Protecting Your Data When You Use AI in Your Business
A White Paper for Multifamily Operators. Enterprise AI safeguards, client protections, and the documents that prove them.
In This Article
The exposure sits on you, not on the vendor.
In February 2026, a federal court ruled that a criminal defendant's private conversations with a public AI chatbot were fully accessible to the government. The case, United States v. Heppner, was the first of its kind. It will not be the last.
For multifamily operators, the ruling raises a critical question: when your team uses AI to draft resident emails, screen prospects, or handle Fair Housing decisions, where does that data actually go, and who can see it?
Here is the problem: most multifamily teams are using free or consumer AI tools with no idea what happens to the data they type in. That exposure sits on your organization, not on the AI vendor.
This white paper does two things at once. It explains what your organization is exposed to when your team uses AI, and it gives you a vendor evaluation framework you can apply to every AI provider on your stack. Throughout, mPro Digital Edge is used as a working example of what enterprise-grade protection looks like at each layer.
This paper covers four topics
This guide is educational, not legal advice. Consult your own counsel for guidance specific to your organization.
What Changed: The Heppner Ruling
How a single federal decision created new exposure for every multifamily operator using AI.
A federal precedent for AI conversations
On February 17, 2026, the United States District Court for the Southern District of New York issued a written decision addressing whether communications with a generative AI platform receive attorney-client privilege or work-product protection. This was the first federal ruling to squarely address this question. It will shape how regulators and opposing counsel view AI conversations for years to come.
The Facts
What the Court Found
Judge Rakoff identified three independent reasons the AI-generated documents were not protected:
What This Means for Your Operation
Regulators, opposing counsel, and government investigators now have a federal precedent to point to when arguing that AI conversations are discoverable. Every operator using AI in their business needs to assume that inputs typed into an unprotected tool could be reviewed by a third party.
For multifamily operators, the implications are immediate. If your leasing team uses free ChatGPT to draft Fair Housing guidance, if your marketing team uses consumer Claude to build campaign strategies, if your property manager uses a free tool to compose resident letters - that data is no longer yours. The ruling says it is discoverable, trainable, and shared at the vendor's discretion.
This is not hypothetical. It is your exposure today.
Consumer AI vs. Enterprise AI
What separates a protected data flow from a discoverable one.
Not just the paid version
Enterprise AI does not just mean the paid version of a consumer tool. It means specific contractual, technical, and operational protections that free and personal accounts do not provide. The distinction is what separates a protected data flow from a discoverable one.
Use the comparison below as your vendor evaluation tool
Every item in the right-hand column should be verifiable in a signed contract or an independent audit report. If a vendor cannot produce written evidence for an item, treat that protection as absent.
| Protection Category | Consumer AI | Enterprise AI |
|---|---|---|
| Training Data Use | Terms allow vendor to use inputs for model training | ✓ Written zero-training guarantee in signed contract |
| Human Review | Data may be reviewed by human moderators | ✓ Data isolated in segregated tenant environment |
| Third-Party Disclosure | Vendor reserves right to disclose to third parties, including government | ✓ Contractual confidentiality covenants |
| Data Processing Agreement | No DPA | ✓ Signed DPA defining roles and obligations |
| Security Audit | No SOC 2 audit for your account | ✓ SOC 2 Type II audited controls, reissued annually |
| Sub-Processor Transparency | Limited visibility into third parties | ✓ Disclosed list with change notification rights |
| Audit Logging | Limited or no accessible audit logging | ✓ Complete audit logging of all activity |
| Data Residency | Data residency not guaranteed | ✓ Defined hosting region and encryption standards |
What Enterprise AI Actually Fixes
Enterprise-grade architecture solves four specific problems consumer tools create:
What Enterprise AI Does Not Fix on Its Own
Three critical gaps remain. Enterprise architecture solves the vendor layer. You solve the rest.
A good contract solves one layer. Your policies, your training, and your platform architecture solve the rest.
The Three-Tier Data Classification Model
Which tools your team can use, for which data, under which conditions.
Three tiers. Every input fits one.
Every piece of data your team handles falls into one of three tiers. The model tells you which tools you may use, for which data, under which conditions. This is the foundation of every AI use policy we recommend. Use this model to build your data governance today.
Tier 1
General Business Data
Definition: Data that is already public or intended for public distribution, and carries no confidentiality, regulatory, or personal information exposure.
May be used with any AI tool that meets basic security standards.
Examples
Tier 2
Confidential Operational Data
Definition: Internal, non-public information whose disclosure would create business, competitive, or reputational harm, but which does not involve regulated personal data or protected class information.
Enterprise AI only. Requires SOC 2 audited platform, signed DPA, no-training contractual clause, and audit logging.
Examples
Tier 3
Regulated or Highly Sensitive Data
Definition: Data that carries direct legal, regulatory, or Fair Housing exposure, including any information tied to a person's protected class status or their private personal, financial, or medical information.
Never in any AI tool. No exceptions.
Examples
This Matters to Multifamily
A Tier 3 input into a Tier 1 tool is where the Heppner exposure lives. It is also where Fair Housing complaints, EEOC exposure, and state privacy law violations originate.
Your team will not remember every regulatory rule. They will remember a simple three-tier system that tells them whether they can use a tool.
How mPro Digital Edge Protects Your Data
Enterprise-grade protection at the contractual, technical, and operational layers.
Built in, not bolted on.
When you evaluate any AI vendor, ask them to walk you through the same three layers in the same level of detail. If they cannot, that is your answer. mPro Digital Edge is architected as a Tier 2 platform. Every layer of the protection stack is built in, not bolted on.
What mPro Digital Edge Does Not Do
Clear limits build trust. Here is what you will never see from mPro:
The Document Package We Provide
Compliance evidence that answers any auditor, insurance carrier, or opposing counsel question.
This is the document set any enterprise-grade AI vendor should hand you at contract signing. If your vendor cannot produce these documents on request, your protection is claimed, not provable. When you contract with mPro Digital Edge, you receive the full compliance package described below and other propritary documents.
Included with Every Engagement
Data Processing Agreement
Defines mPro as Processor and your organization as Controller. Specifies purpose limitation, sub-processor obligations, deletion rights, breach notification requirements, and audit rights.
SOC 2 Type II Reports
Available under NDA. Independent auditor confirmation of security, availability, and confidentiality controls, with current compliance status publicly verifiable. Type II is reissued annually.
Data Classification Policy
The three-tier model, adapted to your organization's operational categories and data types.
Service Availability Policy
Uptime commitments, planned maintenance windows, and service level definitions tied to your business needs.
Incident Response Documentation
Notification timelines, escalation procedures, and communication protocols in the event of a security incident.
Vet the Vendor Assessment
Our structured vendor evaluation tool, thirteen sections across two pages, used to evaluate every AI provider we route to. You may also use it to assess other vendors on your stack.
Sub-Processor List
Every third party that touches your data, updated when material changes occur. You have notification rights and change approval authority.
Fair Housing Compliance Documentation
Platform-level guardrails, prompt filtering logic, and audit logging that supports Fair Housing defense and regulatory confidence.
Available on Request
Additional compliance evidence you can request anytime:
What You Still Own
The responsibilities that remain yours, even with enterprise-grade protection.
Enterprise AI protection is a partnership, and it is a partnership with every AI vendor on your stack, not just one. Your responsibilities do not disappear because you signed a good contract with a strong vendor. This section is what most vendors will not tell you, and it is the difference between a protected operator and one who assumes they are protected.
Appendix: Vendor Assessment Checklist
Run every AI vendor you are considering, and every AI vendor already in your operation, against every question below. If a vendor cannot answer any single question in writing, in the executed contract, or in an independent audit report, they are not enterprise-grade.
Contractual Questions
Technical Questions
Operational Questions
Red Flags: Stop Evaluation If You See These
Closing Note: Your Next Thirty Days
The Heppner ruling is not the last word on AI and legal protection. It is the first. Expect more cases, more regulatory guidance, and more state-level privacy and AI laws over the next twenty-four months.
The operators who will handle the next several years cleanly are the ones who set up their data protection stack now. Not when a subpoena arrives. Not when a Fair Housing complaint lands. Now.
Your next step is immediate: take the Vet the Vendor checklist in this document and run it against every AI tool your team is currently using. Free tools. Paid tools. Borrowed tools from a regional manager's trial account. Write down what you find. That list is your compliance roadmap.
mPro Digital Edge exists to make that setup straightforward for multifamily operators. The compliance package described in this white paper is included with every client engagement.
Ready to close your exposure?
Download the full white paper for your compliance file, or reach out to talk through what enterprise-grade protection looks like at your portfolio.
Build fluency. Establish governance. Implement with confidence.
Download to your phone and share this important information
