The short answer
Using AI at work can be safe, and whether it is comes down to four checks you can run before you paste: which provider, which product tier, which settings, and what agreement your employer has with the provider. The same brand of assistant can use your conversations to train models on a free personal account and be contractually barred from doing so on a business account.
Two statements you will read online are both wrong. "ChatGPT trains on everything you enter" is false for business, enterprise and API use, and can be switched off for personal use.1 "AI companies can't see your data" is also false: consumer products may retain conversations, use them for training, and in some cases have them read by human reviewers, and a court order in 2025 temporarily overrode a deletion promise.518
The rule that holds regardless of provider is the one New Zealand's Privacy Commissioner gives: do not put personal or confidential information into a generative AI tool unless the provider has explicitly confirmed it is not retained or disclosed.22 Below is what each provider currently says, what has actually gone wrong, and a decision framework for what to paste and what to hold back.
What actually happens when you send something to an AI service
When you type into a chat assistant, the text does not stay on your device. It travels, encrypted in transit, to the provider's servers, where a model processes it and generates a reply. What happens next depends on the product. There are six things that can happen to your input after that, and they are separate: a provider can do some without doing others.
| What can happen | What it means | Where it applies |
|---|---|---|
| Logging and retention | The conversation is stored for some period, whether or not you can see it in your history. | Almost everywhere. Consumer chat history is kept until you delete it. Even "temporary" modes may keep a copy for a limited period. Enterprise tiers let administrators set retention.23 |
| Model training | Your conversations are used as data to improve future models. | Default on for some consumer products, with an opt-out. Off by default for business, enterprise and API products at the major providers.1101519 |
| Human review | People employed by the provider or its contractors read a sample of conversations, for quality, safety or training purposes. | Google states this plainly for consumer Gemini. OpenAI's policy refers to monitoring content for safety. Enterprise products generally exclude routine human review.18714 |
| Sharing with sub-processors | The provider uses other companies for hosting, cloud infrastructure and support, and your data passes through them. | Universal. OpenAI's privacy policy lists vendors and service providers including hosting and cloud services.7 |
| Legal holds and disclosure | A court, regulator or law enforcement requires the provider to keep or hand over data, overriding normal deletion. | Happened in 2025: OpenAI was ordered to preserve consumer and API output logs for several months during litigation.5 |
| Security incidents | A bug, misconfiguration or attack exposes data to people who should not see it. | Has happened at least twice at OpenAI and once in Microsoft 365 Copilot, detailed below.8928 |
The distinction people most often miss is between the second and the first. "We do not train on your data" is a promise about training. It is not a promise that nothing is stored, that nobody can see it, or that it will be deleted on a schedule you control.
Consumer versus business: the distinction that matters most
Every major provider now runs two regimes. The consumer regime is what you get when you sign up with a personal email. The business regime is what your employer gets when it buys licences. The table below records what each provider's own documentation said when we read it, with the date shown on the page. These pages change; check the current version before relying on a detail.
| Provider | Consumer product | Business, enterprise or API product | Page last updated |
|---|---|---|---|
| OpenAI (ChatGPT) | Training: ChatGPT "improves by further training on the conversations people have with it, unless you opt out". Opt out in Data Controls. Temporary Chats are not used for training, do not appear in history, but "for safety purposes we may still keep a copy for up to 30 days".12 Memory can store details from chats unless turned off.6 | "By default, we do not train on any inputs or outputs from our products for business users, including ChatGPT Business, ChatGPT Enterprise, and the API." Workspace administrators control retention on Enterprise, Edu and Healthcare; deleted conversations are removed within 30 days unless legally required to be kept. API abuse-monitoring logs are kept for up to 30 days, with zero data retention available on approval.134 | Help article August 2026; enterprise privacy page January 2026. |
| Anthropic (Claude) | Since late 2025 consumers choose whether conversations are used to improve models. Choosing yes extends retention to five years; choosing no keeps the existing 30-day retention. Deleted conversations are removed from back-end systems within 30 days. Flagged or reported conversations may still be used for safety.1011 | The commercial terms state "Anthropic may not train models on Customer Content from Services", and that the customer retains rights to inputs and owns outputs. Applies to Claude for Work, Government, Education and API use, including through third-party clouds.12 | Privacy policy effective July 2026; commercial terms June 2025. |
| Microsoft (Copilot) | Microsoft's privacy FAQ says it uses data from Copilot and other consumer services for AI training, except for certain categories of users and those who opt out.17 | For work and school (Entra ID) accounts: "Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs." Prompts and responses are processed within the Microsoft 365 service boundary, stored encrypted, and subject to retention policies administrators set in Purview. Copilot only surfaces organisational data the user already has permission to view. Microsoft states Copilot has opted out of the human-review abuse monitoring available in Azure OpenAI.141516 | Documentation dated May to August 2026. |
| Google (Gemini) | Activity is kept for 18 months by default, adjustable to 3 or 36 months or indefinite. "Human reviewers (including trained reviewers from our service providers) review some of the data we collect", and reviewed chats "are retained for up to three years" even after you delete your activity. Google's instruction: "Please don't enter confidential information that you wouldn't want a reviewer to see or Google to use to improve our services."18 | For Google Workspace: "Your content is not human reviewed or otherwise used for Generative AI model training outside your domain without permission" and "Your interactions with Gemini stay within your organization." Retention is administrator-controlled.19 | Both hubs updated August 2026. |
"Not trained on" is not "not stored"
Three details show why the training question is only part of the picture.
Temporary and incognito modes reduce retention; they do not remove it
OpenAI's Temporary Chat keeps conversations out of your history, out of memory and out of training, but the provider "may still keep a copy for up to 30 days" for safety.2 If a custom GPT with third-party actions is involved, data sent to those third parties is governed by their policies and may be kept longer.2 Anthropic's incognito chats are excluded from model improvement but are still processed by the service.13
Memory features keep things you may have forgotten you said
OpenAI's memory documentation states that sensitive information may appear in memory if you share it, that fully deleting something ChatGPT knows about you requires deleting every source it appeared in, including past and archived chats and files, and that turning memory back on later may create new memories from older chats still in your history.6 In enterprise regulated workspaces, memory is disabled by default.6
A court can override a deletion promise
In May 2025, during litigation brought by The New York Times, a United States court ordered OpenAI to preserve consumer ChatGPT and API output logs that would otherwise have been deleted. OpenAI's own account states the order affected Free, Plus, Pro and Team subscribers and API customers without a zero-data-retention agreement, and did not affect ChatGPT Enterprise or Edu. The obligation ended on 26 September 2025, after which normal 30-day deletion resumed, but OpenAI says it will "securely store limited historical April to September 2025 user data" under legal hold, accessible only to a small audited legal and security team.524
The lesson is not that OpenAI behaved badly; it complied with a court. The lesson is that a provider's deletion schedule is a policy, and policies yield to law. Anything you would not want preserved for a lawsuit you are not party to should not go into a consumer tool.
Security incidents versus ordinary processing
It helps to separate two kinds of risk. Ordinary processing is what the provider does on purpose and tells you about: retention, training, review. Incidents are what happens when something breaks. Both are real. Ordinary processing is the larger everyday exposure, because it happens to every conversation. Incidents are rarer, and the recent ones point at a new category of risk.
- March 2023, OpenAI. A bug in an open-source library let some users see the titles of other users' chat histories, and possibly the first message of a new conversation. For about 1.2 percent of ChatGPT Plus subscribers active in a nine-hour window, another user could have seen their name, email address, payment address, card type and the last four digits of their card. Full card numbers were not exposed. OpenAI published a post-mortem.8
- April 2023, Samsung. Engineers uploaded internal source code to ChatGPT. Samsung temporarily restricted generative AI tools on company devices, citing the difficulty of retrieving or deleting data held on external servers.27 This was not a provider failure; it was ordinary processing applied to information that should never have been entered.
- August 2025, OpenAI. A "make this chat discoverable" option on shared links resulted in thousands of shared conversations being indexed by search engines. OpenAI's chief information security officer called it a short-lived experiment that "introduced too many opportunities for folks to accidentally share things they didn't intend to", and removed it.9
- June 2025, Microsoft 365 Copilot ("EchoLeak", CVE-2025-32711). Researchers disclosed a vulnerability that allowed an attacker to extract data from a user's Microsoft 365 environment by sending a single crafted email, with no click required: the assistant read the email and followed instructions hidden in it. Microsoft patched it, and no customers were known to be affected.28
- August 2024, Slack AI. Security researchers showed that instructions planted in a public Slack channel could cause Slack's AI assistant to leak data from private channels when a user asked it an unrelated question.30
What regulators and security agencies say
Guidance from official bodies converges, and it converges on the individual worker, not only the organisation.
New Zealand's Office of the Privacy Commissioner states that the Privacy Act 2020 applies to everyone using AI tools in New Zealand, including individuals, and that the security principle covers "prompts and training data".23 Its guidance notes that team members informally supplying text prompts to third-party providers is itself a form of information sharing, that some AI coding tools "have been known to suggest real passwords and API keys found in training data", and that organisations may need breach response plans to cover AI use.23 Its core expectation for generative AI: "Do not input into a generative AI tool personal or confidential information, unless it has been explicitly confirmed that inputted information is not retained or disclosed by the tool provider."22
Australia's privacy regulator recommends that organisations "do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, due to the significant and complex privacy risks involved".25 The United Kingdom's National Cyber Security Centre warned in 2023 that queries to public models are visible to the provider and are stored, and recommended not including sensitive information in queries to public tools and understanding the terms of use first.26 That advice predates the business-tier no-training defaults, which is exactly why the tier matters. The United States standards body NIST lists data privacy among twelve generative AI risks, including leakage of personal information and the tendency of models to memorise and reproduce sensitive data from training.29
And the guidance is being ignored at scale. In the 2025 KPMG and University of Melbourne study of over 48,000 people in 47 countries, almost half of employees admitted using AI in ways that broke company policy, including uploading sensitive company information into free public tools.32 Security vendors that monitor corporate data flows report similar patterns: one 2026 vendor analysis found around 40 percent of data movements into AI tools involved sensitive data and that roughly a third of ChatGPT use ran through personal accounts.33 Vendor research has an interest in the result, but the direction is consistent with the independent survey.
Information you should pause before pasting
Regulators, provider terms and the incident record point to the same categories. "Pause" does not always mean "never"; on an approved enterprise tool with the right agreement, some of these are exactly what the tool is for. It means stop and check which regime you are in first.
| Category | Concrete examples | Why it matters |
|---|---|---|
| Personal information about other people | Customer records, staff details, tenant files, student names, a colleague's performance issue, a complaint containing someone's circumstances. | Privacy law applies to you as the person entering it. The Privacy Commissioner's expectation is explicit confirmation of no retention or disclosure before any personal information goes in.2223 |
| Health, financial and other sensitive information | Medical notes, insurance claims, credit details, information about children. | Regulators single out sensitive information for the highest caution.25 Health information carries its own rules in most countries. |
| Credentials and secrets | Passwords, API keys, access tokens, connection strings, anything in a configuration file. | Models have reproduced real credentials from training data.23 A pasted secret is a leaked secret. |
| Source code and proprietary methods | Internal code, algorithms, formulas, product designs, unreleased features. | This is what Samsung's engineers pasted.27 On a consumer account it may be retained and used for training. |
| Unreleased financial and commercial information | Results before announcement, pricing strategy, acquisition targets, board papers, bids and tenders. | Retention plus legal holds means information can outlive its embargo in places you do not control.5 |
| Legal, HR and employment matters | Draft disciplinary letters with names, settlement terms, privileged advice, investigation notes. | Provider terms prohibit using output about a person for decisions with legal or material effect without human review, and privileged material can lose protection if disclosed.7 |
| Customer payment and account data | Card details, bank account numbers, account identifiers. | Partial payment data was exposed in the 2023 OpenAI incident.8 Payment data is also governed by card industry rules. |
| Anything you would not want indexed by a search engine | A shared link to a chat containing internal detail. | Thousands of shared chats were indexed in 2025 through a sharing option.9 Treat share links as publication. |
| Documents from outside your control, fed to an assistant that can act | Emails from strangers, calendar invitations, web pages, attachments, given to an assistant with access to your files or inbox. | These can carry hidden instructions. The EchoLeak and Slack cases worked this way.283031 |
The Stay Useful "Should I paste this?" framework
A Stay Useful framework, built from the regulator guidance and provider documentation above. Five questions, in order. The first question you answer "no" to tells you what to do.
Stay Useful framework
Should I paste this? Five questions
Outcomes: five yeses means go ahead. A no on question one or two means use the approved enterprise tool, or do not use AI for this. A no on question three means this task needs the real data, so it needs the approved tool. A no on question four means add the review before you start, not after.
Do I know which regime I am in?
Consumer account or business account. If you do not know, find out before continuing. If it is a consumer account, is training turned off, and do you understand that retention and review may still apply?
Would I send this, unencrypted, to a stranger at a company overseas?
That is a fair description of pasting into a consumer tool: the provider is a third party, usually offshore, that will store the text. If the answer is no, the information is personal or confidential enough to need an approved tool or to be removed first.
Can I remove or replace the sensitive parts and still get the value?
Most tasks do not need the names, the account numbers or the real figures. Redact, replace with placeholders, or use a synthetic example. Remember that removing names alone may not prevent re-identification when details are combined.34
Does my organisation have a rule, and have I followed it?
An approved tool, a policy, or an instruction from IT or privacy overrides your own judgment either way. If no rule exists, asking creates one.
What to do instead
Being careful does not mean not using the tools. It means using them in a way you could explain to your privacy officer without wincing.
- Use the approved enterprise tool. If your employer provides Copilot, ChatGPT Enterprise, Gemini for Workspace, Claude for Work or similar, use that account, not your personal one. The contractual protections attach to the account.3121519
- Redact before pasting. Remove names, identifiers, account numbers and anything that points to a specific person or deal. Do it before the text leaves your device, not by asking the tool to do it.
- Anonymise with care. Replacing names is a start, not a finish. New Zealand's business guidance warns that depersonalised details "could be joined up with other information over time to re-identify someone".34 Ask whether someone with the output could work out who it is about.
- Use synthetic examples. For most drafting and analysis, a made-up example with the same structure works as well as the real one. "A customer in Hamilton with a NZ$4,000 overdue invoice" teaches the tool what you need without naming anyone.
- Minimise. Paste the paragraph, not the document. Paste the column headings and three made-up rows, not the spreadsheet.
- Turn off training and use temporary modes on consumer accounts. This reduces exposure. It does not make a consumer account suitable for personal or confidential information.12
- Be deliberate about what an assistant can read and do. Before connecting an assistant to your inbox, files or calendar, understand that anything it reads can try to instruct it. Prefer tools your organisation has assessed, and keep high-stakes actions behind a human confirmation.2831
- Ask IT, security or privacy when unsure. A two-line question costs nothing. Finding out afterwards costs a great deal.
- Build the check into the workflow. Our beginner's guide to using AI at work puts a review step in every workflow, and our 25 ways to use AI to make your job easier names what to check for each use.
- Check the policy, or ask for one. Our guide on whether you can use ChatGPT at work covers what to do when there is no policy yet.
Common misunderstandings
- "ChatGPT trains on everything you type." Not on business, enterprise or API accounts by default, and consumer training can be switched off.1 The consumer default is on, which is why the account matters.
- "If it does not train on my data, my data is safe." Training is one of six things that can happen. Retention, review, sub-processors, legal holds and incidents are the others.2578
- "Deleting the chat deletes the data." Deletion removes it from your view and starts a deletion clock, typically 30 days at the major providers, subject to legal requirements. Human-reviewed consumer Gemini chats are kept for up to three years regardless.31118
- "Enterprise means nobody can see it." Enterprise means the provider does not train on it and your organisation controls retention. Your organisation's administrators can see it, and Microsoft documents that Copilot interactions are available for audit and eDiscovery.16
- "Anonymising fixes everything." Removing names reduces risk but combined details can still identify a person.34
- "The risk is what I paste." Increasingly the risk is also what the assistant reads: emails, invitations and documents can carry instructions aimed at it.283031
Related questions
Does ChatGPT save your conversations?
Yes, on a standard account, until you delete them, after which OpenAI says they are removed within 30 days unless legal requirements apply. Temporary Chats are not saved to history but a copy may be kept for up to 30 days for safety.25 On Enterprise, Edu and Healthcare plans, your administrators set the retention period.3
Can my employer see my ChatGPT conversations?
On an enterprise account, assume administrators can. On a personal account, your employer cannot read the conversations themselves, but if you signed up with a work email OpenAI's terms say the account may be joined to the organisation's business account and become accessible to its administrator.7 Activity on a managed device or network can be logged like any other web use, subject to your employer's monitoring policy and local law.
Is ChatGPT confidential?
Not in the way a conversation with your lawyer is. On a consumer account, OpenAI may retain conversations, use them for training unless you opt out, and monitor content for safety.17 On a business account, OpenAI does not train on your data by default and your organisation controls retention, but the provider still processes and stores it.3 Nothing makes a general-purpose chat tool a confidential channel.
Does Microsoft Copilot train on my data?
For work and school accounts, Microsoft states that prompts, responses and data accessed through Microsoft Graph are not used to train foundation models.1415 For consumer Copilot on a personal Microsoft account, Microsoft's privacy FAQ says it does use interaction data for AI training unless you opt out or fall into an excluded category.17 The green shield in the interface indicates that enterprise data protection applies.16
Can ChatGPT see my confidential information?
If you enter it, OpenAI's systems process and store it, and on a consumer account it may be used for training and monitored for safety.17 The tool cannot see anything you have not given it or connected it to. The safe assumption is that whatever you paste into a consumer tool is now held by a third party under that party's terms.
How do I delete my data from ChatGPT?
Delete individual conversations or clear your history in settings; OpenAI says deleted conversations are removed within 30 days unless legal requirements apply. Memory has to be cleared separately, and OpenAI's documentation notes that fully removing something requires deleting every place it appears, including archived chats and files.56 You can also opt out of training in Data Controls, which stops new conversations being used going forward.1
Is the API safer than the chat app?
For training, yes: OpenAI states that data sent to the API has not been used for training since March 2023 unless a customer opts in. For retention, API abuse-monitoring logs are kept for up to 30 days by default, and eligible customers can apply for zero data retention.4 Anthropic's commercial terms similarly bar training on customer content.12 The API is a business product; the protections follow from that.
Is DeepSeek safe to use at work?
DeepSeek's privacy policy states that it collects, processes and stores personal data in the People's Republic of China, collects your text inputs, prompts, uploaded files and chat history, and uses them to train and improve its models.20 Italy's data protection authority ordered an urgent limit on processing Italian users' data in January 2025.21 For work information, that combination places it firmly in the "do not paste" category unless your organisation has assessed and approved a specific deployment.