ChatGPT, Claude and Gemini at work: how to use them without exposing your data

Using ChatGPT, Claude or Gemini at work is safe if three conditions are met: company accounts with a verified contract and settings, clear rules on which data can be used, and controlled integrations for sensitive data. The most common risk is not the model itself but copying and pasting confidential information into personal tools, beyond any control.

The real problem: “shadow AI”

Many people already use generative AI to write emails, summarise documents or analyse data, often with their own personal account. The result is that contracts, customer data, proposals and code end up in services the company did not choose, under terms nobody has read. Banning everything rarely works: the use simply moves to where it cannot be seen.

Personal accounts, business plans and APIs

	Personal account	Business or enterprise plan	API or dedicated integration
Use of data for training	Depends on the provider and settings	Excluded by default with the main providers	Excluded by default with the main providers
Company control	None	Centralised administration, managed access and offboarding	Complete: you decide on data, flows and permissions
Data processing contract	Standard terms of use	Data processing agreement available	Data processing agreement available
Data retention	According to the terms of service	Configurable depending on the plan	Configurable, down to zero retention where offered
Suitable for	Personal use, public data	Teams’ day-to-day work	Business processes and sensitive data

Terms change over time: before choosing, read the provider’s data processing agreement and check the account settings.

What never to paste into an unapproved tool

• Personal data of customers, patients, employees and job applicants.
• Health data and other special categories of data.
• Credentials: passwords, API keys, tokens, certificates.
• Proprietary source code and production configurations.
• Confidential contracts, proposals and prices.
• Non-public financial data and information on deals in progress.

A one-page policy

An effective internal policy fits on one page and answers five questions:

1. Which tools can be used? A short list of approved services, with company accounts.
2. With which data? A simple classification: public, internal, confidential. Chat tools only for the first two; confidential data only in approved integrations.
3. Who checks the output? AI output must be checked by a person before it is sent to a customer or used for a decision.
4. What should people do when something goes wrong? Who to notify about data entered by mistake or a harmful output.
5. How do people learn? Short, regular training on the limits of AI, which is also the simplest way to meet the AI literacy obligation under the AI Act.

GDPR: the points to check

• A legal basis for processing, for every use that involves personal data.
• A data processing agreement with the provider, appointing it as data processor.
• Transfers outside the EU: check the safeguards in place, such as the EU-US Data Privacy Framework or standard contractual clauses, or choose a processing region in Europe.
• A data protection impact assessment when the processing may pose a high risk to individuals.
• An up-to-date privacy notice for customers and employees, if their data is processed with AI systems.

Integrating AI without copy and paste

When AI needs to work on sensitive company data, the answer is a properly designed integration, not a chat. In the systems we build, we apply a few consistent rules:

• Role-based access: the AI sees only the data the user is allowed to see, with the check repeated on every request.
• Minimisation: the model receives only what the task needs; where possible, data is pseudonymised.
• Data in Europe, and providers that do not retain content when the case requires it.
• A log of every request and action, without writing the sensitive text passed to the AI into the logs.
• No credentials in prompts: keys stay in the systems the AI calls.

In the property management platform with AI agents, for example, every query is scoped to the firm and permissions are checked on every AI call.

Checklist

• Is there a list of approved AI tools, with company accounts?
• Have you read and signed your providers’ data processing agreements?
• Is it clear which data can be used in chat and which cannot?
• Do people know that output must be checked before it is used?
• Is there a simple way to report an error or data entered by mistake?
• Does sensitive data go only through integrations with role-based access?
• Have you planned short, regular training?

If you want to bring generative AI to your company’s data without losing control of it, we can design the integration with you.