Keeping company data safe

Public AI tools have created the most approachable data-leak channel in business history, and it isn’t a hack. It’s a text box that millions of your employees now have open all day, into which typing a customer list, a draft redundancy plan or a set of unreleased financials feels exactly like typing a search query — casual, immediate, and utterly unweighted by consequence. What happens next varies by tool and by settings: the text may be stored, it may be reviewed by humans in exceptional cases, it may be used to train future models, and it may resurface, in fragments, in someone else’s output. None of this requires malice. A well-meaning employee with a deadline is the entire threat model.

Where the risk actually sits

It’s worth being precise about the machine, because precision prevents both panic and complacency. The model itself doesn’t ‘want’ your data and doesn’t remember prompts as a person does — but the text you submit is processed by infrastructure you don’t control, under terms you probably haven’t read, and often retained in logs and storage for periods and purposes that differ between tools and between tiers of the same tool. A business tier of a major tool may offer different data handling than the free tier of the same brand; an enterprise deployment may keep everything inside your own tenancy. The details change quarterly. What doesn’t change is the asymmetry: once information has left your company’s control, you cannot unsend it — you can only manage the consequences.

So the sane posture is neither ‘AI tools are fine, stop worrying’ nor ‘ban them all’, but a third thing: a clear, short, taught boundary between what may go into a general-purpose tool and what may not — plus the habits to work productively on the safe side of that line. That boundary is what this guide is for, and it’s teachable in an afternoon. Companies that teach it get the productivity without the exposure. Companies that don’t, get folklore: each employee privately deciding what’s ‘probably fine’, with accuracy exactly as good as that sounds.

The four categories that never go in

The red lines are easier to teach as categories than as rules, because categories travel to situations no rule anticipated. One: personal data about identifiable people — customers’ names with their purchase histories, employee records, anything that would be a problem under GDPR if disclosed. The test is simply: could this text be tied back to a living person who didn’t consent to being described to a third-party service? Two: confidential commercial information — unreleased financials, margins, pricing before launch, M&A activity, the precise terms of the client contract. If a competitor reading it would damage you, it doesn’t go in a public box. Three: anything covered by a promise — NDAs, client confidentiality clauses, the data-handling terms you signed with your own customers. Your promise doesn’t become weaker because the leak happened via chatbot. Four: security-sensitive material — credentials, keys, internal network details, the configuration of whatever keeps you safe. This category sounds obvious until someone pastes an error message containing an internal hostname at 6pm on a Friday.

Notice what’s not on the list: the general shape of your work. Describing a situation — ‘a B2B services company, about 40 staff, a client missed a payment and we’re deciding between a payment plan and a formal demand’ — carries almost none of the sensitive specifics while carrying nearly all of the useful context. That gap between the shape of a problem and the identifying details of a problem is where most safe AI work happens, and learning to work in it is a skill like any other: awkward for a week, automatic by the second.

Sanitisation: the working habit

Sanitising a prompt means stripping the identifying specifics while keeping the structure the model needs — and it’s easier to show than to describe. Unsafe: ‘Here’s our Q3 customer list [pasted]: draft a win-back email for the ones who haven’t ordered since March.’ Sanitised: ‘Draft a win-back email for B2B customers who ordered regularly last year but have gone quiet since March. Tone: warm, specific to what they used to buy, one clear offer. Industry: industrial supplies; typical customer: a procurement manager in her forties who hates being sold to.’ The second prompt produces an equal or better draft, because ‘specific to what they used to buy’ is an instruction the model can follow without ever seeing the purchase history — the personalisation happens when a human merges the draft with real data, inside your systems, where that data belongs.

Three habits make sanitisation fast. Summarise, don’t paste: turn the document into the description a colleague would need. Placeholder on the way through: where the real text must be worked on, strip names and numbers first, re-attach them after (‘replace [CLIENT] and [AMOUNT] with the real values’). Ask instead of paste: half the time you don’t need the model to see the data at all — you need it to write the formula, the template, the process, which you then apply to the data yourself. Each habit is fifteen seconds. The one-time cost of learning them is paid back the first time an incident doesn’t happen.

Tools and tiers: knowing what you’re holding

Not all AI tools handle data identically, and part of the taught boundary is knowing which tool you’re typing into. The major distinction is between consumer tiers (free or personal accounts, where terms may permit broader retention and use of inputs) and business or enterprise tiers (contractual data handling, retention controls, admin settings — and, in the case of tools inside your own Microsoft 365 tenancy, processing that stays within your permission boundaries). The practical company policy usually lands as: business tools within their contractual terms for ordinary work; consumer tiers treated as public space, with the sanitisation habits mandatory; and anything in the four red-line categories staying out of both, because the safest tier still doesn’t need your clients’ names to help you.

The settings deserve one explicit mention, because they’re where the free wins live: most major tools now offer opt-outs or controls for training on your inputs, chat-history retention limits, and admin policies for organisations. They are not prominently advertised, they change periodically, and an afternoon of someone responsible reading the current documentation and clicking the right switches is worth more than any amount of general caution. This is one of the things the safety module walks through on screen, because a setting you’ve never seen is a setting set to its default — and the default is not designed with your client list in mind.

The policy: one page, actually read

Habits need a backbone, and the backbone is a policy — but the policy that works is not the fourteen-page document nobody opens. The working artefact is one page: approved tools (which ones, which tiers); the four red-line categories in plain words; the sanitisation habit with one worked example; who to ask when unsure; and what happens if something goes wrong — which should be proportionate and aimed at early reporting, because the response to a mistake determines whether it’s reported at 6:10pm or never. The policy exists to be read by a new starter in three minutes and remembered under deadline pressure, which is a design constraint, not an accident of brevity.

Write it with the team, not at them: the fifteen minutes spent arguing about the boundary is the training. Then anchor it where the work happens — linked from the place staff actually start their AI tasks, mentioned when someone joins, revisited when a tool changes. A policy that lives only in the document management system protects nobody; a policy that lives in the onboarding checklist and the team chat protects everyone, quietly, continuously.

What good looks like afterwards

Companies that run this track well describe a noticeable shift in texture rather than any single dramatic event. People still use AI constantly — more than before, usually — but the questions change from ‘can I use this?’ to ‘which tool is right for this?’; the red-line categories become shorthand (‘that’s a category-two paste’); and the drafts that circulate internally show the sanitisation habits because the training taught them as craft, not compliance. The measurable artefacts are modest and real: a one-page policy with a recent date, tool settings configured deliberately, and — when a client or auditor asks how staff were prepared to handle data responsibly — a training record with names, dates and quiz scores, instead of a shrug.

That last item matters more each year. Demonstrating documented, checked training is becoming part of ordinary commercial hygiene — clients ask, insurers ask, and the answer ‘we sent round an email about it once’ is wearing thin. The full safety track lives across every module in the library (it opens ChatGPT Foundations and threads through all of them), with Reviewing AI Output completing the picture on the other side of the prompt box. If you take one thing from this guide, take the boundary: teach the four categories, write the one-page policy, and let the team work fast on the safe side of the line.