Confidentiality and AI

Company policy decides

Different organisations allow different things: some approve specific tools under enterprise agreements, some allow only certain kinds of data, and some forbid external AI tools entirely. Terms differ on how long input is retained, who can see it, and whether it can be used to improve models. You cannot judge these from the tool’s interface.

So:

• Find and read your company’s AI policy before using a tool for work. If there is none, ask your manager or security contact.
• Use only approved tools and accounts. A personal account on a free service is not the same as an approved company arrangement.
• When in doubt, do not paste it. Ask first.

What must not be shared

Unless policy explicitly allows it for a specific approved tool, never put the following into an AI tool:

• Credentials and secrets: passwords, API keys, tokens, private keys, connection strings, and configuration files containing them. See Secrets Management.
• Personal data: names, e-mail addresses, identifiers, health or financial details of any individual; see Data Privacy Awareness.
• Customer data: records, support tickets, contracts, logs or database extracts that belong to customers.
• Proprietary code and internal information: source code, designs, security details, unreleased plans and internal documents, unless approved.
• Third-party confidential material, such as partner documents covered by an agreement.

Logs, stack traces, screenshots and configuration dumps are easy to overlook, because they often contain tokens, addresses or user data you did not notice.

How to share less

• Share the smallest snippet that shows the problem.
• Replace real values with fake ones, such as user@example.com, and replace secrets with placeholders. Do not rely on this alone for sensitive material.
• Keep secrets out of the files you work on, with environment variables and ignored files, so tools that read your project cannot see them.
• Remember that tools which act on your repository (editor integrations and agents) can read files and run commands. Check what they can access.
• If you shared something by mistake, report it at once. For a secret, assume it is compromised and rotate it. Early reporting is expected and far better than silence.

Related risks

Generated code can also carry licence and security risks, and the output of an assistant should not be treated as private either. See also Using AI Assistants Effectively.

Try it

Locate your organisation’s AI usage policy and write down in three bullets which tools are approved and which data categories are forbidden. Then take a real log or configuration file from a project and mark every value you would have to remove or replace before sharing any part of it.