Where did that AI tool come from? Third-party connectors and data brokers

The question underneath the question

Somebody on your team found a tool. It summarizes call transcripts, drafts proposals, or cleans up a messy spreadsheet in seconds. It costs nine dollars a month, no contract, sign up with an email address. Nobody in IT approved it, because nobody in IT knows it exists yet.

That is the same gap we described in our piece on shadow AI. This one goes a layer deeper. Before that tool touches another piece of company data, there is a question worth asking that has nothing to do with whether it works. It works. Most of them do.

The real question is where it came from, and where your data goes after you hit send.

A tool that connects to your data is not the same thing as a tool built by the company whose name is on it. A lot of AI products in the wild right now are wrappers. A chat window bolted onto someone else’s model, resold under a new logo. That is not automatically a problem. Plenty of legitimate businesses are built this way.

The problem shows up when the wrapper is the whole business model. If a product costs a fraction of what the underlying technology should cost, something is paying the difference. Sometimes it is venture capital, burning cash to grow fast. Sometimes it is your data, packaged and sold to whoever wants a look at what small businesses paste into chat boxes. This is not a hypothetical risk. The Federal Trade Commission has documented for years how the data broker industry operates with little transparency about what it collects or who it sells to.

You cannot always tell which one you are looking at from the landing page. That is the whole issue.

Two ways a tool actually connects to your data

There are two real paths for getting your business data in front of an AI model, and they behave very differently.

The first is an official connector. It is built either by the AI provider or by the software vendor you already pay for. In the current generation of tools, this usually runs through MCP, short for Model Context Protocol. Anthropic introduced this open standard in late 2024. It lets an AI assistant talk directly to a specific system, like your ticketing platform, your accounting software, or your CRM. You turn it on inside a settings panel, and it runs under the business agreement you already have with that vendor.

The second is a third-party aggregator. This is a site or browser extension that is not the original vendor of anything. It promises to connect your tools to AI in one place. Some of these are useful. Many exist specifically to collect the data that flows through them.

The practical difference is accountability. An official connector has a company behind it. That company answers to the vendor’s own customers, its own legal team, and its own reputation. An aggregator site frequently has none of that. It can disappear or change its terms overnight, and nobody notices until something has already gone wrong.

Official connectors vs. mystery aggregators

Official connector (MCP or vendor-built)	Mystery aggregator site
Built by the vendor whose name is on it, or by the AI provider directly	Built by an unrelated third party wrapping someone else’s model
Runs on your existing business or enterprise agreement with that vendor	Usually a separate signup, often with its own account and its own terms
Governed by the vendor’s published data handling terms	Terms are often vague, missing, or written to permit resale
Turned on by an admin, inside a settings panel you can find again	Turned on by whoever downloaded it, usually with no record anywhere
A named company with a support line and a reputation to protect	A storefront that can change hands, go dark, or get acquired with no notice

Neither column is automatically safe or automatically dangerous. A well-known aggregator with a clear privacy policy can be a fine choice. Think of the table as a starting point for asking better questions, not a verdict.

What it takes to build your own connector

Most business owners assume they are stuck if a tool lacks a ready-made connector. They usually are not. Almost every modern business platform has an API, and that API can be turned into a working connector by someone who knows how, without waiting for the vendor to build one.

Our own team has done this for internal tools: our ticketing system, our security stack, our remote monitoring platform. None of them shipped with an off-the-shelf AI connector when we needed one. We built our own, connected to accounts we already control, on terms we already agreed to.

Your data never has to leave a system you have already vetted and already trust. You are not introducing a new vendor into the mix at all.

The tradeoff is that it takes someone who can do the setup, and someone accountable for keeping it working after the vendor updates their API. For most small businesses, that means asking an IT provider to handle it once. It is typically a short job, not an ongoing project.

A short list before you connect anything new

Before a new AI tool touches company data, run it past four checks.

• Look for a real company name behind the tool, not just a product name, and check whether that company has a track record.
• Read the privacy policy for where the data goes. A clear one says so in plain language. A vague one dodges the question.
• Check whether a platform you already use has an official connector first. That is almost always the safer path.
• Picture telling your IT provider you are using this. If that would feel uncomfortable, treat the discomfort as your answer.

That last one does the most work. It is the same test from our AI account tiers guide. If you would rather not mention it, that is worth paying attention to.

Find out what you already have before you look for something new

Most systems a small business already pays for, ticketing, accounting, CRM, remote monitoring, security tools, now ship with an official AI connector. The ones that do not can usually have one built without much trouble. The fastest way to cut down on mystery tools is to check what you already have first, before anyone goes looking for a nine dollar aggregator to fill the gap.

Give your IT provider one task: find out which systems you already pay for have an official connector, and which ones would need one built. That is usually a short conversation, not a project. It also closes off the reason most people go looking for an unapproved workaround in the first place.

Key takeaways

• A tool that connects to your data is not the same as a tool built by the company on the label. Many AI products are wrappers around someone else’s model.
• Official connectors run on the business agreement you already have. Mystery aggregators often run on terms nobody read.
• If a system you already pay for lacks a built-in connector, a custom one can usually be built from its existing API, keeping your data inside tools you already trust.
• Before connecting anything new, check who owns it, where the data goes, whether it duplicates something you already have, and whether you would tell your IT provider about it without hesitation.