Knowing what not to put into public AI tools helps employees get useful results without exposing information the company needs to protect. The safest rule is straightforward: if information is confidential, identifies a person, is restricted to certain employees, or has not been approved for public release, do not enter it into a public AI prompt.
That does not mean every workplace use of AI is off limits. It means checking the tool and company policy first, then choosing a prompt that gives the tool enough context without including sensitive details. If your business is building guidance for staff, this checklist can help make the boundary clearer.
Company information to keep out of public AI prompts
Customer and client information
Do not paste customer emails, support tickets, chat transcripts, account records, contact details, or documents containing customer information into an unapproved public tool. A message can include more than a name: order details, dates, locations, account history, or a particular problem may identify someone when combined.
If you need help drafting a response, describe the situation in general terms or create a fictional example. For instance, ask for a polite response to a delayed service request without copying the customer’s message or including identifying details. For customer data and generative AI, follow your company’s approved process rather than assuming a prompt is private.
Employee and applicant details
Keep resumes, applications, payroll information, performance reviews, disciplinary records, schedules, and other employee or applicant details out of public AI tools unless your company has explicitly approved that use. The same caution applies to personal circumstances or workplace matters that could identify an individual.
Removing a person’s name may not be enough. A job title combined with a unique project, location, or event could still point to a specific employee. Use a made-up profile or a broad description instead, and ask your manager or the appropriate internal contact if you are unsure whether a task is approved.
Financial and payment information
Do not enter payment card or bank details, financial reports, budgets, forecasts, revenue information, margins, or pricing plans into a public tool without clear company approval. Even when you want help summarizing a report, the underlying figures may be confidential or access-restricted.
Try asking for a general template or an explanation of a financial concept using fictional figures. If the task requires real company numbers, use only a tool and workflow your organization has approved for that information.
Credentials and security details
Never include passwords, API keys, authentication codes, recovery information, or other access secrets in a prompt. Avoid sharing internal network diagrams, system configurations, security procedures, vulnerability details, or logs that expose sensitive environment information.
When troubleshooting, describe the issue without including credentials or unfiltered system output. If a technical task requires details that could reveal how your systems are protected, ask your IT or security contact which approved process to use.
Confidential plans, contracts, and intellectual property
Keep nonpublic contracts, proposals, product plans, internal strategy documents, source code, designs, and other proprietary work out of public AI tools unless the company has specifically authorized the use. A request to summarize or improve a document can still disclose its contents when you paste the source text into a prompt.
Instead, ask for a generic outline, a sample structure, or editing suggestions using fictional material. For code-related work, use an approved development workflow and do not paste private source code or security-sensitive details into an unapproved chatbot.
What information can be okay to use?
Lower-risk prompts may use information that is already public, general questions that do not reveal company details, or fictional examples created for the task. For example, an employee might ask for a clear explanation of a common business concept or request a generic meeting-agenda format.
Even apparently ordinary details can become sensitive in combination. Before submitting a prompt, remove names and unique identifiers, and consider whether a combination of role, timing, location, or unusual circumstances could reveal a person or business matter. Summarize at a high level rather than copying source documents.
For wider cybersecurity practices, see Zevonix’s guidance on improving cybersecurity for Atlanta small businesses. Teams reviewing their broader technology support needs may also find the guide to IT support for small businesses useful.
Why a training setting is not the whole privacy picture
Turning off model training may address one question, but it does not automatically make a tool appropriate for company data. Tools and plans can differ in how they handle prompts, retention, human review, access, and connected applications. Check the specific terms and settings, and confirm that the tool is approved for the type of information involved. The NIST Generative Artificial Intelligence Profile discusses risks and considerations organizations can use when managing generative AI.
A company-approved business workspace may have different controls from a public consumer tool, but employees should not assume that approval for one use covers every kind of data or every feature. Follow your company’s AI usage policy, including any limits on uploads, integrations, or handling of confidential material.
A quick check before you submit a prompt
- Is the information confidential, personally identifying, regulated, or restricted at work?
- Would the prompt reveal customer, employee, financial, security, or proprietary details?
- Has the company approved this tool for this type of information and this task?
- Can you get a useful answer with fictional details, a general description, or a summary instead?
If you cannot answer these questions confidently, pause and check with your manager or IT contact before submitting the prompt. A clear company AI usage policy can help employees understand which tools are approved, what data they can handle, and where to raise questions.
What to do if sensitive information was shared
If you accidentally enter company information into a public AI tool, report it promptly through your organization’s established security or incident process. Tell the appropriate manager, IT, or security contact what information was shared, which tool was used, and when. Do not assume deleting the conversation removes every copy or resolves the issue.
Follow your company’s instructions for next steps, which may include checking the account and tool settings or assessing whether any access information needs attention. Keep the response factual and timely so the right people can decide what action is appropriate.
Frequently asked questions
Can I paste a customer email or support ticket into an AI chatbot?
Do not put it into a public tool unless your company has approved that specific tool and use. Instead, remove identifying and unique details or use a fictional example.
Is it safe to enter employee, payroll, or performance information?
Keep those details out of public AI tools. Use them only through a company-approved process that permits that information and task.
Does turning off AI model training make it safe to enter company data?
Not by itself. Check the tool’s terms and settings, including retention, access, review, and integrations, and follow company policy.
How can I remove sensitive details before using AI?
Replace real names and specifics with fictional examples, generalize unusual details, and avoid pasting source documents. Remember that combinations of details can still identify someone.
Keep AI useful without exposing company information
Employees can use AI more safely when they know which information must stay private, how to generalize a prompt, and when to ask for approval. Zevonix provides managed AI services and cybersecurity for growing businesses. Contact Zevonix to discuss practical safeguards and AI use at work.