Before entering information into an AI chatbot, check whether the prompt contains another person’s data, employer information, authentication material or documents governed by specific rules.
The safest useful prompt contains the minimum information required for the task.
Never paste credentials
Keep these out of prompts:
- passwords;
- API keys;
- access tokens;
- private encryption keys;
- recovery codes;
- session cookies;
- database connection strings;
- secret URLs that grant access;
- complete payment-card details.
If a credential has been pasted, treat it as exposed. Revoke or rotate it through the relevant service. Deleting the conversation is not a substitute for changing the secret.
Personal data needs a reason and authority
Do not upload passports, medical records, payslips, school records, customer lists or private messages unless the use is authorised, necessary and covered by an appropriate approved system and agreement.
Redacting a name may not anonymise a document. Address, employer, dates, rare diagnoses, account numbers and narrative details can identify a person when combined.
If the task is to improve a letter, replace the real details with explicit placeholders:
[CUSTOMER_NAME][ACCOUNT_REFERENCE][DATE][MEDICAL_DETAIL REMOVED]
Restore the values locally after the text is produced.
Redact by category, then check the combination
| Real detail | Safer prompt substitute | Keep locally for final assembly |
|---|---|---|
| Full name and customer number | [CUSTOMER], [REFERENCE] | Name-to-reference mapping |
| Exact address and appointment time | [CITY], [DATE], [TIME] only if needed | Full address and schedule |
| Medical record text | A minimal synthetic example, where permitted | Original record in the approved clinical system |
| Production log with tokens and hostnames | Sanitised error message and invented hostnames | Original restricted log |
| Contract with prices and party names | Relevant clause with placeholders | Signed original and negotiation context |
After replacing obvious identifiers, read the prompt again. A rare job title, small town, exact date and unusual event can identify someone even when the name is gone.
Employer and client data require authorization
Confidential material includes more than documents labelled “confidential.” Examples:
- unreleased financial results;
- contracts and negotiation positions;
- internal incident reports;
- customer support exports;
- source code from private repositories;
- vulnerability details;
- product roadmaps;
- meeting transcripts;
- candidate and employee records.
Check the organisation’s AI policy and approved tools. A personal paid account is not automatically approved for company data.
Source code can contain secrets without looking secret
Before sharing code, inspect configuration files, comments, logs, test fixtures and example payloads. Remove:
- real hostnames and internal IP addresses;
- tokens and signed URLs;
- customer data copied into tests;
- proprietary algorithms not needed for the question;
- stack traces containing file paths or user names;
- repository history embedded in patches.
Create a minimal reproducible example with synthetic data. It often produces a better technical answer because the actual problem is isolated.
Understand the product settings
Different AI services, plans and enterprise agreements can handle prompts differently. Check current official documentation for:
- whether prompts are retained;
- whether data may be used for model improvement;
- available opt-out controls;
- administrator access;
- geographic processing or storage commitments;
- deletion behaviour;
- connected apps and tools;
- contractual protections for business use.
Do not rely on a screenshot or a blog written for a different plan. Settings and contracts change.
Connected AI can expose more than the prompt
An assistant connected to email, cloud storage, a code repository or company chat may retrieve information automatically. The risk is no longer limited to what was pasted manually.
Review:
- which accounts are connected;
- which folders, repositories or mailboxes are in scope;
- whether the assistant can take actions;
- which plugins or tools receive data;
- whether retrieved content can contain malicious instructions;
- what activity is logged.
Grant the smallest useful access and remove connections that are no longer needed.
Use a reduction pass
Before submitting a prompt, ask:
- Can the task work with invented data?
- Can names and identifiers be replaced?
- Can only the relevant paragraph or function be shared?
- Is this my information to disclose?
- Is this tool approved for the data class?
- What happens if the prompt is retained or reviewed?
If the answer is uncomfortable, process the information locally or use an approved environment designed for it.
If sensitive data was already shared
Act according to the data:
- rotate exposed credentials immediately;
- use the product’s deletion controls;
- notify the relevant security, privacy or legal contact at work;
- follow breach or incident procedures;
- document what was shared and when;
- report the event through the appropriate process rather than delaying action.
For another person’s data, the decision is not solely yours. Reporting quickly can limit harm.
The practical rule
CISA advises avoiding sensitive or confidential information in AI systems. A useful everyday version is:
If the task still works after replacing the real data, replace the real data.
AI is a processing tool, not a private notebook by default.
