PerplexityA business developer, new in the role, wants to read up on a prospect before a call. Instead of running an ordinary search, she opens Perplexity and types in the whole picture: the company name, the contact's name, what she has heard about their contract dispute and the size of the deal she hopes to land. Perplexity gives her a crisp, well-sourced briefing.
It felt exactly like Googling. That is the problem. She has just put a named individual, commercial-in-confidence details and her own internal strategy into an AI service that, on her free account, may use her queries to train its models and keeps her history until she deletes it.
Nobody told her she was doing anything different from a web search. The interface certainly did not. And that gap, between how Perplexity feels and what it actually is, is where its privacy risk lives.
Is Perplexity safe for business data?
For general research it is a useful tool. As a home for confidential context, the consumer version is not what it seems. Perplexity is an "answer engine": it searches the web and writes a response. Unlike a search engine, though, it takes your whole query in as input to an AI system. On the Free and Pro tiers those queries can be used to train its models by default, and your history stays until you remove it.
There is a genuinely different tier. Perplexity Enterprise offers no training on customer data, zero data retention, SOC 2 and a data processing agreement (DPA). Most employees are not on it, though. They use a personal account, where the feel of a search box quietly invites them to paste in things they would never put in an email.
The risk is not that Perplexity is uniquely careless. It is that it feels private, and the consumer terms are not.
How Perplexity handles your data
| Free / Pro (consumer) | Enterprise | |
|---|---|---|
| Used to train models | Yes, by default | No (by contract) |
| Data retention | Until you delete it | Zero data retention available |
| Data processing agreement | No | Yes |
| Processing location | US infrastructure | US, with EU options to confirm |
| Admin controls | None | SSO, history controls, ZDR |
Free and Pro accounts are consumer products. Queries may be used to improve models unless you turn off the AI data retention setting, and that opt-out only affects future data. Uploaded files are kept for a while; history stays until you delete it. No processor agreement stands behind any of it.
Perplexity Enterprise / API is the business product: no training by contract, zero data retention, SOC 2, SSO and a DPA that incorporates Standard Contractual Clauses. Processing is US-based by default; check EU residency for Enterprise with Perplexity. The difference between the two tiers is not cosmetic. It decides whether you have a lawful basis to process client data at all.
Where it goes wrong with Perplexity
1. The search-box illusion
This is the headline risk. People paste named, confidential context into Perplexity precisely because it feels like a search engine. Someone who would carefully redact an email types a prospect's whole situation into the answer box without a second thought.
2. Training on consumer queries by default
On Free and Pro, your queries can feed model training unless you have changed the setting. Most users never open that setting, so the default quietly decides.
3. "Incognito" that isn't private from the vendor
Incognito keeps a chat out of your library and expires it, but it does not hide the query from Perplexity or stop processing on the vendor's side. Employees who use it for sensitive questions because they think it is private are mistaken.
4. Agentic browsing risk (Comet)
Perplexity's Comet browser opened up a new risk: security researchers showed that hidden instructions on a web page could hijack it (indirect prompt injection), so that it might act in accounts the user is logged into. An agent that browses on your behalf offers a larger attack surface than a chatbot.
5. The crawler trust question
In 2025 Cloudflare reported that Perplexity used stealth crawlers to get round sites' no-crawl rules; Perplexity disputed the attribution. For a business the point is reputational: when a tool's data-collection practices are publicly contested, define its scope carefully.
Each of these is made worse because nothing about Perplexity tells you "this is an AI service, not a search bar".
What you risk per search
Under the GDPR, pasting an identifiable person's data (a prospect's name tied to commercial details, a client's situation, an employee's record) into a consumer AI account with no processor agreement means the employer is processing it without a lawful basis. If the data is sensitive and ends up retained or used for training, that is a reportable exposure.
Fines can reach €20 million or 4 per cent of global annual turnover, whichever is higher, and the liability lies with the organisation as controller. The quieter cost is competitive: pasting your own deal strategy and a prospect's confidential details into a tool that keeps queries is as much a commercial risk as a compliance one.
Industry surveys consistently find that a large share of employees put confidential information into AI tools, often through personal accounts outside any company control. Because Perplexity presents itself as search, it is one of the easiest places for that to happen without anyone noticing.
What put Perplexity in the headlines
June 2025: BBC legal threat over scraping
The BBC sent Perplexity a legal threat, reportedly its first against an AI company, alleging that its model had been trained on BBC content and reproduced it, sometimes inaccurately. Perplexity rejected the characterisation. Source: Deadline, June 2025.
August 2025: Cloudflare reports stealth crawling
Cloudflare published research alleging that Perplexity used undeclared crawlers with rotating identities to reach content on sites that had blocked it. It showed this with secret test domains and removed Perplexity from its list of verified bots. Perplexity disputed the findings and blamed the traffic on a third-party service. Source: Cloudflare, August 2025.
August 2025: Comet prompt injection
Brave's security team disclosed that hidden instructions in web pages could manipulate Perplexity's Comet browser. When a user asked it to summarise a page, it carried those instructions out as commands, which opened a route into the user's logged-in accounts. Source: Brave, August 2025.
March 2026: Amazon wins injunction against Comet
A US court granted Amazon a preliminary injunction against Perplexity's Comet shopping agent, finding strong evidence that it had accessed Amazon accounts while disguising itself as a human using a browser. Source: CNBC, March 2026.
The common thread is not a single breach but a pattern: a tool that moves fast across boundaries, whether those of publishers and browsers or users' own sense of what is private.
The Perplexity settings worth changing
1. Turn off AI data retention (consumer) In Settings, switch off "AI data retention" so your queries are no longer used to train models. This only affects future data and can be reset when your account changes, so check it again.
2. Use Enterprise for any business use If Perplexity earns its place at work, move to Perplexity Enterprise, which offers no training, zero data retention, SSO and a data processing agreement. Client data does not belong in personal accounts.
3. Don't rely on incognito for confidentiality Use incognito to keep a chat out of your history, but never as a way to keep a query private from the vendor.
4. Be cautious with Comet and agentic features Treat AI browsers that act in your logged-in sessions as high-risk, and keep them away from sensitive accounts until their defences against prompt injection are proven.
5. Set a policy on personal accounts The most effective measure is organisational: make clear that confidential context stays out of personal Perplexity accounts, and offer an approved alternative.
Checked against Perplexity's documentation as of early 2026. The interface and setting names change often, so confirm them in the live product.
What the settings leave open
A data retention toggle changes what Perplexity does with your queries. It does not change the instinct that makes someone treat an answer engine like a private notebook.
No setting un-pastes the prospect's name and deal size once they have been typed into a free account. No incognito mode brings back a confidential question once it has been processed. The core risk, someone pasting identifiable, sensitive context because the interface feels like search, happens in a human moment that no settings screen can reach.
That is the gap between what Perplexity is and what it feels like.
Before you search: what is in your question?
As you type, BeeSensible checks browser text fields for personal data, including Perplexity's question box. The text goes to BeeSensible's detection service in the EU, where it is analysed in memory and discarded once detection is done. None of it is stored. When a query contains sensitive details, BeeSensible highlights them in the text, so the user sees exactly what they are about to share and can mask them with a placeholder, or remove them, before sending.
