Don't paste that.

Why it matters

When you paste something into a public AI tool, it leaves your company. Depending on the tool and its settings, your text may be stored on someone else's servers, reviewed by humans, or used to train future models.

There is no unsend. A prompt is a disclosure.

The rule

Never paste

• Customer & employee data — names, emails, IDs, account numbers, anything about a real person
• Credentials & keys — passwords, API keys, tokens, connection strings
• Source code & internal docs — proprietary code, roadmaps, strategy decks
• Contracts & financials — agreements, pricing, unreleased numbers
• Health & legal records — anything covered by HIPAA, GDPR, or privilege

Do this instead

1. Redact first. Replace real names, numbers, and identifiers with placeholders. The AI helps just as well with [CUSTOMER] as with the real name.
2. Use approved tools. If your company provides an enterprise AI with data protections, use that one — not your personal account.
3. Ask before you guess. Not sure if something is sensitive? That's the signal. Ask your security or compliance team.

Go deeper

If this page made you uneasy about how AI is actually being used where you work, that instinct is worth following. Golonex writes about exactly this.

• Shadow AI: The Compliance Risk Nobody Put on the Risk Register Staff are already using AI you never approved. Here's how to find it and contain it. golonex.com
• India's DPDP Act Meets Enterprise AI What happens to personal data when your AI stack crosses borders. golonex.com
• The Definitive EU AI Act Glossary: 20 Terms Every Business Must Know Plain-language definitions, without the statutory fog. golonex.com
• ISO 42001 Isn't Compliance — Here's What It Actually Buys You The gap between certification and actually being legally covered. golonex.com
• All posts on AI governance, privacy and compliance The full Golonex blog. golonex.com

Spread the word

Saw someone about to paste a contract into a chatbot? Don't lecture — just send the link.

Or post a picture instead. There's a set of free share images — squares for LinkedIn and Slack, a wide one for link cards, and a badge you can use as your profile picture. No sign-up, no attribution.