Knowing what not to enter into public AI tools helps employees use them more responsibly without guessing where the boundary is. The safest starting point is simple: if information is confidential, identifies a person, creates a security risk, or is not approved for sharing outside the business, do not paste it into an unapproved AI tool.
That does not mean employees must avoid every AI tool. It means the business should make clear which tools are approved, what information can be used with them, and what safer options are available when a task involves sensitive details.
What counts as a public AI tool?
For practical purposes, treat an AI website or app as public if your organization has not approved or managed it for business use. A tool may be easy to access without being approved for handling company information. Data practices, settings, and contractual protections can differ, so employees should not assume that a familiar interface means their prompts are private.
If employees are unsure whether a tool is approved, they should check the organization’s policy or ask the designated IT, security, privacy, or compliance contact before entering business data.
Information employees should keep out of unapproved tools
Customer, patient, and client information
Do not enter names, contact details, account information, case notes, records, or other details that identify a customer, patient, or client. This includes combinations of details that could point to a person even when a name is missing. For example, a location paired with a specific appointment date and unusual circumstances may still make someone identifiable.
When asking for help with a customer-facing message or workflow, use a fictional example with made-up details. If real information is essential, use only an organization-approved environment and follow your company’s handling rules.
Employee and job applicant details
Keep personnel records, compensation details, performance reviews, health-related information, interview notes, and applicant materials out of unapproved AI tools. These details are private and can include information that identifies a person or affects how they are treated.
For a general task, describe the situation without personal details. For instance, ask for a neutral interview-question template rather than pasting an applicant’s résumé or evaluation into a chatbot.
Passwords, API keys, and security information
Never enter passwords, authentication codes, API keys, recovery codes, private certificates, or other credentials into an unapproved prompt. Also keep out security configurations, network diagrams, access procedures, and details about unresolved vulnerabilities or incidents. This information could make it easier for someone to gain access or understand how a business protects its systems.
If you need help troubleshooting, share a general description of the problem and remove credentials, internal addresses, system identifiers, and other security-sensitive details. Use an approved support channel when the issue requires real configuration or logs.
Financial, legal, and contract material
Do not paste budgets, payroll details, bank information, unannounced financial results, contract terms, legal correspondence, or negotiation notes into a public tool unless your organization has explicitly approved that use. These documents can contain confidential business information, personal data, or commitments that should not be shared casually.
Instead, ask for a general explanation or a blank checklist. If the work depends on the actual document, check the approved tool and review process before sharing it.
Trade secrets, source code, and unreleased plans
Keep proprietary processes, product designs, source code, internal research, pricing strategy, acquisition plans, and unreleased business plans out of unapproved tools. Even without customer details, this information may reveal how the business operates or what it intends to do next.
Use a fictional scenario, a high-level summary, or a small example created specifically for the task. Do not assume a short excerpt is harmless simply because it is only part of a document or codebase.
Why removing a name may not be enough
Replacing a customer’s name with initials or deleting an obvious identifier does not automatically make a prompt safe. Other details can combine to reveal who the person is, what account is involved, or which business project is being discussed. Specific dates, locations, job titles, unusual events, and distinctive wording can all provide clues.
Before using any example, remove details that are not necessary for the task and consider whether someone familiar with the situation could identify the person or business. When in doubt, use synthetic information or ask for approval rather than trying to anonymize sensitive records on your own.
Does turning off model training make sensitive data safe?
Not by itself. A setting related to model training is only one part of how a tool may handle information. It does not establish, on its own, what happens to prompts under other settings, who may have access, how information is secured, or what protections apply to your organization.
Employees should follow the organization’s approved-tool list and data-handling policy rather than relying on a single privacy setting. If a tool’s status is unclear, do not enter sensitive information until the right contact has reviewed it.
A safer way to get useful AI assistance
- Start with the task, not the private data. Ask for an outline, template, checklist, or general explanation without including real records.
- Use synthetic examples. Replace real people, companies, amounts, dates, and system details with invented placeholders that do not map back to the real situation.
- Share only what is necessary. Remove unnecessary context and check whether the remaining details could still identify someone or expose a business secret.
- Use an approved environment for approved work. Follow the organization’s tool and data rules, and confirm that the specific use is allowed.
- Ask before proceeding. If the request depends on confidential or regulated information, consult the designated privacy, security, or compliance contact.
A useful business AI acceptable use policy should make these choices clear. It should name approved tools, define restricted data categories, explain how to request an exception, and give employees a straightforward way to report mistakes. A policy that provides safer alternatives is easier to follow than one that only says no.
For broader security guidance, see these cybersecurity practices for businesses. Businesses reviewing how they protect sensitive information may also find this overview of data protection useful.
What to do after an accidental disclosure
If an employee pastes confidential information into an unapproved AI tool, respond promptly and calmly. Do not enter more information in an attempt to explain, correct, or remove the original prompt. A follow-up message could expose additional details.
- Stop using the tool for that information. Avoid copying the prompt elsewhere or continuing the conversation with sensitive context.
- Notify the appropriate contact. Follow the organization’s incident-reporting process and tell the designated IT, security, privacy, or compliance contact what happened.
- Share the facts needed to assess the issue. Report which tool was used, what type of information was entered, and when. Use an approved channel and avoid spreading the sensitive content further.
- Follow the response plan. The appropriate team can assess the information involved, review the tool’s available controls, and decide what actions are needed. If credentials were exposed, ask the responsible team whether they should be changed or revoked.
- Learn from the incident. Clarify the relevant policy or training so employees know how to avoid a repeat.
Do not assume that deleting a conversation from an interface removes every copy or resolves the exposure. Follow the organization’s response process and let the responsible team determine the next steps.
Zevonix provides managed IT and cybersecurity support for businesses in Northeast Florida, along with a free IT assessment. If your team needs help making AI use fit within practical security boundaries, IT strategy consulting can be a starting point. The key is to set clear boundaries before employees face a sensitive prompt, then give them an easy way to ask questions and report mistakes.
Frequently asked questions
Is it safe to paste customer information into an AI chatbot?
Do not paste identifiable customer information into an unapproved chatbot. Use an approved environment and follow your organization’s data-handling rules if the task requires real customer details.
Can employees enter confidential company documents into public AI tools?
Not unless the organization has explicitly approved that tool and use for the information involved. Use a generic template or synthetic example when possible.
Can employees use AI with applicant or employee information?
Keep identifiable personnel and applicant information out of unapproved tools. Ask the appropriate contact about an approved process before using AI for work involving those records.
What if an employee accidentally shares sensitive information?
Stop the conversation, report the incident through the company’s established process, and provide the relevant facts to the responsible team. Do not assume that deleting the prompt fully resolves the issue.
Keep the boundary clear
Public AI tools can support everyday work when employees know what information belongs in them and what does not. Set a clear policy, encourage synthetic examples, and make it easy to ask for help. To discuss practical IT and cybersecurity support for your business, contact Zevonix about a free IT assessment.