What you should never paste into a general AI tool
Client names, credentials, anything under NDA.
You've probably had a moment of hesitation before pasting something in an AI. Should this go into a public AI tool? Will it be safe?
Most of the time, the answer is "probably fine, on a paid business tier." Some of the time, the answer is "absolutely not, regardless of tier." Knowing which is which is the useful part, along with what to do instead.
Where your text actually goes
When you type into a general AI tool, your message leaves your machine, gets processed on someone else's servers, and is usually stored, for a few weeks at minimum, often longer. On consumer plans, that stored text may also be reviewed by humans for quality, or used to train future versions of the model.
Business and team plans usually change this, as training is off by default and retention is shorter. That's a real difference, and it's the main reason to pay. But it doesn't change your contractual position: if your client agreement says their material stays with you, sending it to a third party is a breach whether or not that third party trains on it.
Never paste
Personal data of clients or customers
Login credentials, API keys, access tokens
Confidential client material that isn't yours to share
Anything under professional confidentiality
Pre-announcement financials, salaries, personnel issues
Identifiable images of people, especially minors
Do this instead
Anonymise first: placeholders for names, strip emails and numbers
Use a placeholder in the code, never the real key
Get explicit permission, or use a tool covered by the client's Data Processing Agreement
Use a profession-specific tool with the guarantees built in
Or do that part without AI. The risk rarely justifies the time saved
If you wouldn't send it to the wrong client by mistake, don't paste it into a chat box.
Note: Data protection law (GDPR in Europe) puts strict requirements on how personal data is handled. Pasting it into a general AI tool is usually a breach of those requirements, regardless of what the AI company does with it. You're responsible for where you put your clients' data.
The grey area
Your own data sits in a grey zone. Technically, you can paste in anything about yourself, your business, your projects. Whether you should is a judgement call. A useful test: would you be comfortable if this information appeared in a future AI model's training data? If yes, paste away. If no, anonymise or skip.
For most small and medium team use cases, internal documents are reasonable to use with AI on a paid business tier. That assumes they hold no client data, sensitive strategy, or credentials. Use judgement.
How to anonymise in ten seconds
None of this means you have to keep AI away from client work. It means you strip the identifying parts before the text leaves your machine, which takes about as long as writing the prompt did.
Three things to do this week
01
Swap real names for role labels
"Client A", "the retail client", "our contact in finance". The advice you get back is identical.
02
Round or remove the numbers that identify
Budgets, headcounts, launch dates. "Mid six figures, Q4" carries the same meaning.
03
Keep a scratch note for the swap-back
Client A = the real name. Paste the output back into your doc and put the real names in there.
Conclusion
01
Free consumer tools may train on what you type. Assume they do.
02
Client names, contracts and credentials never belong in a chat box.
03
The cost of getting this wrong, professionally, legally, financially, is much higher than the cost of pausing for a minute to decide whether to paste.
Go to next