What data should a company never upload to a public AI tool?
Personal data about customers and employees, contracts and prices, unpublished financial figures, passwords, and strategic plans. Whatever you paste into a public AI tool leaves your company, and you lose control over where it ends up. For sensitive work, use private AI, like RaceMyDesk, that runs inside your company.
Pasting a document into an AI tool to summarize it or polish a text takes seconds. What most teams don't stop to think about is where that document goes next.
Why it matters
When someone on your team pastes a document into a public AI tool, that text leaves the company and is stored on someone else's servers. Depending on the tool and its settings, it can be used to improve the provider's models, kept for longer than you'd expect, or exposed through a shared link. Nobody does it in bad faith: it's just the fastest way to get an answer. That's why it happens so often.
Six types of data that should never go into a public AI tool
- Personal data about customers. Names, emails, phone numbers, ID or passport numbers, payment details, or any sensitive information they've shared with you.
- Employee data. Payroll, performance reviews, absences or anything from a personnel file.
- Contracts and commercial terms. Agreements with suppliers and partners, negotiated rates, discounts, and offers that haven't been sent yet.
- Unpublished financial information. Results, forecasts, budgets, bank details.
- Passwords and technical access. Credentials, API keys, system configurations.
- Strategy and confidential plans. Expansion plans, investor documents, negotiations in progress.
What to do instead
- Apply a simple rule: if you wouldn't email it to a stranger, don't paste it into a public AI tool.
- Remove identifying details before asking for help with a text: names, figures, company names.
- Put it in writing for your team: which tools are allowed, and what can and can't be uploaded.
- For sensitive work, use private AI, like the RaceMyDesk platform: AI that runs on your own servers, so your data never leaves the company. We explain how it works in Is it safe to let AI read your company's emails and documents?
Not a reason to avoid AI
On Hosteltur TV's panel on AI and tourism, Tomeu Gili, CEO of RaceMyDesk, warned that some documents uploaded to certain AI tools can end up public. It isn't a reason to avoid AI. It's a reason to know what you're uploading, and where.
If you wouldn't email it to a stranger, don't paste it into a public AI tool.
Key takeaways
- What you paste into a public AI tool leaves your company.
- Six types of data should never go there: customer and employee personal data, contracts, unpublished financials, passwords and strategy.
- Remove identifying details and give your team clear written rules.
- For sensitive work, use private AI, like RaceMyDesk, that runs inside your company.
Frequently asked questions
Is it enough to use the paid version of a public AI tool?
Should we ban public AI tools at work?
See how the AI Platform works
A private assistant that reads your documents and email, on your terms.
Explore AI Platform