What is safe to paste into AI at work

What it is good at

• Gives a single test you can apply in seconds instead of memorising a long banned list.
• Separates personal-account risk from business-tier protections most people never check.
• Covers the categories that actually cause real incidents: client data, source files and credentials.
• Includes a redaction habit that keeps the useful part of a question while removing the risky part.

Where it falls short

• No AI tool's terms of service are a substitute for reading your own employment contract or client NDA.
• "Enterprise" data protection claims vary between vendors and change over time, so verify the current agreement rather than relying on marketing pages.
• A redacted prompt can sometimes still be identifiable from context even with names removed.

How to use it for creative work

1. 01

   Run the stranger test

   Before pasting anything, ask: would I be comfortable if this text were read aloud by a stranger at a networking event? If not, it does not go into a public AI tool, full stop.

2. 02

   Separate the question from the sensitive detail

   Rewrite the request in generic terms first. "Rewrite this client email" becomes "rewrite this email" with the client's name replaced by [Client] and figures replaced by [Amount] before you paste it.

3. 03

   Check which tier you are actually on

   A personal ChatGPT Plus, Gemini or Claude account is not the same product as ChatGPT Enterprise, Gemini for Workspace or Claude for Work. Ask your employer which tier is licensed and what its data agreement says before assuming business-grade protection.

4. 04

   Never paste credentials or keys

   Passwords, API keys, licence codes and access tokens should never be typed into a chat window to "debug" or "format" them, treat this the same as you would sending them in an unencrypted email to someone outside the company.

5. 05

   Put it in writing for your team

   A one-paragraph written rule beats a verbal understanding. State which tools are approved, what may never be pasted, and who to ask when someone is unsure, then share it with anyone who touches client work.

Ready-to-use prompts

Read this text and rewrite it with every client name, company name, dollar figure, date and personal detail replaced with a generic placeholder in [brackets], so I can safely ask an AI tool a question about the structure without exposing the specifics: [paste text].

I have a real workplace problem involving [describe situation without names]. Treat this as hypothetical and give me three ways to approach it, without me providing any names, figures or identifying details.

Write a five-line "what not to paste into AI" rule for a [design studio / marketing team / small agency], written plainly enough that a new hire understands it in one read.

Explain, in plain terms, the practical difference between a personal AI subscription and a business or enterprise tier from the same company, specifically around whether my inputs are used for training and who can access them.

I think a colleague may have pasted client data into a public AI chat by mistake. Draft the calm, factual message I should send to my manager or client explaining what happened and what we are doing about it.

Questions people ask

Is it ever fine to paste a client's brief into ChatGPT?

Only if your contract with that client permits sharing their material with third-party tools and the AI tool's data terms match what you have promised the client, check both before pasting, not after.

Does an NDA cover AI tools?

Most NDAs were written before AI tools existed and their wording on "third parties" or "disclosure" may or may not cover them; this is a question for whoever drafted or signed the NDA, not a guess.

What should I do if I already pasted something sensitive?

Delete the conversation from your account, turn off training in settings if you have not already, and tell whoever is responsible for that data (your manager, client or DPO) rather than staying quiet about it.