Once you paste something into an AI tool, it leaves your control. Depending on the tool and its settings, it may be stored, reviewed by the provider, or used to improve the service. You usually can't pull it back. So the safest rule is simple: if it would hurt someone if it leaked, it does not go in.
The never list
Keep these out of AI tools, unless your business has deliberately set up a tool for that kind of data and confirmed it meets your legal duties:
- Client and customer personal data. Full names tied to other details, home addresses, phone numbers, dates of birth, driver's license numbers.
- Health information. Patient charts, diagnoses, treatment notes, insurance claims, anything that links a person to a health condition. Medical and dental offices have legal duties here.
- Financial details. Card numbers, bank account and routing numbers, Social Security numbers, tax ID numbers, payroll records.
- Passwords and keys. Logins, Wi-Fi passwords, door and alarm codes, software license keys, and API keys (secret codes that let one program connect to another).
- Confidential business documents. Contracts under a confidentiality agreement, legal case files, pricing you've promised to keep private, HR and disciplinary records.
If you are not sure whether something belongs on this list, treat it as if it does, and ask.
Can this go into AI? A dental office assistant wants an AI chat tool to summarize a patient's treatment history so the dentist can review it faster.
Answer: No — patient health records are some of the most sensitive data you hold, and dental offices have legal duties to protect them. Keep this in the practice's own records system.
Mask it, then ask
Most of the time, you can still get help. The trick is to remove what identifies people before you paste. This is called masking: swapping real details for placeholders.
Before masking, a prompt might include a customer's full name, street address, invoice number, the amount owed, and the last digits of their card.
After masking:
"Write a polite payment reminder to [Customer Name] about invoice [Invoice #] for [Amount], which is now past due. Friendly but firm, under 100 words."
The draft is just as useful. You add the real details in your own billing system.
A few masking habits:
- Replace names with roles: "the patient," "Tenant B," "the subcontractor."
- Remove numbers that identify a person or account. Keep only what the task needs.
- Describe instead of pasting: "a customer disputes a charge from last month" rather than the full dispute email.
- Strip signatures, email footers and headers. They often carry phone numbers and addresses.
Want to practice? Try our live Before-You-Paste Checker. Paste a sample with made-up details, and it finds things like names, Social Security numbers, card and bank numbers, birth dates and passwords, then gives you a safer version to use.
Can this go into AI? A contractor wants help writing a cover letter for a bid and describes the job as "a kitchen remodel for a homeowner, about three weeks of work."
Answer: Yes — that description has no names, addresses or account details. General job descriptions are exactly the kind of context that is safe to share.
When something slips
Mistakes happen. If someone pastes sensitive data into an AI tool:
- Stop, and don't paste anything more.
- Delete the chat if the tool allows it. This may not remove every copy, but it helps.
- Tell your manager, or the person who handles AI questions at your business, right away. Don't hide it.
- If passwords or keys were shared, change them.
- If client data was involved, your business may have duties to act. Check with a qualified professional.
A quick, honest report is far better than a quiet mistake that surfaces later.
Key points
- Once data goes into an AI tool, you usually can't take it back.
- Never paste client personal data, health records, card, bank or Social Security numbers, passwords or keys, or confidential documents.
- Mask first: replace names and numbers with placeholders and describe the situation instead.
- If something slips, stop, report it, and change any exposed passwords.
Before you paste
Check every item before anything goes into an AI tool.
- No client or customer names tied to other details (swap in [Client Name] or a role).
- No addresses, phone numbers, emails or dates of birth.
- No health information, patient notes or insurance details.
- No card, bank, Social Security or tax ID numbers.
- No passwords, door or alarm codes, or software keys.
- No confidential contracts, case files or HR records.
- Signatures, email headers and footers removed.
- Not sure? Leave it out and ask the person who handles AI questions.