Private workspaces
Client records, files, projects, and notes are organized by company so users only access what they are allowed to see.
Trust & Data
AI systems only work if the business can trust them.
Service businesses may share customer data, estimates, photos, files, documents, payment records, and internal operations details. Clearstep designs systems around privacy, consent, controlled access, and human review.
Operating rules
AI should not mean handing your business data to random tools.
These principles should shape Firebase rules, server functions, file storage, AI usage, billing records, and future contractor access.
Private files by default
Business documents, photos, estimates, and customer files should live in private storage, not public links.
Server-side AI calls
AI provider calls should happen through backend systems so API keys and sensitive logic are not exposed in the browser.
Consent for sensitive AI use
If confidential documents or sensitive business data may be processed by AI, the workflow should be documented and consented to.
Human-reviewed outputs
AI can draft, summarize, classify, and organize. Important business decisions and customer-facing outputs should stay human-reviewed.
Payment protection
Payments should run through Stripe. Clearstep should store billing references and status, not raw card data.
Data model
Every sensitive record needs ownership, role checks, and a trail.
The future client portal should not rely on informal naming conventions or public links for access control.
Required fieldsorgId, createdBy, createdAt, updatedAt, role or visibility, and status where relevant.
Key objectsUser, Organization, Contact, Opportunity, Audit, Project, WorkSession, File, Invoice, SupportRequest, AIRun, AuditLog.
AI useBackend-only provider calls, consent record, minimal data, and traceable AIRun records.
PaymentsStripe handles cards and invoices. Firestore stores references and status, not card details.
Human review
AI can assist the workflow. It should not secretly own the judgment.
Customer-facing communication, pricing, legal interpretation, sensitive documents, billing decisions, and important commitments should have a clear human review path.
DraftAI can help write summaries, replies, checklists, and internal notes.
ReviewA person approves outputs that affect customers, money, obligations, or risk.
RecordSensitive AI use should create an AIRun record tied to purpose, consent, and project.
ImproveSupport should monitor where the system helps, fails, or needs a safer process.
Next step
Build AI systems with privacy and review designed in from the start.
Start with a free call to talk through the workflow and data involved. The AI + Systems Audit can then identify useful workflows, sensitive data, human-review points, and support needs before implementation begins.