What You Can Paste Into AI (and What You Shouldn't)

Questions this answersQuestions this answersfaq

can I paste customer data into ChatGPT?can I paste customer data into ChatGPT?how should PII be handled before it enters a prompt?

Not as it comes out of your system. Take the person out first: initials instead of names, no phone numbers, no email addresses, customer IDs replaced with placeholders. The task almost never needs the person, and a small script does that blacking-out in seconds.Not as it comes out of your system. Take the person out first: initials instead of names, no phone numbers, no email addresses, customer IDs replaced with placeholders. The task almost never needs the person, and a small script does that blacking-out in seconds.Redact first, deterministically: substitute emails, phones, addresses, customer IDs and listed names with per-value placeholders, keep the reversible map local, and send only the redacted copy. A vendor's retention policy applies to what you sent, so what you never sent is the only part under your control.

does the AI company train on what I paste?does the AI company train on what I paste?how do retention and training terms differ by tier?

It depends on the product and on which plan you are on, and the defaults move, so no honest answer quotes you a number. Open your vendor's data-usage page, search it for train and retain, find the matching setting in your account, and write down what you found with today's date. Redo it once a quarter.It depends on the product and on which plan you are on, and the defaults move, so no honest answer quotes you a number. Open your vendor's data-usage page, search it for train and retain, find the matching setting in your account, and write down what you found with today's date. Redo it once a quarter.Training use and retention are set per tier, and consumer, business and API terms are commonly treated differently. Read the policy for the tier you are actually on, record the training setting, the retention language verbatim, the URL and the date, and note whether a data-processing agreement is in place. Re-verify quarterly.

can I give the AI my Metrc login so it can check something?can I give the AI my Metrc login so it can check something?where should credentials live if a model needs system access?

No. Passwords, logins and keys never go in the chat window, and no amount of blacking out makes them safe. If one has already been pasted, change it today, because deleting the chat does not un-send it. The right shape is a connector that holds the key and does the reading, so the AI only ever sees results.No. Passwords, logins and keys never go in the chat window, and no amount of blacking out makes them safe. If one has already been pasted, change it today, because deleting the chat does not un-send it. The right shape is a connector that holds the key and does the reading, so the AI only ever sees results.Credentials sit behind a tool boundary: an MCP server holds the secret in an environment variable server-side and returns results only, so the key never enters context. Scope read-only until a write is deliberately gated. A key that has ever been pasted is disclosed; rotate it.