How to protect client data in a services business

The data that belongs to the client and passes through your systems: designs and drawings, bookings and traveler records, media plans and creative assets, due diligence files, credentials for the client's own portals. This data leaves the perimeter constantly, because delivering it is the service. The goal is not to block the exit. It is to make sure the file stays encrypted, tracked and revocable after it arrives.

It depends on what you deliver. Managed ICT service providers and managed security service providers are classed as important entities; cloud and data centre providers as essential entities (Italian Legislative Decree 138/2024, in force since 16 October 2024). Consulting, travel and advertising usually stay outside the direct scope, but they get pulled in as suppliers: Article 21 requires in-scope entities to manage supply chain risk, which turns into contractual security requirements for their vendors. The current operational reference is ACN Determination 127437 of 13 April 2026, with measures due by October 2026.

Both parties, on different grounds. The client remains the data controller, the supplier is the data processor under GDPR Article 28 and answers for the security measures it put in place. The context matters: third parties were involved in 48% of breaches, up 60% year over year (Verizon DBIR 2026). Commercially, a breach at the supplier costs the contract, not just the fine.

By giving them something usable instead. 45% of employees now use AI tools on corporate devices, up from 15% the year before, and source code is the data type most often uploaded to external GenAI models (Verizon DBIR 2026). Bans do not hold. AIGrant provides private on-premise AI that only works on documents the user can already access, while FileGrant blocks external models from scraping protected content. Widespread shadow AI adds an average of $670,000 to breach costs (IBM Cost of a Data Breach 2025).

In an encrypted vault with tracked sharing, not in a spreadsheet or a chat thread. SecretGrant, a FileGrant module, holds client portals, CMS platforms, cloud environments and ad accounts, shares them with internal and external collaborators without ever exposing the password, and revokes access at project end without forcing the client to rotate the credential. Every use stays logged for audit.

No, it sits alongside them. FileGrant does not replace the collaboration platform you already run: it adds the protection that disappears once a file leaves, meaning persistent quantum-safe encryption, revocation after sharing, screenshot and AI scraping blocking, and an audit trail. AIGrant likewise does not replace Copilot: it covers the cases where client data cannot leave the network. Deployment is modular and works with legacy systems, without reconfiguring existing infrastructure.