# Paste-Safety Checklist: read before anything goes into an AI chat

From Distru's No Bullshit AI Course, lesson 01-03 (learnai.distru.com). CC0 1.0. Version 1.0, September 2026.

Three piles. Decide which one the thing in your hand belongs to, then act.

## Pile 1: paste it (the sales floor)

Things anyone walking into your store could read or ask for.

- [ ] Menu, prices, product names and descriptions
- [ ] Your own SOPs, training docs, email templates
- [ ] COA numbers (THC %, terpenes, pass/fail) with no patient or customer attached
- [ ] Public regulations, Metrc bulletins, state notices
- [ ] Your own notes and drafts

## Pile 2: redact first (a person is in it)

Anything with a real person in it. Run `redact.py` (in this folder) or do it by hand: names to initials, phones and emails out, customer IDs to placeholders, license numbers to last four.

- [ ] Customer or buyer orders, texts, emails
- [ ] Delivery schedules and routes
- [ ] Employee shift notes, performance notes, timesheets
- [ ] Supplier and vendor correspondence with named people
- [ ] Any export from your ERP or POS with a contact column

Metrc tags themselves are not secret; keep them when the task needs them (reconciliation does). Strip them when it does not.

## Pile 3: never (the safe)

No redaction makes these safe. They do not go in a chat window, ever, on any tier.

- [ ] Passwords, logins, Metrc or ERP credentials
- [ ] API keys, tokens, anything that starts with `sk-`, `AKIA`, `ghp_` or looks like a long random string
- [ ] Social Security numbers, driver's licence numbers, passport numbers
- [ ] Bank account and routing numbers, card numbers
- [ ] Medical-program patient records (names, conditions, recommendations, patient IDs) in any form
- [ ] Anything a customer gave you under a signed agreement that names how it may be used

If one of these has already been pasted: change it (rotate the key, reset the password) today. Deleting the chat does not un-send it.

## Before you paste, two more questions

- [ ] **Which tier am I on?** Consumer chat, a business/team plan, or an API/developer account. Each has its own data policy. Anthropic, OpenAI and Google each publish theirs; read the one for your tier, not the marketing page, and note the date you read it.
- [ ] **Is training on my chats turned off, if the tier allows it?** Find the setting. Screenshot it. Put the screenshot in the folder with this checklist.