Is a Website You Built With AI Safe for Your Business?

That is not a scare story. It has already happened.

If your website collects customer details or takes payment, a site that merely looks finished is not good enough. Here is what has gone wrong for others, what the law expects of you, and five questions to ask before you trust it.

By Ryan Nicholls, founder of Archline Digital Solutions · 15 October 2026

In early 2026 a fast-growing app called Moltbook left its database open to the public. Security researchers at Wiz found about 1.5 million login tokens, tens of thousands of email addresses and private messages that anyone could read, and change. The app had been built quickly with AI. Nobody had checked the settings that control who can see the data.

It is not a one-off. Researchers at Escape.tech scanned 5,600 live apps built with AI tools. They found over 2,000 serious weaknesses, more than 400 exposed passwords and keys, and 175 cases of exposed personal data, including medical records and bank details.

Veracode tested more than 100 AI models on security tasks. About 45% of the code they produced failed basic security checks.

Why does AI get this wrong?

AI is built to make things work. It is not built to ask what could go wrong.

Ask it for a booking form and you get a booking form. It does not ask who else can read the bookings, whether a stranger could change a price, or where the passwords end up. Those are the questions that matter, and they are the ones that get skipped.

Why should a small business care?

Because you hold other people’s details: names, phone numbers, addresses, job notes, sometimes payments. If that leaks, it is your name on the letter to the customer and your problem with the data regulator.

You also won’t know it has happened. A site that looks and works fine can be wide open for months.

If your website collects names, emails, phone numbers or addresses, you are handling personal data. In the UK that comes with duties, even if you are a sole trader.

• Pay the ICO data protection fee. Most organisations that handle personal information have to, unless they are exempt. For most small businesses it is £52 or £78 a year, and not paying can mean a fine of up to £4,350. The ICO has a fee checker if you are unsure.
• Tell people what you do with their data. That means a privacy notice: what you collect, why, who sees it and how long you keep it.
• Keep it secure. The law expects appropriate security. A database open to the public is not that.
• Get your legal pages checked. This one is not a legal requirement, but it is sensible. A privacy notice or terms copied from a template, or written by AI, often describes things your site doesn’t actually do. Have a solicitor read them before you take customer details or payments.
• Know what your payment provider covers. A hosted payment page from a certified provider means card details are entered on their system, not yours, which usually reduces your own card-security burden. It does not cover the customer details sitting on your side.
• Check your insurance. It isn’t a legal requirement for this, but cyber and professional indemnity cover can pay towards the cost of a breach. Ask your insurer whether a site you built yourself is covered, and what the policy actually pays for.

Honest answer: it depends, and the worst case is rare. But it is not nothing.

• The regulator. The ICO can fine organisations. The ceilings are £17.5 million (or 4% of worldwide turnover for the largest firms) for the most serious breaches, and £8.7 million (or 2%) for lesser ones. Those limits are aimed at the biggest cases, and fines for small firms are usually far lower. The investigation, the paperwork and the time it takes are still a cost.
• A serious breach has to be reported. If personal data is lost or exposed and it puts people at risk, you generally have 72 hours from finding out to tell the ICO, and you may have to tell the customers affected.
• Your customers. People who suffer harm from a breach can claim compensation through the courts.
• Your payments. A card provider can suspend an account that is being abused or hit by fraud, and a site with no bot or fraud controls is an easy target.
• Your business. No regulator closes a business for this. But lost customers, a claim, a fine and a frozen payment account in the same month is enough to sink a small one.

This is general information, not legal advice. If you hold customer details or take payments, speak to a solicitor about your own situation.

1. What customer information does it collect? List it. If you can’t, you can’t protect it.
2. Who can see it? Only you, or anyone with the link?
3. Where are the passwords and keys kept? They should never sit in the public part of the site.
4. Has anyone other than the AI checked it? A second pair of eyes, with a checklist.
5. Who fixes it when it breaks? And how quickly?

If you can’t answer all five, the site isn’t finished. It just looks finished.

Is AI itself the problem?

Not on its own. It is a fast way to get a first version. The problem is shipping whatever any tool produces without checking it.

Every site we build gets a security check before it goes live. We pay our ICO fee and carry professional indemnity and cyber insurance.

If you have built something with AI, or someone built it for you, and you can’t answer those five questions, get in touch. We will tell you straight whether it needs attention. We are based in Chippenham and work with tradespeople and service businesses across Wiltshire, Bath and Bristol. See our services and work.

Sources: Wiz Security and Infosecurity Magazine (Moltbook); Escape.tech (scan of 5,600 deployed apps); Veracode, 2025 GenAI Code Security Report; ICO guidance on the data protection fee, its penalties and UK GDPR maximum fines.