Small Town Sysadmin
Free CJIS checklist

AI guidesSafetyFor everyone9 min read

Using AI safely: what never to paste in, and setting workplace rules

What to keep out of AI chatbots, how to turn off training on your chats, why work should happen in work accounts, and a simple starting point for an office AI policy.

Last checked:

The biggest AI risk in most small offices isn’t a robot uprising. It’s someone pasting a customer list, a password or a confidential letter into a free chatbot to “clean it up.” This guide covers what to keep out, the settings that matter, and how to set simple rules for the office.

Why what you paste in matters

When you type into a chatbot, that text goes to the vendor’s servers. What happens next depends on the product and the kind of account:

  • It may be used to train future models. On the personal versions of ChatGPT, Gemini and Microsoft Copilot, conversations are used for training by default unless you turn it off. On Claude’s personal plans, it’s a setting you choose. (Details in the comparison guide.)
  • People may read it. Google says some Gemini chats are reviewed by humans, and asks users not to enter anything confidential they wouldn’t want a reviewer to see.
  • It’s stored. Gemini keeps activity for 18 months by default, and personal Copilot keeps conversation history for 18 months, unless you delete it or change the setting.
  • It can leak sideways. Features that remember past chats, connect to your email or files, or share conversations by link all widen who and what can see your data.

Never paste these into a chatbot

Unless your organization has approved a specific tool and account for that kind of data, keep these out entirely:

  • Passwords, PINs, two-step sign-in codes, recovery codes, API keys and private keys. No legitimate task needs them.
  • Personal identifiers: Social Security numbers, driver’s license numbers, dates of birth tied to names.
  • Financial data: account and card numbers, customer balances, loan details.
  • Health information about anyone.
  • Criminal justice information or anything pulled from law-enforcement systems. Those rules apply to any system the data touches; ask your CJIS Systems Agency before using AI anywhere near it.
  • Personnel matters: discipline, medical leave, investigations, salaries.
  • Anything under a contract or confidentiality agreement, including client and vendor documents.
  • Security details: firewall configs, network diagrams, public IP addresses, and vulnerability scan results.

A good test: if you wouldn’t post it on the break-room bulletin board or email it to a stranger, don’t paste it into a personal AI account.

Safer ways to get the same help

  • Strip it first. Replace real names, numbers and addresses with placeholders like “Customer A” or “123-45-XXXX” before pasting. You still get the rewrite or the summary.
  • Turn off training on personal accounts. In ChatGPT: Settings → Data controls → Improve the model for everyone. In Gemini: turn off Keep Activity. In Copilot: Privacy → Training on conversation activity (and voice). In Claude: Settings → Privacy, model improvement setting.
  • Use temporary or incognito chats for one-off questions. ChatGPT’s Temporary Chat and Claude’s Incognito chats aren’t used for training (though vendors may keep them briefly for safety).
  • Do work in work accounts. Business versions such as ChatGPT Business, Claude Team or Enterprise, Google Workspace with Gemini, and Microsoft 365 Copilot Chat signed in with a work account say they don’t train on your organization’s data by default, and they give your administrator control over settings, retention and who has access.
  • Be careful with add-ons. Browser extensions, meeting note-takers and “connect your email” features can see far more than a single chat. Only connect what you need, and tell people before an AI note-taker joins a meeting.

Setting workplace rules

Even a one-page AI policy beats none, because right now people are already using these tools on their own. A practical starting point covers:

  1. Approved tools and accounts. Which assistants staff may use for work, and that work happens only in work accounts the organization controls.
  2. Off-limits data. The “never paste” list above, adjusted for your office.
  3. Human review. A person reads and takes responsibility for anything AI-assisted before it goes to a customer, the public, a court, a regulator or the board.
  4. Accuracy. Facts, figures, citations and legal or medical statements get checked against the original source.
  5. Disclosure. When to tell people AI was used, if your industry, courts or customers expect it.
  6. Agents and automation. AI tools that can send email, change records or spend money need specific approval and limited permissions.
  7. Who to ask. One named person for questions, and a way to report a mistake (like pasting the wrong thing) without fear, so it can be cleaned up quickly.
  8. Review date. Revisit the policy every six months; the tools change that fast.

Regulated offices should check with their own authorities. Law-enforcement agencies should confirm with their CJIS Systems Agency, banks with their examiners and compliance staff, and anyone handling health records with their privacy officer. This guide isn’t legal or compliance advice.

For organizations that want a deeper framework, NIST’s voluntary AI Risk Management Framework organizes AI risk work into four functions (Govern, Map, Measure and Manage), and its Generative AI Profile lists specific risks such as data privacy, information security and over-reliance on AI output.

If something sensitive already got pasted in

  1. Don’t panic, and don’t hide it.
  2. Delete the conversation in the app. OpenAI and Anthropic say deleted chats are removed from their systems within 30 days; check your tool’s policy.
  3. If it was a password, key or code, change it now.
  4. Tell whoever handles IT or compliance, so they can decide whether anything else needs to happen.

Sources

Last checked October 3, 2026. AI products change quickly, so this guide is re-checked against official sources every month.

Back to the AI guides