Don't paste that.

Why it matters

When you paste something into a public AI tool, it leaves your company. Depending on the tool and its settings, your text may be stored on someone else's servers, reviewed by humans, or used to train future models.

There is no unsend. A prompt is a disclosure.

The rule

Never paste

Each of these has its own page — what counts, what actually happens, and what to do instead.

• Customer & employee data — names, emails, IDs, account numbers, anything about a real person→
• Credentials & keys — passwords, API keys, tokens, connection strings→
• Source code & internal docs — proprietary code, roadmaps, strategy decks→
• Contracts & financials — agreements, pricing, unreleased numbers→
• Health & legal records — anything covered by HIPAA, GDPR, or privilege→

Do this instead

1. Redact first. Replace real names, numbers, and identifiers with placeholders. The AI helps just as well with [CUSTOMER] as with the real name.
2. Use approved tools. If your company provides an enterprise AI with data protections, use that one — not your personal account.
3. Ask before you guess. Not sure if something is sensitive? That's the signal. Ask your security or compliance team.

Spread the word

Saw someone about to paste a contract into a chatbot? Don't lecture — just send the link.

Or post a picture instead. There's a set of free share images — squares for LinkedIn and Slack, a wide one for link cards, and a badge you can use as your profile picture. No sign-up, no attribution.