Before you paste that document into an AI chatbot

You want a quick summary, so you drag a document into a chatbot. The file may contain more than the paragraphs you care about: customer details, internal prices, private comments or identifying information in a screenshot.

A useful privacy check happens before the upload. Once information has been sent, deleting the conversation may not mean every copy is immediately removed from every system.

Identify the information, not just the filename

A file called “meeting notes” could be harmless or highly sensitive. Read what it contains. Look for passwords, API keys, identity documents, financial account details, private health information and confidential work material.

Also consider combinations of details. Removing a person's name may not make a document anonymous if their employer, job title and a distinctive event still identify them.

If the file belongs to an employer or client, follow their approved-tool policy. Having access to a document does not necessarily mean you have permission to send it to another service.

Reduce the task before sharing the data

Ask whether the model needs the whole file. If you only want help improving a paragraph's structure, a short excerpt with fictional details may be enough.

Replace sensitive values with meaningful placeholders such as CUSTOMER_A or INTERNAL_PRICE. Keep the relationship between the values when that relationship matters. If the task is checking arithmetic, explain that you changed the numbers and ask for the method rather than pretending the example is a real record.

Do not call this guaranteed anonymization. It is a way to reduce unnecessary exposure.

Check the exact service and account

Different products, subscription tiers and organizational accounts may handle information differently. Review the current terms for training use, retention, sharing and deletion.

Look for controls that apply to the actual feature you are using. A chat setting may not explain the behavior of a connected third-party tool, a shared link or an uploaded file.

If the wording is unclear and the information is sensitive, use an approved alternative or avoid uploading it. A reassuring product label is not a complete data-handling policy.

Think about connected tools

Some AI services can access drives, calendars or other applications after you grant permission. Review the scope before connecting them.

Ask what the assistant can read, what it can change and how to revoke access. A task that needs one document should not automatically become a reason to connect every folder you own.

Public sharing is another separate action. Before sharing an AI conversation, check the visible prompt, attached material and generated answer for information you did not intend to publish.

If you pasted a secret by mistake

For a password, API key or other credential, deleting the chat is not enough. Revoke or rotate the exposed credential through the relevant service and review any applicable incident process.

For work information, tell the appropriate contact rather than trying to quietly repair everything alone. Preserve enough detail to explain what was shared and with which service, without spreading it further.

Useful AI work does not require maximum disclosure. Start with the smallest safe input that can answer the question, and expand only when there is a clear reason and appropriate permission.