Credit Union IndexThe latest growth strategies in marketing and AI enablement for credit unions
Last updated Nov 13, 2026Written and edited by Credit Union IndexNo ads. No sponsors.
AI at Work · Action

Check if staff built AI apps that hold member data

Published Nov 13, 2026 · Last checked Nov 13, 2026 · Last changed Nov 13, 2026
The short answer

Find out this week which AI app builders your staff have used for work. Open every app they built in a private browser window, signed out. If an app with member data opens, take it down the same day.

Verdict
ACT
For
All charters. All sizes. IT lead, compliance officer. Under $100 million: the CEO.
Cost and time
No cost. About half a day for the IT lead.

Why

Security firm Claroc tested 37,571 live apps made with Grok Build. It reports that 35,578 of them opened with no sign-in. Claroc says the share setting was already on "Anyone with the link" when it published a test app. About 1 in 10 open apps held internal or personal data. One held a hospital staff list. Another held 18 passwords in plain text. Staff build these small tools to save time. A credit union with no list of them cannot know what is open.

What to do

  1. Ask every department which AI app builders staff have used for work.
  2. Name the common ones when you ask: Grok, Lovable, Replit, v0, Bolt, Base44 and Google AI Studio.
  3. List every app, the data in it, and who owns it.
  4. Open each app in a private browser window, signed out. If it opens, anyone with the link can open it.
  5. Change each open app to invited users only, or unpublish it.
  6. If an open app held member data, tell the compliance officer and the IT lead the same day. Write down what was in it and how long it was open.
  7. Ask compliance whether the event must be reported to NCUA and whether members must be told.
  8. Add one line to the AI policy. No member data goes into an app builder that vendor management has not reviewed.
  9. Tell the board at its next meeting how many apps you found and how many you closed.

What data may go in

Until vendor management has reviewed a builder and its terms: public information only. No member data, no staff records and no passwords.

Who checks the output

The IT lead keeps the list of apps. The compliance officer decides what to do when member data was open. The board gets the count.

The rule to check

Part 748 of NCUA's rules requires a security program that protects member information. It also requires a report to NCUA within 72 hours of a reportable cyber incident. Ask compliance whether an open app with member data meets that test. Your state's breach notice law may also apply.

What can go wrong

The same problem has been reported at other app builders, so check all of them and not only one. A new app can be open next month. Put a monthly check on the IT lead's calendar.

Sources

Plain text version