What Never to Paste Into ChatGPT at Work

The rule that covers almost everything

AI chatbots are good at drafting, summarizing and rewording. The risk is what people paste in. If your business has not approved the tool, assume the text could be stored, reviewed or processed outside your control.

Memorable rule: if you would not email it to a stranger outside the company, do not paste it into an unapproved chatbot. Use AI for structure, wording and templates; keep the private details in your approved systems.

Never paste: access and money

Passwords, codes and keys: passwords, one-time codes, API keys, recovery codes and login links. Describe the error instead: "How do I fix an expired API key error?"
Bank and payment details: account and routing numbers, wire instructions, card numbers, tax IDs and payroll files. Use rounded or sample figures to explain a budget.

Never paste: personal information

Customer data: names, addresses, phone numbers, emails, account numbers, order histories and support tickets. Replace them with "Customer A" or a short description.
Employee and HR records: resumes, reviews, discipline notes, salaries, complaints and termination plans. Describe the situation in general terms instead.
Health and benefits details: leave and accommodation requests, injury reports and insurance claims, even if you are not a health business. Ask about the process, never the person.

Never paste: confidential business material

Legal documents: contracts in dispute, settlement talks, legal strategy and messages with your lawyer. Ask general questions about structure instead.
Trade secrets and plans: pricing strategy, roadmaps, vendor terms, forecasts and acquisition talks. Turn the question into a generic scenario.
Unreleased marketing: launch messaging, product names and campaign concepts before approval.
Confidential meeting notes and chats: transcripts, board material and internal message threads. Summarize the themes yourself.

Never paste: technical and security details

Source code and architecture: private repositories, database schemas, server configurations and internal hostnames. Use a small made-up example that shows the same problem.
Security incidents: incident reports, vulnerability scans, access logs and live phishing emails. Use your security team's approved tools.
Whole documents: pasting a full report to fix one paragraph also sends comments, tracked changes, names and appendices. Copy only the part you need.

How to redact a prompt in one minute

Decide the real task: rewrite, summarize, brainstorm, troubleshoot or fix the tone.
Delete names, emails, phone numbers, addresses and account or ID numbers.
Swap secrets for placeholders such as [CLIENT], [AMOUNT], [INTERNAL_TOOL] or [DATE].
Cut everything the chatbot does not need; one paragraph instead of the whole thread.
Round numbers and use broad dates when exact ones are not needed.
Ask for something reusable, such as a template or checklist, then fill in the real details privately.

Risky: "Rewrite this email to Robert Chen at Acme Medical about invoice 88314, the $47,892 overdue payment and the account hold tomorrow."

Safer: "Rewrite this in a firm, professional tone: [Customer] has an overdue invoice; service may pause if payment is not received by the deadline."

What business plans and private AI change

Business and enterprise plans from the major AI vendors usually add admin controls and contract terms about how your data is used, and some let you keep data out of model training. That is safer than a personal free account, but it is still a third party, so the list above still applies to the most sensitive material. Read each vendor's current business terms rather than assuming.

For data that should never leave your control, private AI runs models on infrastructure you own or control. Our ChatGPT for business guide compares the options.

Make it a team habit

Put the rule and the list on one page in your AI acceptable use policy, name the approved tools and show a redaction example in onboarding. If people are already using unapproved tools, start with the amnesty approach in our shadow AI guide rather than a ban.

Where ASL fits

When staff keep pasting internal documents into public chatbots to get answers, the better fix is an approved tool. ASL Help Engine answers staff questions from reviewed help content and only shows each person the content their role allows. For assistants connected to your own systems, see our custom software development service or contact us.

Frequently asked questions

What should you never share with ChatGPT at work?

Passwords and keys, bank and payment details, customer and employee personal data, health information, legal documents, trade secrets, source code, security details and confidential meeting notes.

Is it safe to paste company documents into ChatGPT?

Not into an unapproved or personal account. Even with an approved business plan, paste only the part you need and remove names, numbers and secrets first.

How do I use AI without sharing sensitive data?

Redact: describe the task, remove identifiers, use placeholders like [CLIENT] and [AMOUNT], cut extra context and ask for a reusable template you finish privately.

Do business AI plans make it safe?

They usually add admin controls and data terms, which is safer than personal accounts, but the vendor is still a third party. Keep the most sensitive material out or use private AI.

What if someone already pasted sensitive data?

Tell IT or your manager promptly, delete the conversation if the tool allows, change any exposed passwords or keys, and follow your privacy and contract obligations.

Related guides

Explore the complete product

Read features, current access and limitations