Do not paste Singapore Government information into a public chatbot until you have classified it and confirmed that the service is authorised for that classification. Singapore’s policy is risk-calibrated: highly sensitive applications and data are kept off the Internet, while lower-risk use of commercial services is allowed only with contractual, hosting, access, upload and testing safeguards. The Generative AI System Security Plan (SSP), last updated 24 March 2026, sets the practical controls.
The decision is not simply “Is this chatbot secure?” It is whether this specific data, in this specific deployment, with this provider’s retention and processing terms, may be used at all.
As an Amazon Associate I earn from qualifying purchases.
Start with the data classification, not the chatbot
Every internal AI application should state the highest classification of information that users may enter. The user and the data owner must verify the classification before a prompt, attachment or retrieved record is sent to a model. Treat the highest-classified item in a conversation, file set or connected data source as the classification that governs the whole interaction.
A label such as “internal” or “for official use” is not a substitute for the organisation’s approved Singapore Government classification scheme. If the owner cannot establish the classification, stop and obtain a decision from the information owner or security function. Do not use an unapproved chatbot as a temporary place to work out whether information is sensitive.
#1 Best Overall
What the 2026 hosting thresholds mean
| AI service location | Maximum stated data classification | Conditions |
|---|---|---|
| Overseas-hosted GenAI API | RESTRICTED and SENSITIVE NORMAL | Use only where the service and use case are authorised; verify the provider’s processing, retention and cross-border terms. |
| Singapore-hosted GenAI API | CONFIDENTIAL and SENSITIVE HIGH | Use an authorised environment and check for cross-region inferencing or any overseas processing before approval. |
| Self-hosted model | The highest classification the authorised environment can hold | Run the model only in an environment authorised for every classification it processes. |
| Highly sensitive applications and data | Not exposed to the Internet | Use a suitably protected government environment; models may be fine-tuned and deployed on Government servers where necessary. |
“Singapore-hosted” does not automatically mean that every operation remains in Singapore. A service can store data locally while routing prompts, model inference, support access, telemetry or backups across regions. Approval therefore requires a documented check of the complete processing path, not just the address of the primary data centre.
Use the least risky architecture that meets the need
Keep highly sensitive workloads off the public Internet
The Minister for Communications and Information stated on 9 January 2024 that “Highly sensitive applications and data are not exposed to the Internet.” For a workload in that category, a public web chatbot or Internet-reachable API is the wrong architecture even if the provider advertises encryption or an enterprise plan. Build or use an isolated, authorised environment instead. Where a specialised model is required, the Government’s stated approach allows fine-tuning and deployment on Government servers.
Choose an authorised commercial API for lower classifications
Commercial providers can be considered for information within the overseas or Singapore-hosted thresholds, but approval depends on more than a provider’s marketing page. Security, procurement, legal and data-owner teams should record the permitted classification, service location, model and endpoint, identity controls, retention settings, support access, audit evidence and exit procedure.
Self-host only in an environment that matches the data
A model running on a Government network is not automatically authorised for every classification. The computing environment, storage, logs, backups, monitoring, administrator access and connected systems must all be authorised for the highest classification processed. A lower-classification model server cannot become suitable for Confidential information merely because the model weights are installed locally.
Get a binding provider commitment on retention and training
A statement such as “we do not train on your data” is insufficient by itself. The Generative AI SSP calls for a legally binding commitment that input and output data are not logged, stored or retained and are not used to train models. The commitment must cover every endpoint, parameter, output and model in the approved service, including features that may be enabled later by configuration or API version changes.
Contract terms to verify
- Input handling: Prompts, system instructions, uploaded files, retrieved context and metadata are not retained beyond the approved period.
- Output handling: Generated text, code, images, embeddings and safety-review records are covered, not just the original prompt.
- Training and improvement: Neither customer content nor derived content is used to train, fine-tune or evaluate a provider model unless a separately approved arrangement explicitly permits it.
- Endpoint and parameter scope: The commitment applies to chat, completion, embedding, moderation, file, fine-tuning, evaluation and administrative endpoints, and to every parameter that can change storage or sharing.
- Subprocessors and support: The provider identifies organisations and personnel that may access content, the locations involved and the controls governing emergency or troubleshooting access.
- Change control: New models, regions, features or terms trigger a security review before they are enabled for government data.
- Deletion and evidence: The organisation can request deletion where applicable and can obtain records showing that retention and training controls are active.
Prompt caching is a narrow exception
Prompt caching is allowed only when the time-to-live is 24 hours or less. Configure the shortest useful TTL, document it, and verify that cached prompts are covered by the same access and deletion controls as ordinary requests. A cache that persists longer, is shared across tenants or is used for provider training does not meet this requirement.
Control identity, access and auditability
Users should reach an approved chatbot through the organisation’s managed identity and access layer rather than personal accounts. Apply least privilege to the application, model, file store and connected tools. A staff member who may read a case file should not automatically be able to send that file to an AI service, and a model that can summarise records should not automatically be able to export them.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Minimum access controls
- Use single sign-on with multifactor authentication and disable anonymous or shared accounts.
- Assign roles for users, approvers, administrators, auditors and service accounts separately.
- Restrict model and endpoint selection to the versions reviewed for the approved classification.
- Apply network egress controls so the application can call only approved services and regions.
- Log user, time, application, model, endpoint, classification decision, policy result and administrative changes without storing sensitive prompt content in a lower-classification log system.
- Review access and logs periodically, and investigate unusual volume, repeated failed policy checks or attempts to bypass upload controls.
Audit logs themselves can contain sensitive information. Classify and protect them according to their contents; do not solve chatbot logging risk by creating an unprotected “security” log that reproduces every prompt.
Rank #3
Prevent leakage through prompts and file uploads
Attachments create a larger risk than a single text prompt because one upload can contain thousands of records, hidden metadata, prior redactions, comments or embedded objects. The SSP requires DLP monitoring, controls on bulk uploads, per-file classification confirmation and a user review of unusually large files when uploads are enabled.
A safe upload workflow
- Identify the source: Confirm the file owner, purpose, classification and whether it contains personal, operational, privileged or third-party information.
- Minimise: Remove fields, pages, images and historical versions that are not needed for the task. Prefer a short extract or a synthetic example over a complete case file.
- Scan: Run the organisation’s DLP inspection for identifiers, credentials, secrets, personal data, classification markings and embedded files.
- Confirm per file: Require the user to acknowledge the classification and destination for each attachment, not once for an entire session.
- Apply volume limits: Block or queue bulk uploads for review. Set thresholds for file count, total size, pages, rows and token volume appropriate to the application.
- Review anomalies: Prompt the user to inspect unusually large files, sudden batch activity or a mismatch between the declared task and the file contents.
- Send only what is approved: The gateway should block, redact or quarantine content that exceeds the application’s stated maximum classification.
- Delete temporary copies: Remove staging files, extracted text and OCR output under the approved retention schedule.
Prompt minimisation examples
Instead of sending a full personnel case, ask an approved internal system to calculate an aggregate count and send only the count. Instead of uploading a contract with names, account numbers and signatures, replace them with stable labels and retain the original in the authorised records system. Do not assume that deleting a sentence from the visible prompt removes it from browser history, application telemetry, clipboard managers or provider-side diagnostics.
Evaluate the model and its answers before relying on them
Security approval does not make an answer accurate. The SSP requires defined tests and metrics for accuracy, safety and quality, repeated after a model, prompt, dependency or connected-data update. Keep a human accountable for every consequential use.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesBuild an evaluation set
- Use representative, approved examples covering ordinary, edge and adversarial cases.
- Include tests for refusal of unauthorised requests, preservation of classification markings, redaction, citation or source fidelity, and resistance to prompt injection.
- Measure factual accuracy, completeness, harmful or discriminatory output, data leakage, latency, failure rate and escalation behaviour.
- Record the model version, system prompt, retrieval sources, safety settings and test date so results are reproducible.
- Set acceptance thresholds and define what happens when a test fails: block release, limit the classification, require human review or roll back.
Make the human responsibility visible
Users must explicitly acknowledge that chatbot outputs may be inaccurate or fabricated. The interface should display that warning at the point of use, not hide it in a policy document. Require source checking and human approval before an output is used in a decision, sent externally, entered into an official record or used to trigger an action.
For high-impact work, retain the input sources, reviewer identity, material edits and final decision in the authorised record system. The chatbot’s answer is assistance, not an official determination.
Give agentic AI a separate threat assessment
An ordinary generative chatbot returns content when asked. An agentic system can call tools, retrieve records, send messages, execute code or change systems on its own behalf. Those capabilities create additional paths for prompt injection, privilege escalation, data aggregation and unintended actions. The CSA’s “Securing Agentic AI” addendum, dated 17 June 2026, calls for a fresh assessment rather than treating an agent as an ordinary chatbot.
Controls for an agent that can act
- Define an explicit allow-list of tools, data sources, destinations and actions.
- Give the agent a separate identity with the minimum permissions needed for one task.
- Require human approval for external communications, record changes, financial actions, access grants and irreversible operations.
- Isolate tools and data by classification; prevent an agent from combining sources into a higher-sensitivity dataset without approval.
- Validate tool arguments and output formats instead of executing model-generated commands directly.
- Set time, rate, budget and recursion limits, with an immediate stop control.
- Log tool calls, retrieved records, approvals, rejected actions and the final outcome in a protected audit store.
- Test indirect prompt injection in documents, web pages, email and database fields before deployment.
If the agent can autonomously access information above the chatbot interface’s stated classification, the application’s maximum classification is effectively that higher level. Reassess the hosting environment and every connected component.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Decide whether an overseas API is permissible
Singapore Government policy does not impose one blanket answer for every overseas service. The 2026 SSP permits overseas-hosted GenAI APIs only up to RESTRICTED and SENSITIVE NORMAL. That permission still requires an authorised use case and the provider commitments, access controls, upload safeguards and evaluation described above.
Best Value
For CONFIDENTIAL or SENSITIVE HIGH data, use a Singapore-hosted API only through an authorised environment and after confirming that inferencing, support, backups and subprocessors do not move processing overseas. If that cannot be demonstrated, do not send the data. Highly sensitive data remains outside Internet-exposed deployments.
Questions for a service review
- What is the exact maximum classification approved for this application?
- Where are prompts, files, outputs, caches, backups and telemetry processed and stored?
- Can any request be routed to another region for inferencing, failover, abuse detection or support?
- Are retention and training exclusions legally binding and scoped to every endpoint, parameter, output and model?
- Is prompt caching disabled or limited to a TTL of 24 hours or less?
- Can the organisation enforce identity, DLP, file-size, bulk-upload and egress policies before data leaves its boundary?
- What audit evidence is available, and can the service be suspended or deleted quickly?
- Has the current model, prompt, retrieval layer and dependency set passed the required accuracy and safety tests?
- Does the system have tools or autonomous actions that require the agentic-AI assessment?
Common failure modes and the corrective action
| Failure | Why it is unsafe | Correction |
|---|---|---|
| A user pastes a document before checking its label | The tool may be unauthorised for the document’s classification, and the disclosure cannot be recalled. | Make classification confirmation a precondition to sending; route uncertainty to the data owner. |
| The provider promises “no training” on a web page | Marketing language may not cover logs, outputs, support tools, endpoints or future models. | Obtain a binding, scoped non-retention and non-training commitment. |
| A Singapore data-centre location is treated as proof of local processing | Inference, backups or support may still occur across regions. | Obtain and review the full processing path and cross-region controls. |
| Users upload entire folders for convenience | Bulk files increase aggregation, hidden-data and accidental-disclosure risk. | Minimise, scan, limit volume, require per-file confirmation and review anomalies. |
| Chatbot output is copied into an official decision | The model can hallucinate or omit critical facts. | Display the warning, require source checking and assign a named human approver. |
| An agent receives broad permissions because it is “internal” | Prompt injection or a model error can turn one request into unauthorised actions. | Use least-privilege tools, approval gates, allow-lists, limits and an agentic threat assessment. |
| Logs capture prompts in a lower-classification system | Monitoring can create a second disclosure channel. | Classify logs by content and protect, minimise or redact them. |
A practical approval checklist
Before enabling a chatbot for government work, the service owner should be able to answer “yes” to every applicable item:
- The application states its highest permitted input classification.
- The data owner has verified the classification and business purpose.
- The hosting location and all cross-region processing paths are documented.
- The deployment fits the threshold: overseas only up to RESTRICTED and SENSITIVE NORMAL; Singapore-hosted up to CONFIDENTIAL and SENSITIVE HIGH only in an authorised environment.
- The provider has a binding commitment covering non-logging, non-storage, non-retention and non-training for every endpoint, parameter, output and model.
- Any prompt cache has a TTL of no more than 24 hours.
- Identity, multifactor authentication, least privilege, network restrictions and audit logging are active.
- DLP, bulk-upload controls, per-file classification confirmation and large-file review are implemented.
- Accuracy, safety and quality tests have acceptance thresholds and are rerun after changes.
- The user interface requires acknowledgement of hallucination risk and identifies the human accountable for the result.
- Any tool-using or autonomous capability has passed a separate agentic-AI threat assessment.
- There is a tested suspension, deletion, incident-response and provider-exit procedure.
What Singapore’s guidance means for staff and managers
For staff, the safest habit is simple: classify first, minimise the material, use only the approved application and stop when the service or destination is unclear. Never use a personal account or an unapproved public chatbot for official data, and never treat a convenient browser plug-in as part of the approved boundary.
Free tools Windows power users keep installed
One-click scans. No signup required.
For managers, approval is a continuing control, not a one-time procurement decision. Model updates, new connectors, changed retention terms, a new hosting region or a move from answering questions to taking actions can change the risk. Re-run the relevant tests and threat assessment whenever those conditions change.
The Institute of Digital Government’s 12 June 2026 guidance states that not all AI tools have the same security controls. The practical consequence is that a tool approved for one classification, team or task is not automatically approved for another. Record the decision in terms users can follow: which data may be entered, through which application, under which account, with what upload and review limits.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
