Acceptance criteria
Cover pipeline, pricing, contracts, supplier terms, financial projections, M&A and investment data.
Why it matters
Pricing, contracts and deal information are often a company's most valuable data and rarely follow a pattern.
How to verify
Commercial information in unstructured pilot prompts is detected on default configuration.
OWASP adoption context
Commercially confidential information can appear across the listed employee AI settings; its sensitivity depends on the content and business context, not the tier.
Framework mappings
Recognition of designated confidential commercial information supports its identification, sensitivity classification and leakage rules. The buyer’s classification policy and enforcement action are still required. SOC 2: C1.1: The Confidentiality category and relevant information must be in scope. ISO/IEC 27001: A.8.12: Use an operated leakage-protection workflow with defined alert triage, warnings, blocking or another protective response. Recognizing M&A or financial content does not classify every record.
Recognizing confidential commercial content supplies a specific input to data-in-transit protection. Use findings in an operated leakage-protection workflow; classification alone neither prevents release nor maintains an inventory.