One vendor’s privacy policy permits training on de-identified audio and on transcriptions, which it acknowledges may contain personal information.[19] Others commit categorically not to train.[20] The distinction is in the terms, not the marketing.
A note on consent, which is where committees usually stop. The problem of verification and the problem of consent are logically distinct, and solving one does not solve the other. An employee clicking accept on a notetaker’s terms resolves neither for the organisation whose material is in the room.
A group chat is, functionally, a distributed list of your members’ phone numbers, visible to every member and portable out by any of them. For a book club that is trivial. Where membership is itself the sensitive fact — a health condition, an immigration status, a recovery programme — end-to-end encryption protects none of it. Research presented in 2026 demonstrated enumeration of billions of accounts through contact discovery, and found that more than half the numbers in a scrape more than six years old were still active.[21] The lesson is architectural: a service keyed on phone numbers is enumerable by design.
Among the dedicated community platforms, the differences are documentary and worth reading rather than assuming. One publishes a data-processing addendum dated June 2023, which still recites a Type 1 audit while its trust centre now offers a Type II report; the addendum has gone unrevised for three years, during which two AI model providers joined its subprocessor list, and it addresses AI features nowhere.[22] Another publishes a Type II report, a public SOC 3, dated penetration-test summaries, a thirty-day objection window, and an explicit commitment never to use personal data to train external models — alongside an undated addendum, subprocessors located entirely in the United States, and a broad perpetual licence to process content “to develop and improve” its products.[23]
Neither of those is a scandal. Both are answerable in writing, which is the point of the questions further down.
Some readers should carry on exactly as they are.
The counter-case deserves more than a mention. Every competitor sits on the same tools, so the exposure is shared and confers no relative disadvantage, while the firm that migrates alone pays the entire cost. Measured productivity traded against unmeasured risk is, on ordinary reasoning, a poor trade until the risk is quantified — and I cannot quantify it. What I can say is that the trade looks different for the small number of things whose loss you would not recover from. Nothing below asks you to move everything.
Secrecy is a wasting asset. It fails on disclosure, it fails on retention, it fails quietly, and once it has failed it cannot be restored. If your protection strategy is entirely “keep it hidden”, it has a single point of failure and no recovery path.
The alternative is not better hiding. It is to stop relying on the secret and start being able to prove when you had it.
Overselling this is what makes people stop listening. A sealed record does not protect anything. It does not prevent appropriation, it is not a shield, and it is not a legal instrument. What it does is make the taking contestable afterwards — a dated, signed, independently checkable record that predates the appropriation. Whether that satisfies any particular legal duty is a matter for your counsel, not for me and not for a vendor.
A smaller claim than “we secure your intellectual property”. Also the one that survives contact with an adversary.
It would be easy to read what follows as saying you need trusted timestamping before any of this is worth starting. You do not, and that matters more than the sophistication that comes after it.
A signed, sealed record held under your own custody already gives you four things, none of which depend on a timestamp authority:
That rung carries no charge, and it is switched on. Everything below refines it; nothing below is a precondition for it.
Signatures decay. The ones in the system I build are Ed25519 — classical, and eventually forgeable. You do not have to take that on trust: every record states the algorithm it was signed under, so the claim is checkable from the record rather than from me [algorithm identifier, carried on each signed entry]. That is also what makes replacement a configuration change rather than a rewrite, because a verifier reads the algorithm instead of assuming it. Post-quantum signatures are not yet in use, and anyone claiming quantum-safe signatures today should be asked to name the algorithm.
What does not decay is an assertion that cannot be back-dated, because the timing was fixed by an outside party at the moment of creation. That is the property that decides a priority dispute, where the entire question is who held what, when. Re-stamp before each algorithm’s demise and the chain of evidence outlives every algorithm in it. The standards for this have existed since 2007.[24] What does not exist is anyone who has yet carried such an archive through a post-quantum transition at scale — a frontier, not a solved problem.
It is also why the choice of timestamp authority is not a procurement detail. The property rests entirely on the stamp coming from someone who is not you.
The ladder, plainly: sealing first — no charge, independently checkable, and switched on. A qualified timestamp when one is contracted, for material where provable priority is the point; until then the timestamps in use are free and unqualified, and no record carries the presumption. Custody arrangements last, because they are hardest and least finished. Nobody is offering the top of that ladder today, and that includes me.
Recommending action while implying the field is settled would be a lie by omission.
That is the argument for piloting rather than committing. You do not bet an organisation on a field in this state. You do run small, reversible experiments in it — because the alternative, waiting for the field to settle, means arriving after the decisions that mattered were taken.
None of the first steps require buying anything, and they pay off on the platforms you already have. That is deliberate. If the rest of this essay is wrong, this section is still sound.
First, and it costs only a meeting. Name the small number of things whose loss you would not recover from. Most organisations have between three and ten. Write down where each currently lives, and who can export it. That inventory is usually the moment the room goes quiet.
Then the cheap and reversible. Retention periods, because material you did not keep cannot leak now or be read later. Phishing-resistant authentication on every administrative account — and note the continuous-integration case above: a second factor does not protect a session already issued, which is why session lifetime and device posture matter as much as the login. Run an export rather than trusting that one works. Write down what does not go on which platform. Audit who holds administrative rights; in most organisations that list includes people who left.
Then the questions. Put in writing to each vendor: what is the retention period for member content, direct messages and deleted accounts; is our material processed by AI features or any third-party model provider, and is that provider a listed subprocessor; is it used to train anything, including your own models; may we see a current assurance report; what residency options exist. Keep the reply. A documented question is itself a control — it establishes what you were told, and when.
Ask me the same questions. If the answers are worse than your incumbent’s, use the incumbent.
Then, and only for the things on the first list, a pilot. Small, bounded, reversible, carrying no more than one item from that first list. What you are testing is not whether the technology works, but whether your organisation can operate it — key custody, succession, and whether anybody actually runs the verification.
That last one is where systems of this kind quietly fail. A record is tamper-evident, not tamper-proof: a compromise leaves marks. Marks only matter if somebody looks. An unmonitored log catches nothing at all.
Not vaults that cannot be broken. No such thing exists, and anyone selling one is lying. Records that cannot be silently rewritten — where a compromise leaves marks any party can verify independently, the damage is bounded by what the record can be made to say, and the evidence outlives the attacker.
Nor is any of it a substitute for a frontier laboratory. The capital being spent on frontier capability is beyond the reach of any sovereign operator. But that capital buys compute and buildings. It does not buy custody, provenance or independent verifiability — those are protocol problems, their best artefacts are open specifications, and their marginal cost is engineering discipline rather than hardware. Large platforms fund that work too, and fund it well. The difference is where trust terminates: in their root, their logs, their attestation keys, under their jurisdiction.
Which is the whole argument, and narrower than it first appears. You do not need to reproduce the frontier. You need to stop feeding it the few things you could not survive losing, while going on using it for everything else.
This is a synthesis of public reporting and published vendor documentation as at 2 August 2026. It is not primary research and it is not legal advice; where the stakes justify it, take advice in your own jurisdiction.
The strongest claim here — that the loss is silent — is an argument from absence, and arguments from absence are weak. That is why the evidence above is ranked, and why the weakest door is labelled as the weakest.
Several vendor positions cited here changed within the last four months and will change again. Every one carries a date. Re-check any figure on which a decision will turn.
I build and sell sovereign infrastructure. The system described is cited only as evidence that the approach is buildable. What is actually available, rung by rung: sealing carries no charge, is switched on, and is checkable without asking me, signed by your key. The qualified-timestamp tier has its interface built and no authority contracted — so the statutory presumption that comes with a qualified European stamp is not something I can offer you yet. The custody tier is under way and not finished. No organisation is running the full arrangement in production.
The security review behind it was an internal adversarial review by AI agents that did not build it, plus automated scanning. It has not been penetration-tested, independently or otherwise, and I will not describe it as though it had.
Post-quantum signatures are roadmap and not running. That includes mine.
The instrument that names your work and attaches no consent step is not usually a treaty. It is a terms-of-service update you did not read, applied to a tool you did not choose, by a company you cannot ring.
None of that requires anyone to have behaved badly. It requires only that a tool built for reach be used as a vault, for long enough that nobody remembers deciding it.
You will not be told when it matters. So the question is not how to keep the secret. It is what you will be able to prove when the secret is gone.
Every source below was checked against the originating document, regulator, court record or vendor page rather than against reporting about it. Where only secondary reporting exists, it is said so.
tj-actions/changed-files, CVE-2025-30066, March 2025;
CISA alert. Some 23,000 repositories used the action; Endor Labs found
5,416 referencing it, 614 running an impacted workflow in the window,
and 218 that printed secrets to logs. The 23,000 is usage, not exposure,
and only the 218 is Endor Labs’ figure.draft-oauth-ai-agents-on-behalf-of-user — an
individual draft, now at -02 and expired. Not an adopted standard.Not cited, because they do not survive checking: any account of source code pasted into an assistant later resurfacing from a model; the claim that a coding assistant’s malicious pull request wiped machines (it never executed); and the report that a frontier model spent five days intruding on real companies unnoticed, which conflates two unrelated disclosures.
Companion piece: What Survives When the Secret Doesn’t — the same argument, where the knowledge is rongoā Māori and the instrument is a trade agreement. What it costs, and what is not on sale yet: the tiers.