Is it safe if we turn off training in the settings?

It is better, and it is not the same as the terms saying so. A setting can be changed, defaulted differently on a new account, or apply to one surface of a product and not another. The durable version is a written commitment for the tier in use; the setting is how you comply with your own decision.

What about tools that run locally?

A model running on your own hardware removes the vendor question and leaves every other one. What it is connected to, what it retains, who can reach it and what gets built with it are all unchanged, and local deployment sometimes removes the logging that would have told you what happened.

How do we find out what people are actually pasting?

Ask, and make it costless to answer honestly. Instrumentation is usually unavailable and often unwelcome, and the answer people give when the question is not a trap is more accurate than most of what monitoring would produce. Where the honest answer is uncomfortable, that is the finding.

What data should never go into an AI tool?

The honest answer is that it depends on the tool's terms and on what you are accountable for, not on a universal list. What is consistent is the test: anything you could not retract, could not explain having shared, or hold on somebody else's behalf should not go into a tool whose terms you have not read. In practice the recurring categories are customer records, credentials and keys, unreleased commercial terms, and anything covered by an obligation you did not write yourself.

Start with what the terms permit

The same product usually has several tiers, and the tier decides this more than the product does. A free or personal tier commonly permits training on what you put in; a business tier commonly does not. Which one is in use is a fact about your account rather than about the software, and it is frequently different from what people assume.

This is why the first question is not what to paste but what the terms say, in writing, for the specific tier in use. An assurance from a salesperson is not a clause, and a help-center page is not a commitment.

Where the terms permit training, the material is not merely stored. It has been learned from, and there is no version of that you can retract later.

The categories that recur

Credentials and keys, which arrive by accident more than by decision: pasted in a stack trace, a config file or a log while somebody is debugging. It is one of the most common serious leaks and it never feels like sharing data.

Other people's data you hold on their behalf, where the obligation is somebody else's and the consequence of getting it wrong is not only yours.

Unreleased commercial material, which is not usually regulated and is usually the thing that would cost the most.

And material about identifiable people that they would not expect to be somewhere else, which is a wider category than the regulated one and worth thinking about separately from it.

Why the rule needs a permitted route

A rule that only prohibits gets routed around by capable people under time pressure, and the route they choose is invisible: a personal account, a phone, a different tool. The prohibition succeeds at the level of the document and fails at the level of the work.

The version that holds gives the sanctioned alternative in the same sentence as the prohibition. Use the company account, redact this way, use this approved tool for that category. The work still has to get done, and a rule that does not acknowledge it is a rule about somebody else's job.

The test of whether a rule operates is not whether it exists but whether people can state it. A rule nobody can state does not run at the moment it would need to.

Common questions

Is it safe if we turn off training in the settings?: It is better, and it is not the same as the terms saying so. A setting can be changed, defaulted differently on a new account, or apply to one surface of a product and not another. The durable version is a written commitment for the tier in use; the setting is how you comply with your own decision.
What about tools that run locally?: A model running on your own hardware removes the vendor question and leaves every other one. What it is connected to, what it retains, who can reach it and what gets built with it are all unchanged, and local deployment sometimes removes the logging that would have told you what happened.
How do we find out what people are actually pasting?: Ask, and make it costless to answer honestly. Instrumentation is usually unavailable and often unwelcome, and the answer people give when the question is not a trap is more accurate than most of what monitoring would produce. Where the honest answer is uncomfortable, that is the finding.

Find out where you stand

The assessment on this site asks up to 24 questions about what the AI in use here exposes you to, and returns a score, a verdict and, where a control is short, the one thing to fix first. It never asks whether you have a list of the tools. It takes about ten minutes, and questions your organization has no surface for are dropped rather than scored against you.

It is a self-assessment of what has been arranged and practiced, not of whether it would hold against somebody actually trying. Not a penetration test, not an audit, not a certification.

Run the assessment