Thinking before you paste

You copy a piece of code, an email from a client or a clause from a contract. You paste it into ChatGPT and ask it to take a look. A few seconds later you have a useful answer, and the temptation to do the same with everything else is huge.

It’s a great way to work. But it’s worth asking one question before you hit Enter: where does that text go?

Where your words go

A cloud AI assistant doesn’t think inside your computer. Every message travels to the provider’s servers, where it’s processed and, usually, stored. That’s where something few users read comes into play: the terms of service.

With consumer services, the norm has been that conversations may be used to train and improve future models. In April 2023, OpenAI added an option to turn this off: conversations started with chat history disabled aren’t used for training and are deleted after 30 days. It also announced a business plan whose data won’t be used for training by default.

That’s good news, with one caveat: you need to know these options exist and switch them on. By default, what you paste may stay there for longer than you’d imagine.

A case from April 2023

That same month, several Samsung engineers pasted internal code into ChatGPT to look for bugs. Nobody meant to leak anything: they wanted to work better. Even so, in early May the company restricted the use of these tools in one of its main divisions.

The reason it gave is the part that matters: what’s sent to these services sits on external servers, and it’s hard to retrieve or delete. Once it’s pasted, it’s no longer only up to you.

What’s never worth pasting

A few categories deserve a moment’s thought.

Other people’s personal data. A client’s email, an employee’s payslip, a contact list. It isn’t yours, and if you work in Europe, sharing it with an outside service also has legal implications under the GDPR.

Passwords, keys and credentials. It’s enough for them to appear in a code snippet or a configuration file. Pasting them without noticing is easier than it sounds.

Confidential information. Your own code, contracts, business plans, financial data. Anything you wouldn’t publish on a public website deserves the same care here.

Using it without giving data away

None of this means giving up on AI. It means using it with a bit of method.

Anonymise before you paste. Swap names, amounts and addresses for made-up examples. The AI rarely needs the real data to help you.

Check your settings. Turn off the use of your conversations for training, and the history if you don’t need it.

Choose the service carefully. Business plans and providers with clear terms on data use make a real difference.

Consider local models. Open models that run on your own computer are starting to appear. For sensitive tasks, keeping the data at home is the best guarantee.

In a company, guidelines beat bans. A blanket ban usually ends with people using AI behind everyone’s back. Clear guidelines on what can be pasted and where work much better.

A tool, not a confidant

AI is one of the most useful tools to reach our work in years, and it’s worth using to the full. But it isn’t a confidant: it’s another company’s service, with its own rules.

Before you paste, one question is enough: would I publish this online? If the answer is no, take out the sensitive parts or find another way to ask for help.