In 2023, Samsung engineers pasted internal source code into ChatGPT to debug it. Within weeks, Samsung banned generative AI tools company-wide. That story is three years old now, and the lesson still has not landed at most small businesses I talk to. The difference is that Samsung had a security team to catch it. You probably do not.
Here is the uncomfortable math: Microsoft's Work Trend Index found that 78% of AI users bring their own AI tools to work. Not company-approved tools. Their own accounts, on their own terms of service. If you employ anyone, some version of your business data has probably already been through a chatbot you did not choose.
Where the Data Actually Goes
The answer depends entirely on which door you walk through, and the doors look identical from the outside.
| How you access AI | What happens to your data |
|---|---|
| Free consumer accounts | Conversations may be used to train future models unless you find and flip the opt-out setting. Assume anything pasted here could inform a model output later. |
| Paid business tiers (Team, Enterprise) | Training on your data is off by default, with admin controls and retention settings. This is the floor for business use. |
| API access (what your automations use) | Both OpenAI and Anthropic exclude API traffic from training by default. The strongest default of the three. |
The same question pasted into a free account and a business account has two different privacy outcomes. Check provider policies for the current specifics; they change.
Notice what this means in practice. The intern using a free personal account is operating under the weakest protections in the building, and they are usually the heaviest user.
The Risk Is Rarely the Model. It Is the Account.
People imagine their trade secrets showing up verbatim in a competitor's chat window. That is not the realistic failure mode. The realistic failures are duller and more expensive:
- Contractual breach. Your client agreements likely restrict who can process client data. A personal chatbot account is a third-party processor you never disclosed.
- Privacy law exposure. If customer personal data goes into a consumer AI account, you may have created a GDPR or CCPA processing activity with no legal basis and no paper trail.
- Lost confidentiality claims. Trade secret protection depends on you taking reasonable steps to keep the secret. Pasting it into an unmanaged tool undermines exactly that argument.
Three Rules That Cover Most of It
Rule 1: Buy the business tier of one tool and name it. The single most effective move is giving your team an approved, paid option so they stop using personal accounts. The monthly cost is trivial next to the exposure it removes.
Rule 2: Sort your data into green, yellow, and red. Green is public or harmless (marketing copy, published prices). Yellow is internal but survivable (process docs, drafts). Red never goes into a chat window: customer personal data, financials, credentials, anything under NDA. Put the list on one page. People follow rules they can remember.
Rule 3: Route automations through the API, not a chat account. If a workflow touches real customer data, build it on API access where no-training defaults and data processing agreements exist. This is one reason I build client automations on the API even when a chat interface could technically do the job.
The Bottom Line
You cannot stop your team from using AI, and you should not try. What you can control is which door the data goes through. Pick the door with the contract, sort your data before it moves, and write the three rules down. That is ninety percent of the protection for one afternoon of work.
Sources
- TechCrunch, "Samsung bans use of generative AI tools like ChatGPT after April internal data leak," May 2, 2023. techcrunch.com
- Microsoft, "AI at Work Is Here. Now Comes the Hard Part," Work Trend Index (78% of AI users bring their own AI tools to work). microsoft.com
- OpenAI, "Enterprise privacy" (business and API data handling commitments). openai.com
- Anthropic, "Privacy Policy" (data handling for consumer and commercial services). anthropic.com
Not sure where your business data is leaking into AI tools?
We help small businesses set up approved AI tooling with the right data rules, so the team gets the productivity without the exposure.