Is it safe to put company data into ChatGPT or other AI chatbots?
Short answer
Only if your organization has approved the tool and its data terms for that kind of data. Consumer AI accounts may keep conversations and, depending on settings and terms, use them to improve models. Business plans often offer stronger data controls, but you need to check the provider’s current terms.
The details
A simple rule works for most teams: no customer personal data, credentials, source code or confidential documents in any AI tool that has not been approved for it. Write this into an AI acceptable use policy and give staff an approved alternative, or they will use unapproved tools anyway.
What to do
- Check whether the tool is on your approved list.
- Read the provider’s data retention and training terms.
- Remove names, account numbers and secrets before pasting.
- Use business accounts with admin controls for work.
Terms explained
- Shadow AI
- Shadow AI is the use of AI tools inside an organization without approval or oversight from IT, security or compliance.
Sources
Related questions
Related Guides
GuideAI Security
9 Rules for Safe Use of Generative AI at Work
Discover nine practical rules for the safe use of generative AI at work. Protect company data, verify model outputs, and establish clear operational controls.
Read more GuideAI Security
10 LLM Security Risks Every Team Should Understand
Examine the top 10 LLM security risks affecting modern applications and learn concrete defensive controls to safeguard your data, models, and infrastructure.
Read more GuideAI Security
AI Agent Security: Implementing Least Privilege for Tools
Learn how to enforce least privilege for AI agent security. Control tool calling, scope data access, and prevent unauthorized actions in production.
Read more GuideAI Security
How to Deploy a Secure AI Chatbot for Small Business
Learn how to configure, test, and run a secure AI chatbot for your small business. Protect customer data, prevent prompt injection, and limit model access.
Read more