TL;DR:
Check your company's rules before you use any AI tool with work material. They override anything a tool promises.
Do not paste secrets, personal details about other people, or confidential files. Replace them with placeholders.
Give a tool the least access that does the job, and turn that access off when you finish.
Your manager asks you to clean up a customer complaint email before it goes out. The easy move is to paste the whole message into an AI tool and say "make this polite". But the message includes the customer's full name, address, order number and a phone number. In two seconds you have copied personal data into a place your company may not have approved.
Most data mistakes at work are not clever attacks. They are quick, helpful, one second decisions. A few habits remove most of the risk.
The short answer
Treat anything you paste, upload or show on screen as something you are handing to another party. Before you do, ask three questions. Am I allowed to use this tool for this material? Is there something in here I should not share? Could I get the same help with less?
Start with company rules
Your employer decides which tools are acceptable for which kinds of information, often in an acceptable use policy or an IT page. Those rules come before any feature list or privacy claim. A tool can be perfectly safe in general and still not approved for client data at your company.
Look for a written policy on AI tools, usually from IT, security or legal.
If there is none, ask your manager or IT before using one with work material.
If the answer is unclear, assume the strictest reading until someone says otherwise.
Schools and clubs work the same way. The organization that owns the material sets the rule.
What happens step by step when you share something
You paste, upload or show it. The content leaves the app you were in.
It is processed, often on a remote computer, which is why most assistants need a connection.
It may be stored, for some period, depending on the product and its settings.
Others may be able to see it, for example an administrator of a work account.
You usually cannot take a paste back. The safest moment to protect data is before step 1.
Walk-through: what not to paste or show
Take the complaint email. Here is a sensible way to work through it, using a made-up message.
Hi, this is Dana Whitfield, 14 Orchard Lane, order 55012. My phone is 555-0142.
The lamp arrived broken and nobody called me back. Fix this today.Piece | Keep it? | Why |
|---|---|---|
Dana Whitfield, 14 Orchard Lane | Replace with [name] and [address] | Personal data about someone else; the rewrite does not need it |
Order 55012 | Replace with [order number] | Links to an account |
Phone 555-0142 | Remove | Contact details are not needed to fix the tone |
The complaint itself (lamp broken, no callback) | Keep | This is the actual job |
After the swap the tool sees "Hi, this is [name], [address], order [order number] ... The lamp arrived broken and nobody called me back." It can still improve the tone, because the tone has nothing to do with the real name. You then put the real details back in by hand. The help is the same and the exposure is far smaller.
Check by counting. The original had 4 identifying items (name, address, order, phone). The version you pasted has 0. If you cannot get that number to zero for a task, that is a sign the job needs an approved tool or no tool.
Sensitive data to keep out by default
Passwords, keys, access tokens and one-time codes.
Personal details about customers, coworkers or students.
Financial records, contracts and anything marked confidential.
Unreleased plans, source code and internal documents, unless a tool is approved for them.
Health or legal matters about a person.
The same goes for what you show on screen. If a tool can see your screen, close the windows that hold any of the above first.
Least access and what it can't do
Least access means giving a tool only what the job needs, and only while it needs it. Use a single document instead of a whole drive. Use one browser tab instead of everything open. Turn off screen access when you are done.
There are limits to what any habit can do. Redaction is easy to get wrong, because names hide in file names, footers and image text. A tool's promise to delete data cannot be verified by you. And no checklist replaces your company's rules.
No substitute for advice: This article is general guidance, not legal or security advice. For compliance questions, ask your company's IT, security or legal team.
Privacy and control
Prefer tools that act only when you ask. For example, DuckyHelper only listens or looks while the pill is open, is built to ask before it sends or pays, and is built not to type your passwords or card numbers. Those controls help, but they do not remove your own responsibility to keep sensitive material off the screen.
Also look for the controls that you own: a way to delete your history, a clear statement of what is stored, and the ability to switch off features you do not use.
Try it yourself
Take one real task from this week and run the three questions on it. Which tool, which material, how much access? Write down the rule you would follow next time. If you are a student, the same exercise applies to school work: see academic honesty and AI: following your school's rules.
If you are worried about what a tool does after the internet trip, read why most AI assistants need an internet connection.
Frequently asked questions
Is it okay if I delete the chat afterwards?
Deleting your copy may not remove everything the service kept. Decide what to share before you share it.
What if my company has no AI policy?
Ask. Until you get an answer, keep confidential and personal material out of any AI tool.
Does a private mode make everything safe?
No. It may change what is saved, but your content still gets processed. The redaction habit still applies.
Get started
