Energy Growth JournalThe latest growth strategies in marketing and AI enablement for energy, solar and battery companies
Last updated Nov 13, 2026Written and edited by Ali PeivandizadehNo ads. No sponsors.
AI at Work · Action

Check if staff built AI apps that hold customer data

By Ali Peivandizadeh, business growth and AI implementation specialist.

Published Nov 13, 2026 · Last checked Nov 13, 2026 · Last changed Nov 13, 2026
The short answer

Find out this week which AI app builders your staff have used for work. Open every app they built in a private browser window, signed out. If an app with customer data opens, take it down the same day.

Verdict
ACT
For
All energy sellers. All sizes. Owner, operations, compliance.
Cost and time
No cost. About half a day.

Why

Security firm Claroc tested 37,571 live apps made with Grok Build. It reports that 35,578 of them opened with no sign-in. Claroc says the share setting was already on "Anyone with the link" when it published a test app. About 1 in 10 open apps held internal or personal data. One held a hospital staff list. Another held 18 passwords in plain text. Staff build these small tools to save time, such as a job tracker or a proposal list. A company with no list of them cannot know what is open.

What to do

  1. Ask every team which AI app builders they have used for work.
  2. Name the common ones when you ask: Grok, Lovable, Replit, v0, Bolt, Base44 and Google AI Studio.
  3. List every app, the data in it, and who owns it.
  4. Open each app in a private browser window, signed out. If it opens, anyone with the link can open it.
  5. Change each open app to invited users only, or unpublish it.
  6. If an open app held customer data, write down what was in it and how long it was open.
  7. Ask a lawyer whether customers or the state must be told.
  8. Add one line to your AI rule. No customer data goes into an app builder until the company has read its terms.

What data may go in

Until the company has read a builder's terms: public information only. No customer names, addresses, bills, meter data or passwords.

Who checks the output

The owner or the operations lead keeps the list of apps. In a larger seller, compliance decides what to do when customer data was open.

The rule to check

State privacy and breach notice laws apply when customer data is exposed. Meter data needs the customer's permission before anyone shares it. An electricity seller also answers to its regulator for how it protects customer information.

What can go wrong

The same problem has been reported at other app builders, so check all of them and not only one. A new app can be open next month. Put a monthly check on one person's calendar.

Sources

Plain text version