What never goes into a prompt

Every prompt is a disclosure. The moment text leaves your machine you have shared it with a vendor, and depending on the plan and settings, possibly with a system that retains it. That does not make AI unsafe — it makes it a place where a data policy is required, exactly like email or cloud storage. The question is never "is this tool safe" in the abstract but "is this specific information appropriate to put in it." Some categories are simply out. Full payment card numbers, bank account and routing details, government identifiers, login credentials and API keys, health information, and anything covered by a confidentiality agreement should never be pasted into a general-purpose assistant. Others need judgment: customer names and contact details, internal financials, employee matters, unreleased plans, and supplier terms can often be used in de-identified form. The habit that makes this easy is redaction by default — "a customer" instead of a name, "the west-side location" instead of an address, a placeholder for every figure that identifies someone. Write the rules down and make them short enough to remember. A four-line policy — never share these, always redact these, use this tool for that class of work, ask this person when unsure — outperforms a long document nobody reads. Then check the settings you actually control: history retention, training opt-out, who on your team has accounts, and what happens to those accounts when someone leaves. Review it when you add a tool, and treat a paste you regret as an incident worth logging rather than quietly forgetting. Most data incidents with AI are ordinary rather than dramatic: a screenshot with a full invoice, a pasted email thread containing someone's medical detail, a spreadsheet with account numbers left in a hidden column. Redaction habits prevent nearly all of them. Team access is the part owners forget. Accounts created by employees on personal logins survive their departure, and no policy protects data that leaves through an account you do not control. A small law office adopted a rule that no client name ever enters a general assistant, using role labels instead. It cost them nothing in usefulness and removed an entire category of confidentiality risk in one sentence.

Key takeaways

• Some categories are simply out.
• Write the rules down and make them short enough to remember.
• Payment card data is categorically prohibited.

Sign in to complete activities, save progress, and use the AI Coach.