Your staff are pasting client data into ChatGPT. Start here.
AI data leakage is decided by which account your staff use, not which model. LayerX found 82 percent of pastes into AI tools come from unmanaged accounts. Give people a sanctioned company account and the same prompts land under business terms you control, with training off by default.
- The exposure is set by the account, not the model. One prompt in a personal account and in a company account gets different retention, review and training outcomes.
- LayerX measured 82 percent of AI pastes coming from unmanaged accounts, and 67 percent of ChatGPT access happening outside company control.
- Google asks consumer Gemini users not to enter confidential information, because a subset of chats are read by human reviewers and kept up to three years.
- Anthropic retains consumer chats for five years if the user allows training. Its Team and Enterprise plans are excluded from those consumer terms.
- Banning the tools moves the usage onto phones you cannot see. Provisioning one sanctioned account is the faster risk reduction.
Your staff are pasting client data into AI tools. What should you do first?
Provision a sanctioned company account on a business tier, before you write a word of policy. That one move changes how the vendor retains, reviews and trains on every prompt your people type, because the commitments attach to the plan rather than to the model.
The behaviour is rational, which is exactly why a ban fails. People paste because the tool saves them real time on a real task. Verizon found that frequent usage of AI tools by employees surged from 15 percent to 45 percent of employees in a single year, and now ranks shadow AI as the third most common non-malicious insider action. LayerX, which measures this from inside the browser, found that 77 percent of users paste data into AI tools and 82 percent of that activity comes from unmanaged accounts.
Read those two findings together and the problem changes shape. The exposure is not created by which model your staff picked. It is created by which account they were signed into. The same prompt, typed into a personal free account and into a company workspace, produces a different retention period, a different answer on human review and a different answer on model training. One of those you can govern. The other you cannot even see.
This guide is about consumer AI tools and what leaves your business. For the policy document itself, read Shadow AI: How to Write an AI Use Policy. For the opposite direction of data flow, where an assistant inside your own tenant surfaces files staff could already open, read Copilot sees everything your users can see. For how providers are selling AI this year, see our 2026 AI in Managed IT report.
Why does the account decide your exposure, not the model?
The account decides because every promise a vendor makes is written against a plan name, not a model name. The engine is the same in both tiers. The contract around it is not, and that is where your data handling is settled.
OpenAI states that by default, it does not use your business data for training its models. On its consumer plans the same company lists the opposite position. Its own plan comparison marks content as used to train our models, with an opt-out available on the Free, Go, Plus and Pro plans. That opt-out is a setting named Improve the model for everyone, and OpenAI warns that turning it off does not delete or hide saved chats. Read the asymmetry rather than the reassurance. In a personal account the model training opt-out belongs to your employee. In a company workspace the default is already off and the control belongs to your administrator.
That is why visibility collapses first. LayerX found 67 percent of ChatGPT access happens through unmanaged accounts. None of that traffic reaches a console you own, so there is no log to read after an incident and no list of what left.
You cannot govern an account you do not own. The first control here is not a rule. It is a login.
What do the consumer tiers actually keep?
Consumer tiers keep more, keep it longer, and promise less. All three major vendors publish their own figures, and the distance between a consumer tier and a business plan is wider than most owners expect.
Google tells consumer users not to type anything confidential
Google's own guidance for the consumer Gemini app is blunt. It states that a subset of chats are reviewed by human reviewers, and asks users directly not to enter confidential information that you would not want a reviewer to see. Retention then runs on two clocks. Your activity is auto-deleted after 18 months by default, which a user can change. Separately, reviewed chats are retained for up to three years, and deleting your activity does not remove them. A paste into a personal Gemini account is therefore not reversible by deleting the chat.
Anthropic keeps consumer chats for five years if the user agrees
Anthropic asks consumer users to make the choice themselves. It states that if you choose to allow us to use your data to improve Claude, we will retain this data for 5 years, held in a de-identified format in our model training pipelines. Two other clocks run whatever the user picks. Content flagged against the usage policy is kept for up to 2 years, and trust and safety classification scores for up to 7 years. Anthropic is equally clear on scope. Those consumer terms do not apply if you use Claude Team or Enterprise Plans, the Claude Developer Platform, or other services covered by our Commercial Terms.
A temporary chat in ChatGPT is not a delete button
OpenAI sets a shorter clock on the consumer side, with a catch worth knowing. Temporary chats may be retained for up to 30 days for safety purposes, and they are not used to improve models. Ordinary chats behave differently, and turning the training setting off leaves saved history exactly where it was. Staff who believe a private window protects a client list are working from the wrong model of how this works.
What changes the moment you provision a company account?
Five things change, and every one of them is written in the vendor's own terms rather than in your handbook.
- Training stops by default. OpenAI states that by default it does not use content from ChatGPT Business, Enterprise, Edu or ChatGPT for Healthcare workspaces to train models. Google commits that Workspace does not use customer data for training models without the customer's prior permission or instruction.
- Retention becomes configurable. On ChatGPT Enterprise, OpenAI says any deleted conversations are removed from our systems within 30 days and that you control how long your data is retained. On ChatGPT Business, workspace admins can control how long your data is retained.
- Human review stops. Google states that on a qualifying Workspace edition, Gemini app chats and uploaded files will not be reviewed by human reviewers.
- Prompt logging moves inside your control. Google lets administrators choose whether conversation history is kept at all, with automatic deletion after 3 months, 18 months or 3 years, or indefinite retention. Your workspace then logs the prompt somewhere you can reach.
- Identity gets attached. A company account arrives through single sign-on, so joiners and leavers follow your directory. A personal account does not leave when the person does.
One detail is worth checking before you compare quotes. OpenAI lists data residency at rest in the US, Europe, the UK, Japan, Canada, South Korea, Singapore, Australia, India and the UAE, and names ChatGPT Enterprise, ChatGPT Edu, ChatGPT for Healthcare and the API platform. ChatGPT Business is not on that list. OpenAI also confines its zero data retention policy to the API platform. So the enterprise tier and the cheaper business tier are not the same purchase, and a provider who says business tier when you asked about data residency has not read the page.
What should you check in the vendor's own terms before you sanction a tool?
Check six things in the vendor's own documentation, never in a sales deck. Each has a yes or no answer, and the whole exercise takes about half an hour per tool.
- Confirm the training default for your exact plan name, in the vendor's words, and screenshot the page with its date.
- Find the retention period and who can change it. Note whether a deleted chat is genuinely gone, because Google says reviewed chats survive deletion of your activity.
- Ask whether any human reads the content, and under what circumstances.
- Check data residency against where your clients and your regulator sit, and get the qualifying plan name in writing.
- Require single sign-on, admin ownership of every account, and an auditable record of who holds access.
- Get the contractual document rather than the help article, because help pages change without notice and only a contractual commitment is enforceable.
Verify the plan on the invoice as well as in the pitch. One sanctioned tool beats a long list of banned ones, because people route around a ban when nobody has given them a better option. CISA, the NSA and the FBI, with international partners, published joint best practices for securing the data used to train and operate AI systems, which is the standards-body view that this is a data problem rather than a passing tooling fad.
Which data should never be pasted into any AI tool?
Five categories stay out of every AI account, including a sanctioned one, because the paste is not reversible and the time saved is small. LayerX found that of the employees pasting into AI tools, 22 percent paste content containing personal or payment card data.
- Personally identifiable information at scale, such as customer lists, dates of birth, social security or national insurance numbers, and anything you would name in a breach notification.
- Payment and bank data, including card numbers, sort codes and account details.
- Health records. OpenAI will sign a business associate agreement on request for its API platform and sells a separate healthcare product, which tells you the consumer tier was not built to carry this.
- Credentials and keys, including passwords, API keys and anything that would let a reader log in as your business.
- Anything covered by client confidentiality, such as a client contract, an NDA, an unannounced deal, or a document you hold on a client's behalf.
The acceptable use policy that fits in one paragraph
Your acceptable use policy can be one paragraph, and a short one actually gets followed. Something close to this works. Use the named tool with your company account only. Never paste customer personal data, payment data, health data, passwords, or anything a client gave us in confidence. If you are unsure, ask the named owner before you paste rather than after. Everything an AI tool writes gets checked by a person before a client sees it.
Then make it real rather than decorative. Pair it with data loss prevention on the obvious paths, so a thousand-row customer list pasted into a browser form gets flagged and logged. Map the whole thing to the NIST AI Risk Management Framework if an insurer or auditor will ask you to show your work. For the longer document, with tool tiers and a named owner, our shadow AI guide does that job.
What should you ask your IT provider this week?
Ask four questions and write down the answers. A provider doing this work answers with a plan name, a number or a date. A provider selling you something answers with a product name.
- Which AI services are our staff reaching, and from which accounts? A good answer is a report with a date on it. A weak answer is that we block what we can.
- Which plan are we on, by name, and does it exclude our data from model training? A good answer quotes the vendor's page. A weak answer is that it is the business one.
- What is our retention period, and who can change it? A good answer is a number of days and a named administrator.
- What happens to the account when someone leaves? A good answer names single sign-on and your own directory.
The gap here is measurable, and it is not small. IBM found that of organisations reporting an AI-related breach, 92 percent lacked proper AI access controls, and that across all organisations surveyed only 40 percent apply access controls to AI models and data at all. Incidents involving prompt injection against an organisation's own AI applications averaged 5.89 million dollars in losses. The ordinary basics still carry most of the risk alongside this, with software flaw exploitation now behind 31 percent of breaches, so AI governance sits beside patching rather than ahead of it.
None of this makes a paste reversible, and no honest provider promises that it does. It moves a behaviour you cannot see into an account you can govern, which is the only version of this problem that has a fix. Sanction one tool, name it, give everyone the company login, and spend the rest of your effort on the five categories that never go in.
FAQ
Is it safe to put company data into ChatGPT?
It depends entirely on the account, not on ChatGPT. OpenAI states that by default it does not use your business data for training its models, and that on a company workspace you control how long your data is retained. A personal account carries neither commitment, so the same prompt gets different treatment.
Does ChatGPT train on my conversations?
In a personal account, unless you turn it off. OpenAI's own plan comparison shows content used to train our models with an opt-out available on Free, Go, Plus and Pro. On business plans the position reverses, because OpenAI says it does not use content from ChatGPT Business, Enterprise, Edu or Healthcare workspaces by default.
Should we just block ChatGPT at work?
No, because a ban moves the usage onto phones and personal accounts you cannot see. Verizon found employee AI use rose from 15 percent to 45 percent in a single year and LayerX found 82 percent of AI pastes already come from unmanaged accounts. Sanction one tool instead, then govern it.
How long do AI vendors keep our conversations?
It varies by vendor and by tier. Anthropic retains consumer data for 5 years where the user allows model training. Google auto-deletes consumer Gemini activity after 18 months but keeps human-reviewed chats for up to three years. OpenAI removes deleted enterprise conversations within 30 days.
Is ChatGPT Business the same as ChatGPT Enterprise?
No, and data residency is the clearest difference. OpenAI lists residency at rest across ten regions for ChatGPT Enterprise, Edu, Healthcare and the API platform, and ChatGPT Business is not named. Business does give admin-controlled retention, since workspace admins can control how long your data is retained.
Best IT MSP is the independent directory of vetted managed IT and cybersecurity providers across the US and Canada. Organic ranking is earned on rating and verified data, and paid placement is always labelled. Take the four questions above to three merit-ranked firms in your city and compare the answers side by side.