Before you paste a client document into an AI chatbot

AI chatbots are good at summarising contracts, explaining statements and drafting replies. That makes it tempting to paste in whatever document is in front of you. Before you do, it's worth knowing where that text goes.

What happens when you paste

When you use a cloud AI tool, your prompt, including any document you paste or upload, is sent to the provider's servers to be processed. What happens next depends on the provider, the plan and your settings.

Taking OpenAI as an example, its help centre explains that for personal ChatGPT accounts, conversations may be used to improve its models unless you turn that off in the data controls. For its business, enterprise and API products, it says it does not train on your inputs by default. Other providers have their own terms, and they change, so check the current policy for the tool and plan you actually use.

Even when your data isn't used for training, it has still left your machine and is stored under someone else's policies for some period.

It has already happened

In 2023, Samsung restricted staff use of generative AI tools after employees uploaded internal source code to ChatGPT, NBC News reported. Nobody was trying to leak anything. They were trying to get their work done faster.

For individuals

• Don't paste ID numbers, account numbers or passwords. The chatbot almost never needs them to answer your question.
• Swap in placeholders. "My account number is [ACCOUNT]" gets the same help.
• Check your settings. If your tool lets you turn off model training or chat history, decide whether you want to.
• Think before rating a reply. OpenAI's help page notes that on its personal plans, giving feedback on a response, such as a thumbs up or down, may let it use that whole conversation to improve its models even if you've opted out of training.

For firms

• Have a written rule about which tools may be used with client information, and which plans. Many client agreements and professional rules restrict sharing confidential information with third parties.
• Prefer approved business plans with clear data terms over personal accounts.
• Redact before you paste. Remove client names, account numbers, IDs and anything you wouldn't put in an email to a stranger. Keep the structure, lose the identifiers.
• Mind the hidden parts. Pasting from a document can bring along comments or tracked changes, and uploading a file sends everything in it, including hidden spreadsheet data.

Where Ombly fits

Ombly runs on your own computer or your company's servers, with no cloud AI involved. Use it to remove names, IDs and account numbers from a document before it goes anywhere else, including an AI tool. Join the waitlist, or book a call for your team.