Blog · Safety · 3 min read
Is it safe to put client information into AI? 3 checks before you paste anything
Short answer: it can be, once you make three choices. Here they are in plain English, plus the list of things that should never go in, on any plan.
It’s the question I get most on free audit calls, usually from owners who’ve been in business twenty years or more. And it’s the right question. Your clients trust you with their information, and being careful with it is part of why they stay.
The honest answer is that it depends on three things, and all three are in your hands.
1Check whether your chats are used to train the AI
On free and personal plans, the companies behind these apps can use your conversations to improve their AI unless you switch it off. It’s one setting, and it takes a minute:
- ChatGPT: Settings → Data controls → turn off “Improve the model for everyone.”
- Claude: Settings → Privacy → turn off “Help improve Claude.”
- Gemini: look for the activity setting in Gemini’s menu and turn it off.
Menu names change from time to time. If you can’t find it, search for the app’s name plus “turn off training.” Keep in mind that the switch protects your chats from that point on, not the ones before it.
The business versions (ChatGPT’s team plans, Claude for teams, Gemini inside Google Workspace) say they don’t train on your business’s data by default. If your staff uses AI every day, that’s usually the right plan. Read the plan’s privacy page before you decide.
2Take out what doesn’t need to be there
You almost never need a real name to get good help. AI writes the same letter for “Client A” as it does for “Margaret Thompson.” So before you paste anything, swap the names for labels and delete the numbers: Social Security numbers, account numbers, birth dates and addresses.
The exact wording
A long-time client (I'll call them Client A) is upset because [what happened]. They've been with us for [number] years and I want to keep them. Write a short, warm reply that acknowledges the problem, explains [what we're doing about it] and offers a quick call. No excuses, and don't promise anything about [money / dates] without me checking first.
Same help, nothing private. Make it a habit and the risk drops a lot.
3Know what you’re connecting, and how to unplug it
Pasting into a chat window is one thing. Connecting AI to your email, calendar or files is another, and that’s where the real time savings are. So here’s what you should know before you connect anything:
- It uses your own sign-in. AI sees what your account can see, through a connection you approve. You can review it and disconnect it at any time.
- You decide what it can do. A good setup lets AI read and draft, and asks you before anything is sent, changed or deleted.
- Your accounts stay yours. When we set this up with owners, everything runs on their accounts, and nothing is stored on our side.
Never paste these, on any plan
- Social Security numbers and tax ID numbers
- Bank account and credit card numbers
- Passwords and logins, ever
- Medical details about clients or employees
- Anything a client told you in confidence
If your industry has its own rules (health, legal, tax and financial work all do), check with whoever handles compliance for your business before you use AI with client files. AI can be part of a careful process, but nobody can promise you it makes you “compliant.”
The bigger risk is the one you can’t see
Here’s the uncomfortable part: your employees are probably already using AI, on free personal accounts, with no rules. That’s a bigger risk than anything you’ll do after reading this. A one-page policy fixes most of it, and AI can write the first draft:
The exact wording
Write a one-page policy for my [type of business] called "How we use AI here." It should cover which AI apps staff can use, what never to paste (client names, Social Security numbers, bank details, passwords), that a person reads everything before it goes to a client, and who to ask when they're not sure. Plain English, friendly, no legal jargon.
Have your attorney look it over, then share it at your next team meeting.
The short version
- Turn off training in the settings, or use a business plan.
- Swap names for labels, and delete the numbers.
- Connect only through your own accounts, with AI asking before it sends anything.
That’s what makes AI safe enough to use every day. When we set it up with owners, these rules come first, before any tool gets connected.