Fondetec’s Mission and the Data Privacy Challenge

My name is Antoine Fascio. I'm the executive director of Fondetec, which is a public law foundation based here in Geneva. We are financed by the town of Geneva. And what I would like, and Fondetec is financing small businesses in Geneva, small businesses is restaurants, shops, crafts and other services.

So, the question that I would like to talk to you today about is the question of data privacy and how you deal with data in a public sector environment because for us, I would say that there is no technological barrier to what we want to do, but the complication about about the laws and about how you you you you respect those those laws are are pretty intense so I think that the the problem that we have at for the tech

is that we're we have a tool it's called provisional point CH with which helps helps entrepreneurs creating business plans and financial forecasts and of course we ask them to go to the platform and to fill up those information and to give us all their information in order for us to study the project and to give them a decision if we are going going to invest or to finance them or not so that's require a lot of personal data ID tax which tax tax documents and and so forth and so on so so it's it's a

pretty important aspect of what we do because if we act there it's it's terrible for the for the people that are using the software and it's terrible for us as well so so we're we're building a lot of a lot of information and a lot of of systems around that to protect those those data now of course what we've seen in the last couple of years is

that the the business plans that are submitted to us have improved quite a bit uh and there's There's much less mistakes in those things and they are built and used with AI and the question for us is how are we going to integrate AI in what we do and how we are going to help people with AI with the framework that we have to work with at Fondatech.

A Risk-Based Framework for Using AI

So the first question that we have to ask ourselves is how we treat data, what type of data we have, what type of data we are going to share with with those models and not and that's really what we're going to use so the data flow is really I think the philosophy that we're using is that how the data is going to go across those different systems and what type of data is going to go across and depending on the data that we that we have we're going to decide if we can go in one way or the other so i think that's uh that's pretty important uh for us so uh i i i'm going to show you three uh three

three business cases that we we developed uh at for the tech uh that's our first attempt at putting putting AI into our platform Provisionnel .ch, the first one.

Low-Risk AI for Market Studies

So what we did is we started with something that is pretty low in data risks. So market studies and go -to -market agents. So basically we can take the information of our clients, they describe whatever they do, do and basically we, so that's the interface and now you see we are in market study.

So this entrepreneur just described the business here and basically on this side, sorry it's in French but it's still, it's going to come but here we start to ask questions with AI. so we know that we're safe we know that there is no confidential data in there so we know that we can go to frontier models with with that information without any risks so that's what we do of course we tell to tell people that

we're going to do that but now we have we have a dialogue with with our entrepreneur say well what you're saying is and we try to ask questions rather rather than giving solutions because the idea is really for the entrepreneurs to grow and to come up with their own solutions, not our solution. So that's the first case. We can very, very quickly go to frontier models without any risks.

Building Internal Tools Without Exposing Sensitive Data

Now if I come back to the second one, we have a lot of internal control systems that we have to put in place again we have to to to show that we are doing our work uh in the the best possible way uh it's it's money that's coming from the state of from from the town of geneva but we have to to demonstrate that we're we're handling that money correctly so we have a lot of of

internal control systems and it's a nightmare it's a nightmare for what because we never know which is the last version of the documents, which one is enforced, who should give access to that in the organization, who should be able to accept those modifications that we do on those systems.

So basically I took Claude and I started to say, well, that's what I need. And let's build a software to do that. So we built a software called, in this case I call that Norm Pilot.

and and basically it's well it yeah it created that in a couple of hours couple of days I was able to create that and I mean I I know a little bit about about computer science but I I didn't I mean it's vibe coding completely okay and I I have no credits to that, just the idea of what I wanted.

So basically I have all the different things that I have to do, the descriptions, and all of that is completely done with AI, but it's not operating with any AI in it, because it's sensitive data and we don't want to go to the outside.

So we built it with AI, but there is no AI in it, except for one thing, it's the new entry or import entry where I tested the idea of using a model, it's Mistral, on a server from Infomaniac. just to be able to take PDF, Word and Excel documents to translate it into markdown formats and it works very well actually actually but that's the only way it's the only place where we use AI in the entire system and that's

enforced now for four months and and our people are using it and I don't want to it they love it because who loves structured information but at least it's

Keeping Back-Office Data Outside AI Systems

it works and it does the job the last last one is our back office so again yeah our back office is pretty simple I wanted so so that's all the things that

we have internally the expenses from our staff. There is information from our staff here, so there is personal data that we don't want to share with anybody.

So here there is absolutely nothing that is using AI, except that I created all of those things using it, but there is no other data here so yeah the yeah well I think that's all I have to say about that ten

The AI Decision Checklist

minutes good so basically what we created is is a framework I have I printed a couple of of samples of of that checklist I'm a pilot so I love checklists but the idea is that with that checklist I have a score that's coming out of those questions and those those scores give me a decision say well I can go freely I must be a little bit careful and the last point is really well it's require a lot of precaution and in that field in that sector here here, we're not doing anything without our lawyer. We have a lawyer that's specialized in data protection that is going to look at it and decide what to do about it.

So basically, question is always, what result do I need? That's the first question. The following question here is, can I do it without AI? And I think that we should ask that question as well, because if we can we should it's safer it's easier to maintain there's a lot of advantage and in in terms of environmental concern it's a it's a

concern as well data do we have personal data sensitive of confidential if yes or no and what is what is this this level can we can we change the data can we can can we make it so that the system doesn't put that data with somebody directly? Who operates and who will reuse the data? That's crucial. Are they going to use the data to train their models or not? That's something that we have to ask.

The life cycle is another interesting aspect that we don't don't think about it for the for the the first thing that I show you in provision L about the about the the go -to -market strategy eight hours we keep the data eight hours and after that we just purge purge the data and I think that's that the lifecycle of the data is really interesting and really important to think about it what what's in where do you stay there for how long are you going to to keep it and finally responsible who check the output and who holds the decision as well uh and hopefully i i hope that sometime it's somebody else than me in in my organization but uh but i think it's it's really important to to ask that

question as well well basically i think that's what i wanted to tell you uh i i have two minutes left so what I did is that I have a copy of those document for a couple of copies of those document for who wants it and I asked Claude as well because it's my best friend to create a little checklist or a little guide that that's that basically resume what I was saying today so I have I have ten copies of both of those documents so maybe at the end if you if you want those copies there they They are free and if there are not enough of those copies then I will either print more or take your email address and send that to you. Thank you very much.

Questions on Data Retention and AI Conversations

This is the moment where you can take questions. I take questions. Questions guys?

I'd like to tell you.

You said you purged the data, so which data do you purge and how do you purge it and how do you know it purged? Well, that's a lot of good questions and I was hoping that you asked difficult questions.

Now basically what we do is that all the documentation, the information, the thread of the chat that we're doing with with our with our entrepreneurs we have that and we just delete it and the question of how we check that is an excellent question i and i don't have that answer yet but i will have it soon for our next lunch together when you say the chat with the entrepreneur is

the chat in which form like on a whatsapp or on a cloud or what have you done no here uh i was taking this example that that's in our platform so we we take that information from them and after that we chat with them about their business models uh for instance okay so so that information is

this back -end force uh with with the with our clients we we keep it we store it for for eight hours but no no it's not well this one is not closed but uh yeah in we we store it for to just just for them to have uh to have the the to keep the information for them but if they want they can copy it but they know that in eight hours it's gone we don't have access to it anymore you mean

like you as a person physically are chatting with them no the the the ai so they are entering their their business plan, or the market study that they're going to do. That's what they do. So, yeah. And then they get a personalized conversation with an AI agent. Yeah.

And the information that they add to the market study gets watched. Afterwards, you delete it from your system.

So maybe, again, the idea is that we don't want to do the job for them. What we want is to make them think about maybe some aspects of their business that they didn't think about. So basically, that's what they wrote. The system is going to ask the question and finally give a diagnostics or something like that.

And they use that to improve that part. But we're not generating any data for them. It's not a copy -paste Because that they can do on them on their self and then we don't do that for them

We really use use that to to to to help people Better understand their their products and and businesses does that answer your question? Well, that's Yeah, yeah

If you use an LLM, it will be stored on the LLM as well. So it's just in your organization, not the database of the LLM. Yeah, yeah, OK.

But again, those are not sensitive data. And our users accept at the beginning that if they use that, this is going to go to a frontier model. So that's what we do.

If we go to, we have another part of the business where we created some prompts and basically they copy. What we do is that we create an extract of that with our prompts and after that the user is copying all of that into their model. So again, they do whatever they want with their data and that's not our problem.

Yeah, I think you were asking for quite a long time.

Expanding Support for Entrepreneurs

Are you targeting businesses in Switzerland only, or Europe? Well, we're developing that for our community here in Geneva. But now it's used quite a bit outside of Geneva as well. So in Switzerland only? Yeah, mainly.

And the target is to finance these businesses? Well, originally that was the idea, yeah. So they get a short analysis from this.

So why don't you propose something that your finance is safer? So if I don't have a complete idea and I just ask a sort of, let's say, not complete question, why don't you propose something to me so I become better, so your investment is safer with me? Well, the idea, again, is that we don't want to give you the solution, because we... But you are, both of us are doomed to fail. No. You're improving by the fact that we ask, hopefully, good questions. If we ask good questions, then maybe you can think about your business and improve on your business.

The problem is that we, this tool we created for our needs, and now it's used by about the whole community in Geneva, in Vaud now, and elsewhere. we have about 15 ,000 users in the software and we financed that just to help our people, the 40 companies that we're going to finance per year, we did that for those 40 companies and now we have 15 ,000 people that are using it.

So you're, let's say, a shark tank with AI. Again, we're now importing, this tool exists for eight years and now we're starting to put AI in it, very very timidly, very very one step at the time to try to understand how it works.

And all this AI, does it take into account only the data protection, of the professional data protection or finance risk? No, here is just general context on the market study. That's it. They have no access to the rest of the. For this case, but for the other parts where you get the data. There is nothing else for now. That's really the beginning for us. Yes.

Data Security, Legal Oversight, and Responsible Adoption

Yes, I think you're touching on an even larger subject. Here you're talking about what you do at Phonetic, but even a larger subject is when you go in to use an AI agent and you put information in, you have a responsibility to be attentive to what you put in there.

Absolutely. Because even though it might give you options that you can delete what you've entered or delete the conversation, it must go somewhere. It must be stored somewhere.

And that's why I'm interested. There are quite a few IT professionals here in this room. What is the reality? I mean, there's a real risk you have to be attentive to. to what extent can you just comfortably use ai what what should you be attentive to well

i would let those guys answer the technical parts for for us for us it's it's really clear if we have personal data we're not going out period there is no there is no ai for now until we figure out a way to do it that's safe for now i don't know it's safe so so it's completely blocked Yeah, go ahead, guys.

the management of the GDP etc. in the European Union.

So for me, it seems to me to be more or less a poor problem. For you, not for me.

Yeah, well, I think that data and the way you handle data, and I answer in English because I think it's the common language here, It's very personal. For us, it's a huge problem. So we rather say no than say, well, let's try it.

And I give you an example, the protection of data that I must use, tell me, well, you have to be able to audit every single one of your suppliers. I'm a foundation of seven people, okay, based here in Geneva. The tool that we're using every day for email and Word and all of those things is Microsoft. So imagine when I'm going to Microsoft, say, guys, I'm going to audit your systems. It's a joke.

So I rather say, well, I'm not going there than saying, well, of course, Microsoft Azure has a server in Switzerland, but how can I prove that? I cannot.

Yes? I just want to say there are very easy and straightforward ways to make AI secure, to not have data escape, to have proper data residency. It sounds complicated, but it actually isn't.

there are a lot of people who are providing services, especially here in Switzerland for this to stay in Switzerland inference is done privately and your data is stored privately it's extremely easy to implement and it doesn't cost much more

I just want to say this it's this big problem everybody thinks it is, but it's not you can expose your data to AI in ways that is perfectly safe, including financial data data, legal data, medical data, or any data you can, you can take it on?

I agree with you. The problem that we have is that we cannot, and that, I think that you asked that question, is how do you, how do you, how are you sure that your data is safe? And that's why it's complicated.

Because if you do it on a Mac Mini somewhere in your office, no problem. And no problem yet, somebody can stole the Mac Mini.

Yes, yes, yes, yes, no, I agree, I agree, I agree. I'm not arguing with you. I'm just saying in my position, that's what for now we're confident in doing. Is it the best way? Is there other ways? Yes, absolutely, but that's what we decide to do for now Yes

So still on the data topic, we're moving away from the technical part side of it. You mentioned lawyers. Yeah What do your lawyers tell you about what you can and what you cannot or what you should or should not allow to go outside of your your environment in terms of data? Do they have anything more nuanced other than don't send anything anywhere?

That's the first step. That's always the first step. When you speak with a lawyer, say no, because they're paid to see risks, and if there is no risk, there is no lawyer.

So, of course, there is nothing, and after that, you have to argue, you have to dance, you have to show. go. And same thing with the responsible of the data position of the control of Geneva. We went with that checklist. We said, like, guys, that's what we want to do. Is it safe? Are you happy with that? Say, well, yes, we're happy with that. Say, okay, fine, let's do it.

And I think that you have to discuss, to argue with those guys, but they're doing their job our lawyers and we pay them for that but uh but you have to fight with them and so when you get to after you dance with them a little bit discuss a little bit kind of give it can you get a sense of where is the barrier of what they then say yeah it's okay to send that but not this you know is it okay to send the name is it okay to send a bank account is it okay to send the size of your shoes is it uh yeah where is the light so so for for everything that we do in the checklist

and we have a couple of checklists we're going to list all the all the data that we're going to send and we're going to go to each each one and single one of them say well this one is okay this one is not and and that's why i was speaking about data workflow because you have to decide which which which workflow you're going to use for what type of data. And after that, it's changed the scope of what you can and what you cannot do.

And I think that as we discuss with our lawyers, as we grow together, they're getting more used to it. It's more flexible. I don't want to say that they're more permissive than before, but at least they feel more confident at least.

Where AI Can Create the Greatest Impact

So you've shown kind of low risk to high risk activities, and so far, from what I understand, and you're allocating your, let's say, automations or AI to what you believe is possible or legally allowed. If you would look at it in a world where everything's safe and the lawyer dances for you, dream world, where do you think between those three pillars, those three different activities, would AI give you the most value once it would be implemented?

Yeah. Still on the first? Yeah. That's where I want to push it. Why?

Because there's 3 ,000 companies created in Geneva every year. Half of them will not exist after five years. Okay? So the attrition rate is incredible.

Altogether, all the people that are helping the entrepreneur community, we're probably helping about 300 companies a year, 10 % of the companies that are created. It's one to five, it's 50 % of the company dying in the first five years alone. With help, with help of us or others, we're about 10 % that are going to fail in those five force for the first five years okay so so the gap is huge the

problem is that we we have no we have no budget we are seven in our company it's about the same in all of those those guys so there is no way that we can help that many people it's the only way to do it on top of that where people need it it's an evening and in weekends is with a tool like that and that's why we need AI to to to to help them build a better a better business how would this be

different from the same person including all of this in the same information into a let's say a mo whatever it goes to the US and they say ask me the same questions would they get the same kind of level or are you getting some more context and memory to whatever agent in in my view and again it's my view and with my little very

little understanding of the world it's very difficult for an ai to ask questions and what we do again what we want the ai to do is to ask questions not give answers because again the business plans that we've seen since ai is is popular is way more better than what it used to be but that doesn't mean that it's make better businesses and our our really goal is to make better businesses and if you if you give answers to people you you're not helping them having better businesses that's a strong belief i may be wrong but uh i believe really one more question

Fondetec’s Selection Criteria and Local Mandate

yeah not so much about ar but you mentioned that you have a very short list of companies to go So, you know, startups, so how do you even start a selection of those same companies? I assume that a lot of approach you to use AI or any other tools to think, or it's like you have an internal process to experiment with AI at all?

Well, every single organization has their own policies, and we have our own policies, and if people fit to those policies, we're going to help them. For us, the first threshold is that we are financed by the town of Geneva. Our game plan, our game play area is the town of Geneva. You are in Carouge, we said, well, guys, sorry, we're going to do anything for you. So that's one of the first limitations. And every of those companies have those type of limitations.

Well, thank you very much. It's a pleasure. Thank you.