Why this matters
A third-party AI service may store your input and use it for training. A password, an ID document, card details or someone else's personal data sent into a chat is a leak you can't take back: the data has settled in logs, caches and possibly a training set. For a business it's also a breach of confidentiality agreements and data protection law.
Real-world scenario. An employee pastes a chunk of the customer database into a public chatbot to "quickly clean up the table". The data goes to the provider's servers; by default, input on a free plan could be used to improve the model. The result: a leak of customer personal data, reputational and legal risk — and nothing left to roll back.
What to do (step by step)
- Check the data-retention policy and the training opt-out before you paste anything sensitive. On business/Enterprise plans training on your data is usually off — switch that mode on explicitly.
- Anonymise the data before pasting — replace real values with placeholders:
Before: John Smith, +1 555 123-45-67, passport 4509 No. 123456
After: <FULL NAME>, <PHONE>, <PASSPORT>
- Run sensitive material and trade secrets through a local model with no cloud involved:
# local model, data never leaves the machine
curl -fsSL https://ollama.com/install.sh | sh
ollama run llama3.1
- Turn off history/training in the service's settings wherever possible; for a team, use a corporate plan with a DPA (data processing agreement).
- Set a team rule for what may never go into a cloud AI at all (customer personal data, keys, contracts, medical or financial records).
What NOT to do
- Don't paste passwords, ID documents, cards, keys or other people's personal data into third-party AI.
- Don't upload customer databases or confidential documents to public services.
- Don't assume "temporary chat" means "not stored" — that's about your screen, not their servers.
- Don't send trade secrets into a free plan with training switched on.
Self-check
- I know whether my service stores my input and trains on it; the opt-out is on.
- I anonymise data before pasting anything sensitive.
- For trade secrets and customer personal data I use a local model or an Enterprise plan with a DPA.
- The team has an explicit list of "what must never go into cloud AI".
- History and training are switched off in the service settings wherever possible.
Tools
- Local models (data stays put): Ollama, LM Studio, GPT4All.
- Corporate plans without training on your data: ChatGPT Team/Enterprise, Claude for Work, Gemini for Workspace (check the DPA terms).
- Anonymisation: Microsoft Presidio — detects and masks personal data in text.
- Policies: an internal "data and AI" rulebook, a checklist of acceptable input.