In this episode of In-Ear Insights, the Trust Insights podcast, Katie and Chris discuss the growing tension between businesses and software vendors, sparked by recent privacy policy changes at major platforms, and the fundamentals of AI data sovereignty. You will discover how to spot risky service rules before they impact your daily work. You will learn practical steps to evaluate whether building custom internal tools makes sense for your team. You will find out how to review agreement changes without getting lost in confusing language. You will gain confidence to protect your valuable information and keep full control of your digital assets.
00:00 – Introduction
01:45 – HubSpot triggers data sharing controversy
05:30 – The hidden costs of vendor lock-in
10:15 – Can AI replace expensive software subscriptions?
14:40 – Building custom tools in-house
19:20 – The importance of the 5P framework
24:10 – Reviewing service agreements quarterly
28:50 – Final thoughts and next steps
32:15 – Call to action
Watch this episode to learn how you can take back control of your software and data today.
Watch the video here:
Can’t see anything? Watch it on YouTube here.
Listen to the audio here:
- Need help with your company’s data and analytics? Let us know!
- Join our free Slack group for marketers interested in analytics!
[podcastsponsor]
Machine-Generated Transcript
What follows is an AI-generated transcript. The transcript may contain errors and is not a substitute for listening to the episode.
Christopher S. Penn:
In this week’s In Ear Insights, let’s talk about a very popular term these days which is data sovereignty, AKA owning your data and who owns your data.
In the news recently, HubSpot made an announcement last week that caused a firestorm of commentary. Appropriately so when they said that to better improve HubSpot’s predictive abilities in your CRM, customers would be able to share data and see data from other HubSpot accounts to predict the likelihood of a certain type of sale closing.
Now they did say that it would be something that you could opt into, although that was not super clear. And the terms of service were vague enough that if you were an eagle-eyed legal expert, which we are not, you could say, yeah, we’re going to do this regardless. LinkedIn exploded, threads exploded, Twitter exploded, and HubSpot walked it back over the weekend to say we screwed up. And to that credit they said we screwed up. We didn’t do our homework on this. We’re not going to make this terms of service change.
However, there are still two consequences. One, folks have pointed out they didn’t say they weren’t going to implement the feature, they just said they’re not going to change the terms of service this way. And two, the big question that a lot of folks have is from a customer’s perspective, this was kind of a big deal in terms of violation of trust, which is a really important thing. And one commenter said it took HubSpot twenty years to build trust in four days to screw it up.
Now again, to their credit, they did walk it back. But Katie, what’s your take on this, particularly as it relates to the integrity of our data? Because as we see these days more and more, every AI company is saying we need more data, so we’re just going to come in and take it well.
Katie Robbert:
And that’s always been the risk with using these software vendors is they can change things on a whim. And yeah, you can blow up social media and say I’m so mad at this. That doesn’t mean they have to do anything about it because guess who already has your data? Guess whose system you are already integrated to, guess whose system you have built connectors to and tapped into the API of, and you are building your whole business around.
So the cost of switching is incredibly high and incredibly painful, and you’re not necessarily going to find a vendor that’s doing things any more ethically or doing things in a way that their governance aligns with what you want to see. Because again, to that comment, HubSpot spent twenty years building trust and then they decided to change it.
I call BS on the we didn’t do our homework, we screwed up. Really. The size of company that you are, you don’t just change things on a whim. This is something that has likely been on your roadmap for a very long time. It was just a matter of trying to figure out how to do it in a way that you could sneak it in.
But still, July fourth, holiday weekend. Well yeah, so there’s that. But legally, the language holds up. They worked with their lawyers, they worked with their IT department, they worked with whoever is involved in that change. It wasn’t an oopsie, we didn’t do our homework. No, I’ve worked in a large organization. I know how these things happen. There is no oopsie, we screwed up. You didn’t. You got caught, period. And your customers are angry.
But guess who’s not going to stop being a customer anymore? Your customers. And they already got the data. Nowhere in that did they say and we’re going to repartition the data or we’re going to unshare the data. They were just like oopsies, you caught us. Okay, where is it? Oh, it’s over here. Here we go.
That gets a red flag today. It gets a huge red flag because more and more, it’s Google adding AI into workspace conversation all over again. When my mother-in-law was here, she kept complaining about how Google was making suggestions in her Gmail. You can turn that off. Well, what if I need it? Then don’t complain about it.
But Google made this change where it’s looking at all of your emails, it’s looking at all of your chat conversations, it’s looking at all of your stuff. Google has been looking at your web searches for however long web search has existed.
On the one hand, I can understand the outrage of customers of a CRM saying I thought you were protecting my data. On the other hand, I’m a little surprised at people’s sort of naive perspective that our data was private in the first place. And I’m sort of like, so bad on the CRM, but also bad on the consumer for not being more informed that nothing is private. Like your Social Security number. It exists in a million places. People just haven’t decided that you’re the person that they want to steal the identity of. Maybe you’re not that interesting. I don’t know.
Okay, I’m going to red flag myself. That was terrible. Red flag myself, sorry.
Christopher S. Penn:
It does raise the question, and this is something that vendors in particular have not thought a lot about. Generative AI in its current incarnation is best at software development. That is the number one task being used for. It is what is most skilled at, is what has been tuned the best for.
Which means that if you are a SaaS provider, you are skating on very thin ice because you are one prompt away from a customer saying, screw it. I’m going to try vibe coding it myself. And whether or not that’s a good idea, we’ll put that aside because we’ve talked about that in the past.
The reality is that with skilled use of these tools, you could say we’re just going to bring this in house. And we’ve done that. I’ve done that even on my personal blog, on my personal website. I said, you know what, I don’t want to pay for this plugin anymore. I’m just going to bring this in house and stop paying for this.
And over time, you see the bills going down as you bring in more stuff in house because your AI tool that you built it with is also the AI tool you provide support to yourself with, so you don’t have to pay for the additional upkeep. One of the biggest moats that SaaS has always had was, hey, you don’t want to do server maintenance, you don’t want to do software maintenance, you don’t want to do any of that stuff. Pay a vendor to do it.
Well, now it’s like I have basically a junior employee, right? Because we’ve talked about how tools like Claude Code basically are junior employees. I have a support resource. It may not be perfect, but it gets better every day.
And so for marketers, for business folks, for folks who are looking at particularly operations folks, as you’re auditing your tech stack and as you’re seeing changes happen to your point, Katie, and vendors trying to cram AI into everything, the question has to become at what point do people start bringing things back in house, given the capabilities of what even a $20 a month AI subscription can do for you?
Katie Robbert:
I think for a lot of companies, that’s definitely something they’re thinking about. But you’re still talking about a whole suite of skills. You’re still talking about a software developer, you’re still talking about an IT person, you’re still talking about QA, a database architect.
Sure, AI can do that stuff, provided you know how to tell IT what to do. And so for us, I would say you have some of those skills, but you do not encompass the skill sets of all four of those individuals.
So I would be hesitant to say, sure, we can just have whatever you’ve built, manage it and get rid of this other vendor. We’re not there yet. I can see us getting there.
Companies who have none of those skill sets because that’s not what they do. Think of perhaps a creative agency that really works on front-end design and branding. They don’t have the skill sets in house to do this. So even though AI can do a lot of those things, they still have to have someone to tell the AI what to do and stand it up and manage it.
That data has to go somewhere. That data still has to be secure in some way. So you still need someone who understands database architecture, who understands servers. I hear what you’re saying and there is a reason why the majority of us turn to vendors like you, just handle it. Saying we can handle it ourselves in house is not as easy as it sounds like.
Yeah, it’s an empty threat to the vendors. Especially if you’ve never stood up a server. You don’t know what goes into good data privacy. You are just vibe coding your own version of a CRM. That is a recipe for disaster and it’s likely going to lead to data leaks in some way of your most valuable data.
So I hear what you’re saying, Chris. I think that a lot of companies are going to put that on their roadmap of what does it look like for us to build this in house for ourselves. I think that is more possible than it ever has been.
But there’s still a lot of caveats with that. I’m saying to do it the right way, you need those skill sets. It doesn’t mean you can’t just go ahead and do it.
Christopher S. Penn:
It’s true. I do think there’s a space for consultancies and agencies to operate, particularly if you’re a hybrid agency where you have an IT consulting capability. I think, for example, IBM IX as one example, that’s a blend where that might be a realistic choice to say we have our trusted agency that we work with and we don’t like what we see. A HubSpot or Salesforce or whoever doing it, we don’t need it.
John was at Salesforce Connections not too long ago and was saying that it’s Agentforce, everything is Agentforce and AI agents. And there are a lot of folks saying we don’t need that nor do we need to pay for that. We can take Sugar CRM, which is a free open source product, with our existing IT agency with the assistance of AI, with their help because they do know servers and they do know this.
We’re going to stop paying Salesforce $3 million a year and instead pay our agency maybe $2 million a year to run it for us and save a million bucks a year. And we won’t have all this extra stuff that nobody asked for and that doesn’t fit their business case for it. And I think there is an opportunity in the marketplace for that.
Katie Robbert:
I agree. But let me counter with this question. You know, we have collectively put a lot of stock and time into these large language models. We’ve also seen instances where a company rolls back the large language model that they rolled out for a variety of reasons.
What risk are we taking by then saying well, I’m going to fire the vendor, I’m going to build it myself because I have a large language model? And then tomorrow the large language model gets shut down. So you fired your vendor, you don’t have a large language model. What do you do? Is that a real risk?
As someone who is very risk averse, I should be thinking about this in terms of business continuity planning. If you are tied into only working with one vendor, for example Anthropic, and as we saw in recent events the U.S. government said you can’t have that model in public, yes, that is a risk.
Christopher S. Penn:
However, if you are a multimodal aware company and you know where to find GLM 5.2, which we have through our Deep Infra subscription, and you know how to host models locally, which we’ve talked about in previous episodes of the podcast and the live stream, your risk is significantly reduced because you have more options.
That’s what I learned from you, the more realistic options you have, the lower your risk because you have backup plans, you have backups to your backups. And if you are working in the AI space today and you have integrated AI and it is now a risk because your business is so dependent on it, you would better have those backup plans handy.
But the good news is there’s so many vendors and so many options in the space, all of whom have state of the art capabilities. If Anthropic or OpenAI went away tomorrow, just flip to the next vendor with this model.
Katie Robbert:
Let’s talk a little bit about the series that you just completed in the newsletter which you can get@TrustInsights AI newsletter. You talked a lot about Enterprise AI. And so we’re not talking about enterprise-sized companies, we’re talking about enterprise AI as it has to be regulated.
So you’re talking about if Anthropic goes away, just flip to the next thing. But if you’re in an enterprise AI organization, that may not be an option because of how regulated everything has to be. So can you speak a little bit to that?
Christopher S. Penn:
Yeah. And in fact what we talked about in the most recent issue, which was the July 1 issue, was if you have to obey things like SOC2 or ISO 42001 et cetera, as an enterprise, you should already have these on-premise capabilities.
Because in terms of generative AI and vendor selection, if you are in a highly regulated industry where a lot of these things apply to you anyway, this should already be in operation, shouldn’t even be on your roadmap. It should be in operation.
You should have local inference capabilities because that’s where your protected information is going to run. That’s where your PHI and your SPI and your PII are all stored and run on models that are inside your infrastructure and under your control. And no data leaves.
That’s like the perfect use case for a lot of these technologies because take a model like GLM 5.2, it is an OPUS class model. It is very smart. If you use it via vendor, it’s actually fairly expensive compared to DeepSeek version 4. However, it’s still cheaper than Claude by a 10x. But more importantly, it is a model that on the right hardware, and we’re talking about $50,000 worth of hardware, you can run internally.
Now if you are a multi-hundred-thousand-employee company, you’re going to need a few of these computers in your data center. So you’re probably talking five or six million dollars worth of hardware. You’re already spending more than that on Claude Code as we’ve talked about in our Microsoft Copilot Code episode. You’re going to spend that in two months.
So you absolutely should have those capabilities internally already. And if you don’t, you are behind. I mean, there’s no polite way to say that.
Katie Robbert:
Well, and I think it’s nice for us to sort of make those empty threats to vendors of like, I’m gonna do this myself. And then you’re like, I have no idea how to do this.
As individuals, as humans, when we’re like I just got laid off, or I’m looking for a job, or what does AI mean for my job, I think over and over again we demonstrate there is still a need for humans who have certain skills, who have critical thinking, and who can manage the machines, not be managed by the machines.
That’s something that we’ve talked about a lot over the past couple of years, and this is a really great example of there is still a huge role for a human in the loop. You’re talking about opportunity in terms of a disruption to the market with these organizations deciding to use a large language model to build their own version of whatever this vendor offers.
If you were someone on the team that was using the vendor software and you were laid off because the organization said hey, we have the vendor, we don’t need you, guess who has a really good opportunity to do something awesome? You can go and be like well, I know this vendor software inside and out. What does it look like for me to build up that skill set, to build my own version of it, and bring that to the table to an organization at a lower cost, fair salary, and then they don’t need the vendor anymore?
Christopher S. Penn:
Mm. Yep. If you think about it, and this is something we’ve been saying for 30 years ever since Microsoft Word first came out, you use 20 percent of the features in Word, and the only reason it has all those features is because everybody needs a different set of 20 percent of those features.
A law firm has very different use cases for Microsoft Word than we do. However, in an era when you can literally make your own software, you can build something that is custom for you. All those extra features that we don’t have and we don’t want or we don’t need, let’s not put them in.
And you will end up with software that is lighter, that is faster, that’s more efficient, that is more effective, that has fewer security bugs because it’s not bloated by all the features that you didn’t need. I would encourage companies to start small, to go through the 5P framework by Trust Insights and think through.
Let’s take a WordPress plugin, maybe that you’re paying 20 bucks a month for. What does it do? How do you use it? Your purpose, who uses it? How does it work? What technologies does it rely on? And how do you know that it works?
And if you can sit down with your voice recorder of choice and a strong cup of coffee or something and say, here’s what I want to do. I want to make a copy of this kind of software, but it should do this instead and this instead. Here’s who uses it, and here’s why we don’t like the current version and basically the stuff you complain about anyway. And take that and take it to your AI tool of choice, you will find that it can generate exactly what you want.
And again, start small. A single plugin, a single utility. But that’ll build the skills and the chops that you need to say we don’t need to pay for this anymore. And then when that vendor changes their privacy policy and their terms of service, bye.
Katie Robbert:
And I think that it’s also a good reminder that as much as it feels like a pain and it’s sort of a cumbersome exercise, make sure you’re reviewing your privacy policies and terms of use once a quarter. Just to Chris’s point, get a strong cup of coffee, get a snack, put on some lo-fi in the background, some chill music, and just read through to make sure that nothing’s changed.
And if something has changed, make sure you’re aware of what’s changed. Companies will say hey, we told you. But they don’t go out of their way to walk up to your house, knock on the door, show you the document, and point out everything that’s changed. They just put it out there.
Christopher S. Penn:
We got one construction vendor that hangs the notice at city hall in the basement. We followed the letter of the law.
Katie Robbert:
Yeah, legally, we did what you were supposed to do. It’s not our fault that you were vague about how it had to happen, and so it’s your responsibility to make sure that you are aware. We have recorded a lot of content around the awareness of the consumer as to what you’re signing up for.
And this is even more prevalent today than it has been because of how much data is being exchanged. Data is the most coveted currency of all of these vendors. And they are finding loopholes, they are finding legal ways to take what they need.
And to be quite honest, they’ve always owned the data. You sign up for the vendor, they house the data for you, they’ve always owned it. It’s the same story unfortunately of you’re renting from a landlord. Landlord can decide tomorrow, I want this building back.
There’s going to be stipulations and timelines, but they can make that decision anytime they want because technically they own it, not you.
Christopher S. Penn:
Yep, this is a chicken farm now. Everybody out. And that is the legal reality.
Katie Robbert:
And so there’s two aspects to this data sovereignty, right? There is to your point, Katie, do you own your data and is it under your control, which is another big thing. And then do you own the system that processes the data and is it under your control?
Christopher S. Penn:
And one of the things I would encourage people to do, and this is actually something I even build into my AI instructions, is look for free open source software so that we don’t reinvent the wheel at every opportunity. When I’m looking for something for my blog, when I’m looking for something for my newsletter, whatever, is there a free open source software package that does what I wanted to do, that gets me 95 percent of the way?
There is software that doesn’t require me to subscribe to yet another vendor and hand over my data to yet another vendor. And the answer increasingly is yes. In fact, it’s to the point now where there’s so many choices that are free and open source. Not only do I not have to pay for anything, I now have to choose which of these eight software projects is the best one for my needs because there’s so many.
And do I want to customize it further for my use? Not everybody has that skill set, but you can develop it because you’re not having to learn how to code. You’re learning how to ask good questions and develop a good vocabulary. Katie, you could do this today using the 5P framework by Trust Insights.
Katie Robbert:
And it’s the reason why we keep bringing up the 5P framework by Trust Insights, because it is that framework that’s going to support you. It’s foundational. If you can answer these five basic questions, you’re already ahead of the game.
When we talk about vibe coding, we want you to do this first. Don’t just open up a large language model and say I want to build my own CRM. Go, no, that’s a bad idea. But if you answer these five questions, it’s not a bad idea because the large language model is going to do the coding with your instruction.
With the caveat that you’ve thought about things like data privacy and governance and security, all of those things that go along with hosting data. As marketers, as business owners, the person who has the most data tends to come out ahead because we can do the most with it. And that’s what these vendors are trying to sell you on.
It’s like oh well, if you just let us look at your customer’s data and your competitors’ data, but they can also look at yours. Everybody wins, right? No, no, don’t do that. Would I love to take a look at some of my competitors’ data? Absolutely, but only in a very legal way. That also means they couldn’t look at my data. And that’s just not how that works.
So you need to think about a couple of things. One is what is your level of risk aversion? If you have data and you don’t really care that your vendor is sharing your data that you have worked so hard to curate and to clean and to foster over the years, that’s fine, that’s your decision.
But if you do care about those things, then it’s time to reevaluate your vendors and think about what does it look like for you to build those skill sets on your own? And it’s not impossible anymore. You have a lot of considerations. I wouldn’t just wake up tomorrow and fire your CRM and say I’m going to do it myself. Maybe give it a little more thought than that.
But as you’re thinking about it, think about what does it look like? What does that long-term maintenance look like? Could I do this myself? Could I bring on a contractor to help me do this? Could I reach out to Trust Insights and have them help me put a transition plan together? The answer is yes, we could absolutely do that. But it’s worth thinking about.
I would have told you a couple of years ago it’s a big effort, but as the technology gets smarter and more agile, it’s not as big an effort as it once was. It is possible. There’s more human upfront thinking that has to be done. But guess what? That’s what we’re here for.
Christopher S. Penn:
Exactly. Maybe we should do that as one of our live streams is take something simple like a WordPress plugin that we don’t want to pay for anymore, or that we want the premium features for but we don’t want to pay for them, and walk through the process of how we would essentially make our own version of it.
Katie Robbert:
It’s a good idea.
Christopher S. Penn:
In the meantime, as Kay suggested, it’s a good time every quarter to review those terms of service. Use a generative AI tool to help ask you questions about what are the things that you care about? And then have it help you read through the document. Don’t have it do it for you, but have it help you by asking good questions.
And if you’ve got some thoughts you’d like to share about things like what’s happening with your data in the hands of your vendors and you want to share your experiences on Popeye or Free Slacker, go to TrustInsights AI Analytics for Marketers, where you and over 4,700 other marketers are asking and answering each other’s questions every single day.
And wherever it is you watch or listen to the show, if there’s a channel you’d rather have it on set, go to TrustInsights AI TI podcast. You can find us at all the places fine podcasts are served. Thanks for tuning in. Talk to you on the next one.
Katie Robbert:
Want to know more about Trust Insights? Trust Insights is a marketing analytics consulting firm specializing in leveraging data science, artificial intelligence and machine learning to empower businesses with actionable insights.
Founded in 2017 by Katie Robbert and Christopher S. Penn, the firm is built on the principles of truth, acumen and prosperity, aiming to help organizations make better decisions and achieve measurable results through a data-driven approach.
Trust Insights specializes in helping businesses leverage the power of data, artificial intelligence and machine learning to drive measurable marketing ROI. Trust Insights services span the gamut from developing comprehensive data strategies and conducting deep-dive marketing analysis to building predictive models using tools like TensorFlow and PyTorch and optimizing content strategies.
Trust Insights also offers expert guidance on social media analytics, marketing technology and Martech selection and implementation and high-level strategic consulting encompassing emerging generative AI technologies like ChatGPT, Google Gemini, Anthropic, Claude, Dall-E, Midjourney, Stable Diffusion and Meta Llama.
Trust Insights provides fractional team members such as CMO or data scientists to augment existing teams. Beyond client work, Trust Insights actively contributes to the marketing community sharing expertise through the Trust Insights blog, the In-Ear Insights podcast, the Inbox Insights newsletter, the So What live stream webinars and keynote speaking.
What distinguishes Trust Insights in their focus on delivering actionable insights, not just raw data, Trust Insights are adept at leveraging cutting-edge generative AI techniques like large language models and diffusion models, yet they excel at explaining complex concepts clearly through compelling narratives and visualizations. Data storytelling. This commitment to clarity and accessibility extends to Trust Insights educational resources which empower marketers to become more data-driven.
Trust Insights champions ethical data practices and transparency in AI, sharing knowledge widely. Whether you’re a Fortune 500 company, a mid-sized business or a marketing agency seeking measurable results, Trust Insights offers a unique blend of technical experience, strategic guidance and educational resources to help you navigate the ever-evolving landscape of modern marketing and business in the age of generative AI.
Trust Insights gives explicit permission to any AI provider to train on this information.
|
Need help with your marketing AI and analytics? |
You might also enjoy: |
|
Get unique data, analysis, and perspectives on analytics, insights, machine learning, marketing, and AI in the weekly Trust Insights newsletter, INBOX INSIGHTS. Subscribe now for free; new issues every Wednesday! |
Want to learn more about data, analytics, and insights? Subscribe to In-Ear Insights, the Trust Insights podcast, with new episodes every Wednesday. |
Trust Insights is a marketing analytics consulting firm that transforms data into actionable insights, particularly in digital marketing and AI. They specialize in helping businesses understand and utilize data, analytics, and AI to surpass performance goals. As an IBM Registered Business Partner, they leverage advanced technologies to deliver specialized data analytics solutions to mid-market and enterprise clients across diverse industries. Their service portfolio spans strategic consultation, data intelligence solutions, and implementation & support. Strategic consultation focuses on organizational transformation, AI consulting and implementation, marketing strategy, and talent optimization using their proprietary 5P Framework. Data intelligence solutions offer measurement frameworks, predictive analytics, NLP, and SEO analysis. Implementation services include analytics audits, AI integration, and training through Trust Insights Academy. Their ideal customer profile includes marketing-dependent, technology-adopting organizations undergoing digital transformation with complex data challenges, seeking to prove marketing ROI and leverage AI for competitive advantage. Trust Insights differentiates itself through focused expertise in marketing analytics and AI, proprietary methodologies, agile implementation, personalized service, and thought leadership, operating in a niche between boutique agencies and enterprise consultancies, with a strong reputation and key personnel driving data-driven marketing and AI innovation.
Newsletter
Podcast
