Is it safe to put business data into ChatGPT, Claude or Copilot?
By Rafael · Updated · 2 min read
The short answer
It depends on the account, not just the tool. Business and team plans from major AI providers generally offer stronger privacy commitments than free personal accounts, such as not training on your data by default. Use approved business accounts for work, and keep the most sensitive information out of AI entirely.
Free vs. business accounts
With free or personal accounts, what you type may be stored and, depending on settings and terms, used to improve the service. Business, team and enterprise plans typically add contract terms, admin controls and commitments about how your data is used.
Check the current terms for the exact plan you use. They change, and they differ between providers and plans.
Using personal accounts? See how to stop ChatGPT, Claude, Gemini and Copilot from training on your data. Need more control? See private AI for business.
What "shadow AI" means
Shadow AI is staff using AI tools the organization hasn't approved, usually personal accounts, for work. It's rarely malicious; people just want to get work done. The risk is that customer lists, contracts or personal information leave your control. More in what shadow AI is and how to manage it.
Simple rules that cover most risk
- Use approved business accounts for work.
- Never paste passwords, keys or financial account numbers.
- Keep health, HR, counseling and pastoral information out unless a tool is specifically approved for it.
- Remove names and identifying details when you can. The AI rarely needs them.
- Put these rules in a short written AI policy and train your team.
Common questions
- Does ChatGPT or Claude train on my data?
- It depends on the account type and settings. Business and enterprise plans from major providers generally don't train on your data by default; free personal accounts may, depending on settings. Check the current terms for your plan.
- What is the safest way to use AI with customer data?
- Use an approved business or enterprise plan, share only the data the task needs, remove identifying details where possible, and follow a written policy.