ChatGPT and Claude will both connect to almost any Model Context Protocol (MCP) server you point them at, and neither vendor verifies what’s on the other end. OpenAI’s documentation warns that a malicious server can exfiltrate anything that reaches the model’s context, and Anthropic’s custom connector documentation carries the same warning. Secure AI access comes down to governance, permissions, and audit.
This guide covers what secure data in AI means, the governance controls to have in place first, and how to give ChatGPT and Claude access to live systems through one governed endpoint.
What “secure data in AI” means in an enterprise context
Secure data in AI means protecting enterprise data everywhere an AI system touches it, including integrations, prompts, and context. The NIST Generative AI Profile (NIST AI 600-1) lists data privacy, information security, and intellectual property among its risk categories for generative AI.
Quick definition: secure data in AI
Protecting the enterprise data an AI system reads, processes, or returns so none of it is exposed or leaked, while each user’s existing permissions still apply at each prompt.
AI data security stops unauthorized access and misuse, whereas AI governance decides who’s authorized and how that’s audited. Securing Claude or ChatGPT access is mostly a governance problem, and encryption alone doesn’t solve it.
The Zero Trust model of NIST SP 800-207 grants access per session rather than by network position. Applied to AI, the model authorizes every query against the user’s own permissions and logs it, never through a shared service account. Our analysis of MCP security risks dives deeper into common governance gaps.
Before you connect: governance prerequisites and eligibility
Four controls carry most of this, and each belongs in place before any AI tool reaches production data.
Authorization: federated single sign-on (SSO) through OAuth or SAML, so every query resolves to a named person.
Permissions: source-system role-based access control (RBAC) that the AI path inherits rather than duplicates.
Encryption: data protected in transit on every hop, including the MCP endpoint.
Logging: a per-query audit record that exports to your security information and event management (SIEM) system.
Treat these as eligibility gates. An auditor can ask you to demonstrate any of them on the spot, and a pilot missing one usually stalls at security review rather than integration.
Prerequisite | Why it’s required | Standard or reference | How to verify |
Federated SSO via OAuth or SAML | Ties every AI query to a real user identity | RFC 6749, The OAuth 2.0 Authorization Framework | Run the same query as two users and confirm the results differ |
Source RBAC mapped, not duplicated | Keeps one permission model to audit | ISO/IEC 27001:2022 Annex A 5.15, access control | Change a role at the source, then rerun the query |
Encryption in transit | Protects data regardless of network location | NIST SP 800-207, Zero Trust Architecture | Confirm HTTPS on every hop to the source system |
Per-query logging with SIEM export | Produces the evidence an auditor asks for | ISO/IEC 27001:2022 Annex A 8.15, logging | Pull one query from the SIEM with user, statement, and timestamp |
Documented AI risk mapping | Justifies the control set to auditors | NIST AI 600-1, Generative AI Profile | Map each control to a named risk category |
Plan tier is itself a security control. Pro and Max users on Claude can add a custom connector themselves; on Team and Enterprise, only an Owner can add one, and members then connect individually. ChatGPT’s full custom MCP support sits behind developer mode, which admins enable only for Business, Enterprise, or Edu workspaces on the web.
Identity, OAuth/SAML, and SSO requirements
SSO lets someone sign in once with a work account and reach every connected application. Security Assertion Markup Language (SAML), the OASIS standard, then carries proof of that sign-in from the identity provider to an application. OAuth 2.0 grants that application scoped, time-limited permission to act on the person’s data.
OAuth 2.0 is an authorization protocol rather than an authentication one. The application never sees or handles the user’s password, and instead requests an access token from an authorization server. RFC 6749, The OAuth 2.0 Authorization Framework, defines that token as a string denoting a specific scope and lifetime.
Scope: the token carries only the permissions actually granted, not everything the user could do.
Lifetime: the token expires, so access has to be renewed rather than held indefinitely.
That combination closes the failure RFC 6749 was written against, where applications stored credentials directly and gained broad access nobody could narrow or time-limit.
Quick definition: OAuth/SAML passthrough
The AI tool hands the source system the end user’s own identity instead of a credential of its own. Salesforce or SAP sees the person who asked, applies the permissions it already holds for them, and returns only what that person could see by logging in directly.
When the user signs in, the authorization server issues a scoped token, and the query reaches the source carrying that identity, with no password stored and no standing access held anywhere in the chain. Claude’s custom connectors already work this way, and Anthropic confirms Claude itself never sees the password.
CData Connect AI applies the OAuth/SAML passthrough flow at the data layer. The user’s identity passes through, and the source enforces the permissions it already holds for that person, with no parallel role mapping and no shared service account behind every user.
Mapping existing RBAC and least-privilege controls
Least-privilege, in the zero-trust sense, authorizes access only for the duration of a task, with no standing broad privileges. The real choice is where RBAC gets enforced. Evaluating it at the live source leaves one permission model to audit, while rebuilding it inside the AI layer means maintaining two that gradually drift apart.
Approach | Where permissions live | Audit attribution | Governance verdict |
Shared service account | Broad standing access in the connector | User identity lost | Fails least-privilege |
Static API key per integration | Long-lived secret per connection | Connection level only | Fails credential hygiene |
Permissions rebuilt in the AI layer | A parallel model beside the source | Partial, and drifts | Doubles audit surface |
Identity passthrough via OAuth or SAML | The source system, unchanged | Full, per user and per query | Defensible |
Connect AI inherits the end user’s identity through OAuth or SSO, so finance roles see finance data and sales roles see CRM data, enforced dynamically rather than snapshotted at connection time.
Audit, logging, and compliance requirements (SOC 2, ISO 27001)
ISO/IEC 27001 is the international standard for an information security management system, now at its 2022 revision. Its Annex A controls cover the ground AI access touches, including 5.15 access control, 8.15 logging, and 8.16 monitoring activities.
Quick definition: audit trail (AI access)
A tamper-evident record of every AI query, showing who ran it, what they asked, which systems answered, what came back, and when. Export it and it becomes compliance evidence.
Auditors ask for per-query attribution and evidence that access enforced least privilege, neither of which a shared account can produce since every action resolves to one generic identity. CData is independently audited against SOC 2 Type II and ISO/IEC 27001:2022.
Step 1: Choose a governed data layer instead of direct connections
Point-to-point connections fail predictably. Every AI tool paired with every system means a separate credential to rotate, a separate permission model to reason about, and a separate log to chase during an incident.
OpenAI itself warns that developers must trust any remote MCP server they connect, since a malicious one can exfiltrate whatever reaches the model’s context. When individuals wire up their own connections, the audit trail often stops at the conversation log, invisible to IT. A single governed layer gives the architect one place to prove passthrough, RBAC, and audit.
Step 2: Connect enterprise systems through one managed MCP endpoint
MCP is an open protocol, created by Anthropic, that standardizes how AI applications connect to external data and tools. Both major platforms now consume it.
Quick definition: MCP endpoint
One HTTPS address that speaks the Model Context Protocol. Any compliant AI client can point at it, discover the tools and data it exposes, and call them without custom connector code.
A production endpoint must be a stable HTTPS address protected by the MCP specification’s authorization flow, which also requires hosts to obtain explicit user consent before invoking any tool. Connect AI provides one such URL covering hundreds of enterprise systems, so architects govern a single endpoint.
Step 3: Give ChatGPT secure access to your business data
Authorize your data sources in your managed MCP platform, add your MCP URL in ChatGPT, and start querying. No custom connector code is involved; what governs the result is whether that URL enforces per-user permissions at the source or holds standing access of its own.
Authorize sources and add your MCP URL in ChatGPT
An admin or owner enables developer mode under Workspace Settings, then adds the MCP app with the server URL. OpenAI doesn’t verify custom servers, so provenance is part of the review.
Enforce user permissions with OAuth/SAML passthrough
The app never holds a standing credential; each query runs as the individual who asked, and the source returns only what that person is already permitted to see.
Step 4: Give Claude secure access to your business data
On Team and Enterprise plans, an Owner adds the connector once in organization settings, and members then connect individually. Because each user authenticates separately, Claude reaches only what that individual already has access to. Claude connects from Anthropic’s cloud rather than the user’s device, and pre-fills authentication once you supply the HTTPS server URL, with per-user OAuth sign-in as the default.
Connect Claude chat, Claude Desktop, Claude Code, and the Anthropic Agent SDK
MCP support spans Claude chat, Claude Desktop, Claude Code, and the Messages API’s MCP connector, and a connector approved for chat can extend to other surfaces the same user works in, making a write-capable OAuth grant a cross-harness permission, not a per-app one.
Use the Anthropic-certified connector for governed access
Anthropic screens submitted MCP servers, with most listed as community connectors and some selected for a closer verified review, and it selected CData Connect AI as the endpoint that enforces source RBAC underneath Claude’s per-user connect model.
Step 5: Enforce RBAC, workspace isolation, and scoped tool exposure
Two boundaries do this work.
Workspace isolation scopes which systems an agent can reach, so a finance agent sees finance data and a sales agent sees CRM data.
Scoped tool exposure limits which MCP tools a client can see and call, narrowing the other axis.
NIST SP 800-207, the zero-trust standard, is explicit that least privilege restricts visibility as well as access, and a tool an agent can enumerate is one it can attempt to call.
The protocol assumes this happens above it, stating that tools represent arbitrary code execution and must be treated with caution. In Connect AI, Workspaces define the data boundary and Toolkits the action boundary, and each combination deploys as a dedicated MCP server. Our best practices for secure AI agent governance cover the full control set.
Step 6: Set up audit trails and SIEM integration
A complete AI audit trail captures five fields for every query, covering user identity, query text, systems accessed, data returned, and timestamp. Anything less and attribution breaks under questioning. ISO/IEC 27001 Annex A treats logging (8.15) and monitoring (8.16) as distinct controls, so exported AI-access logs double as certification evidence.
Log field | Compliance purpose | SIEM use case |
User identity | Attribution for SOC 2 and ISO 27001 | Incident response scoping |
Query text | Evidence of what was requested | Detecting out-of-pattern agent behavior |
Systems accessed | Proof that scope boundaries held | Cross-domain access alerting |
Data returned | Data minimization evidence | Exfiltration volume monitoring |
Timestamp | Reconstructing the incident timeline | Correlation across identity and network logs |
Connect AI logs every query with full attribution and exports to your SIEM. For the wider control set IT owns, see our guide to AI agent data governance.
Practical tips and troubleshooting for stalled AI pilots
A funded ChatGPT Enterprise or Claude deployment sits idle when Security won’t approve direct system access. The objection is usually over credential exposure and audit gaps rather than the AI tool itself. Both are properties of the data path, and both are fixable without renegotiating the AI license.
Symptom | Likely cause | Fix |
Connector fails at the Connect button | Missing OAuth metadata or a callback URL mismatch | Correct the protected-resource metadata and registered redirect URI |
Claude can’t reach the server at all | Server sits behind a VPN or firewall | Expose a public HTTPS endpoint, or allowlist Anthropic’s IP ranges |
Tools appear but every query returns empty | The authenticated user lacks source permissions | Verify entitlements at the source, not in the AI layer |
Developer mode option is missing in ChatGPT | Workspace admin hasn’t enabled it | Enable under Workspace Settings, Permissions and Roles |
Token works once, then fails | No refresh handling, or audience validation rejecting it | Add refresh handling and bind tokens to the resource they were issued for |
Two habits prevent most of this.
Never put a credential in the connector URL, since a URL carrying a token leaks through server logs, proxy logs, browser history, and screenshots.
Check authentication first when a connector breaks, since most failures land in the OAuth handshake before a tool is ever called.
Frequently asked questions
What do I need to set up before giving ChatGPT or Claude access to enterprise data?
Federated SSO through OAuth or SAML, source RBAC the AI path can inherit, encryption in transit, and per-query logging with SIEM export. Full custom MCP support in ChatGPT and Claude is also admin-enabled.
How do I make sure ChatGPT or Claude can only see the data each user is already allowed to access?
Use identity passthrough. The end user’s own identity reaches the source at query time, and the source enforces its existing row-level, field-level, and role-based controls. The AI tool holds no entitlements to exceed.
What are the biggest security mistakes organizations make when connecting AI to enterprise systems?
Treating AI data access like ordinary application integration. The frequent failures are one shared service account behind every user, long-lived static API keys, permissions rebuilt in the AI layer, and connecting an unreviewed MCP server.
How do I create audit trails and access logs for AI queries against enterprise data?
Log user identity, query text, systems accessed, data returned, and timestamp per query, protect the logs against tampering, and export them to your SIEM. That maps to ISO/IEC 27001 Annex A 8.15 logging and 8.16 monitoring activities.
What tools or infrastructure do I need to securely connect AI assistants to systems like Salesforce or SAP?
A managed MCP endpoint that authenticates each user against the source, enforces RBAC at query time, scopes the systems and tools each agent reaches, and logs every query. Connect AI covers hundreds of enterprise systems.
How do I get my security team to approve AI access to company data?
Bring an architecture rather than a demo. Show that queries inherit each user’s permissions, that no shared service account exists, that scope is defined per agent, and that every query logs with attribution.
What happens to my enterprise data after ChatGPT or Claude queries it, is it stored or used for training?
On business tiers, no, by default. OpenAI doesn’t use business data from ChatGPT Business, Enterprise, or Edu to train its models by default, and Anthropic states the same for commercial products. Consumer plans differ, so workspace type is the control that matters.
Say a governed “yes” to AI data access with CData Connect AI
A governed yes means every AI query inherits the user’s existing permissions at query time, with no shared service account and no parallel permission model to maintain.
CData Connect AI enforces that through identity passthrough, Workspaces, and Toolkits, backed by SOC 2 Type II and ISO/IEC 27001:2022 audits, with one Anthropic-certified MCP endpoint serving both Claude and ChatGPT without custom connector code.
Start a free trial to put that endpoint against your own zero trust and ISO 27001 requirements.
Your enterprise data, finally AI-ready!
Connect AI gives your AI assistants and agents live, governed access to hundreds of enterprise systems — so they can reason over your actual business data, not just what they were trained on.
