What should never go into an AI prompt or upload

The easiest privacy mistake happens in seconds: you are in a hurry, the AI box feels conversational, and you paste something sensitive because it would be faster than redacting it. The safest habit is to decide what stays out before that moment arrives.

The first boundary is simple: some things should never enter the box

• Do not paste passwords, API keys, recovery codes, or secrets.
• Do not upload personal, legal, medical, payroll, or customer data unless you have explicit permission and a clear reason.
• When possible, use sample or anonymized data first.

A quick example makes this easier to remember

Example scenario: you want help rewriting a contract clause. The wrong move is pasting the whole live contract with names, prices, and private terms. The safer move is to isolate the clause, remove identifiers, and ask about the wording problem itself. The model can still help, but the exposure is much lower.

Why people still overshare

AI tools feel like chat, which lowers caution. But a friendly interface does not remove the need to think about storage, retention, connected accounts, and accidental exposure. Convenience is exactly what makes this category risky.

Safer everyday habits

• Replace names, account numbers, and direct identifiers before you paste.
• Keep a short internal list of information that always requires manual review.
• Check whether connected accounts expose more data than the task actually needs.

Marketing words are not the same thing as a safe workflow

Words like 'private', 'secure', or 'enterprise' are not enough on their own. The official privacy and security pages matter because they explain what is stored, who can access it, and what controls exist. Regulatory guidance matters because it reminds you that misleading assumptions about AI are still risky even when the interface feels polished.

The mistakes that show up most often

• Testing with real customer or company data first.
• Assuming 'private' always means no human review, no logging, and no retention.
• Sharing secrets because the prompt felt temporary.

The safest rule is still the fastest one

If it would be risky to drop into a wrong email, it is risky enough to pause before putting it into AI. That one shortcut catches more mistakes than most long policy documents.