Yes, once the names, addresses and numbers are out of the document. Until then, pasting a client's file into a chatbot means disclosing it to a third party.
Two different questions
"Is it safe?" usually covers two questions. The first is whether the provider will leak or misuse your content. That depends on their security. The second is whether you may send it at all. That depends on your contracts, your regulator and your profession.
You have little control over the first. You have full control over the second, and it is the one with consequences. A provider with perfect security does not give you the right to share someone else's personal data.
What Samsung did
In May 2023, Samsung restricted the use of generative AI tools inside the company. A data leak had happened the month before. Nobody was hacked. Employees used an approved tool on documents they were allowed to see. The problem was that the data was sent out at all.
What decides it
1. What the document contains
A blog draft, a public filing or your own notes are fine to paste. A signed contract, a medical record, a CV or a bank statement contains personal data about people who never agreed to share it.
Documents rarely show this at first glance. A spreadsheet may have names and salaries in one column. A reused template may still carry the previous client's address. Assume a real document contains identifiers until you have checked.
2. Which account receives it
According to OpenAI's published terms, consumer accounts may use your conversations to train future models unless you change the settings. Team, Enterprise and API accounts are not used for training by default.
This only applies if you are actually on that account type, with those settings. The terms can also change. And even the best account type only controls what the provider may do with your text. It does not change the fact that the text has left your hands.
3. What you owe the people in the file
Most confidentiality agreements forbid sharing the other party's material with third parties, and an AI provider is a third party. Lawyers, doctors, accountants and recruiters also have professional duties of confidentiality. A vendor's privacy policy does not relieve you of them.
In Europe and the UK, data protection law adds another layer. You are the controller and the AI provider is your processor. You need a lawful basis for sending the data, and normally a written processing agreement, before the first document goes out. We explain what is at stake in what you risk when you paste client documents into a chatbot.
What happens after you paste
The text goes to the provider's servers, where it is stored, at least for a while, and processed. Depending on your account, it may be kept for a set period, checked by a human reviewer, or used for training. Even with training turned off, it is now on systems you do not control.
A ten-second check
- Whose data is this? If it is not only yours, slow down.
- Does it contain identifiers? Names, addresses, account numbers, dates of birth, ID numbers.
- Am I allowed to share it? Check the contract and your professional rules, not the vendor's policy page.
- Does the AI need the real names to help me? Almost never.
If the answer to the last question is no, the first three stop mattering.
Remove the identifiers first
To summarise a contract or draft a reply, the AI needs the content and the structure. It does not need to know that the other party is Acme GmbH at Friedrichstrasse 123 in Berlin. So remove those details before the text leaves your machine.
With promptShield, a name becomes a code such as [P0ABCD] and an address [A1WXYZ]. The first letter shows the type of data. You paste the coded version, get your answer, and switch the codes back to the real values on your own computer. Inside one folder, the same value keeps the same code, so the AI can still follow who is who across your documents. The details are in reversible redaction, explained.
After that, the difficult questions about account types, contracts and retention no longer apply. No personal data was sent.
So it is safe to paste documents into ChatGPT, provided you anonymize them first. promptShield does this on your own machine.
Frequently asked questions
Does a ChatGPT Enterprise account make it safe to paste client data?
Only partly. Enterprise and API accounts are not used for training by default. But they do not give you the right to share someone else's personal data, and they do not override a confidentiality agreement or a professional duty.
If I delete the conversation, is the upload undone?
No. Deleting removes the chat from your history and, under most providers' policies, from their systems after a set period. The data was still sent, and copies may remain in backups.
Is pasting the text safer than uploading the file?
The text leaves your machine either way. Uploading the file is often worse: it can also contain author details, tracked changes, comments and hidden columns.
Does this apply to Claude and Gemini too?
Yes. It applies to every AI service hosted by a third party. The solution is the same: remove the identifiers before you send.