Using AI at work without leaking company data

Your team is already pasting emails, contracts and code into AI chatbots. Banning it just moves it to personal phones. Give them a safe way instead.

The policy I suggest fits on one page:

1. One or two approved tools, on a business plan, with training on your data switched off and company sign-in.
2. Never paste: passwords, API keys, customer personal data, health or payment data, anything under an NDA.
3. Swap names for placeholders before pasting. The answer is just as good.
4. A person reads the output before it goes to a customer, into production or into a contract.
5. One person to ask when someone isn’t sure.

Check each approved tool’s data terms once: is it used for training, how long is it kept, who can see it. It’s all written there.

For truly sensitive work, run an open model on your own server.

And if you connect an AI assistant to your email or files, give it the smallest access that works. It can read everything its account can read.