Someone on your team has almost certainly pasted something work-related into ChatGPT already. A contract to summarize, a spreadsheet to clean up, a customer email to rewrite. It’s fast, it’s helpful, and most people doing it have no idea whether it was a problem. So the question lands on a lot of desks across Alaska and Hawaii: is it actually safe to put company data into these tools?
The honest answer is that it depends entirely on which tool, which settings, and which data. Some uses are perfectly fine. Some could quietly create a real problem, and a few could land a regulated business in genuine trouble. Let’s walk through how to tell the difference without the scare tactics.
What actually happens to the data you paste in
When you type something into a public AI tool, that text leaves your business and travels to the tool provider’s servers. What happens next is the part most people never check.
With many consumer versions of these tools, the provider may retain your input and, depending on the settings and the plan, use it to help train future versions of the model. That does not mean your contract pops out word-for-word in someone else’s chat window. It does mean your information has left your control and now sits on a third party’s systems under their terms, not yours. The business and enterprise versions of the same tools usually offer much stronger protections, including commitments not to train on your data, but only if someone actually turned those settings on and chose the right plan.
The point is not that AI tools are spying on you. It is that pasting data into one is a decision about where your information lives, and most people are making that decision by accident.
The data that should never go into a public tool
A simple way to think about it: if you wouldn’t email it to a stranger, don’t paste it into a public AI tool.
That includes anything covered by a regulation. If you are a medical or dental practice, patient information protected under HIPAA does not belong in a consumer chatbot, full stop. If you handle controlled information as a government contractor under CMMC, the same rule applies and the consequences of getting it wrong are serious. Accounting and law firms have their own confidentiality obligations to clients that a public tool can quietly violate.
Beyond regulated data, be careful with anything that gives away your business: customer lists, pricing models, unreleased plans, employee records, passwords and access keys, or anything you would consider a competitive secret. Once it is in a third party’s system, you cannot pull it back.
This is also how data quietly leaks out of a company one helpful shortcut at a time. We wrote a separate, practical guide on how to stop staff from leaking company data into public AI tools that covers the technical and human sides of closing that gap.
The uses that are genuinely fine
We don’t want to leave you thinking AI is too dangerous to touch, because that’s not true either, and your competitors are already getting value from it. Plenty of uses carry little to no risk.
Brainstorming, drafting generic copy, explaining a concept, writing a function in code, summarizing a public document, or rephrasing something you wrote yourself are all low-risk as long as no sensitive information is involved. The trouble starts when real company or customer data goes in. Strip the specifics out, or use a tool configured for business use, and a lot of the worry disappears.
The safest path for most businesses is to move staff onto a properly configured business-tier tool, where data protection commitments are in place and you control the settings, rather than leaving everyone on the free consumer version. Getting those settings right is exactly the kind of thing we help clients sort out.
The piece most people skip: a simple policy
Here is the gap we see most often. A business worries about AI risk, but has never told its team what is allowed and what is not. People are left to guess, and they guess generously because the tools are so useful. A short, clear acceptable use policy fixes most of this by giving everyone a simple rule to follow.
It does not need to be a legal document nobody reads. It needs to say which tools are approved, what kinds of data are off-limits, and who to ask when someone is unsure. To make that easy, we put together a free AI Acceptable Use Policy template you can adapt for your own business. Pairing a clear policy with the right tool settings closes most of the everyday risk.
How we think about it
We help clients in Alaska and Hawaii use AI tools in a way that is safe and, where it matters, compliant. That means choosing the right business-tier tools, turning on the protections that should have been on from day one, keeping regulated data out of anywhere it does not belong, and keeping a real person involved in decisions about sensitive information. We treat AI as a tool your people use carefully, never as something that gets unsupervised access to your most important data. That balance is the core of our People+ Framework.
Where to start
If you’re not sure what your team is already pasting into AI tools, you’re not alone, and the answer is usually more than you’d expect. The good news is that this is a very solvable problem once you put a little structure around it.
Start by downloading the policy template above and having a short conversation with your team. If you’d like help choosing safe tools, configuring them correctly, or making sure you stay on the right side of HIPAA or CMMC, book a discovery call and we’ll give you a clear, practical plan with no pressure.