AI and sensitive information: a few settings and a few decisions

You're not early. In McKinsey's 2025 global survey, 88% of organizations said they use AI in at least one part of the business. Microsoft says 90% of the Fortune 500 use Microsoft 365 Copilot.

Plenty of people are already using it outside any company setup. In Microsoft and LinkedIn's 2024 survey, 78% of AI users said they bring their own AI tools to work. In our experience, that usually means a personal ChatGPT account connected to everything, with no settings changed. We recommend changing those settings first.

It can look complicated from the outside. The companies that went first have already worked out the practices, and for most businesses they come down to three settings and three decisions. You don't need to be perfect. Follow this guide and you'll be well ahead of most people using AI today.

Start with the basics that aren't AI

The security problems we've seen at clients didn't come from AI. They came from weak passwords, a phishing email or a risky link, on accounts with no two-step sign-in. A connected AI assistant makes a stolen password more costly, so fix this first.

• Turn on two-step sign-in for email and every business system.
• Use strong, unique passwords, kept in a password manager.
• Ask your IT provider to check security on the systems that hold sensitive information.

Then decide what is sensitive and where it lives (the rest of this guide). The AI tool comes third.

The real question is what AI can reach

Nobody wants AI that only works when you copy and paste into a chat. The value comes from connecting it to your email, calendar, files and CRM. So the question isn't what you're willing to paste. It's what those connections can reach, and what the AI can do with them.

That's where people get stuck, usually because nobody has said what's actually sensitive. Here's a pattern we see often. A business wants AI connected to its CRM. The IT provider holds off, because it contains client data. So the business and IT look at what's actually in there: names, companies, job titles, business emails and notes from calls. Most of the contact details are already on LinkedIn or company websites, and the notes are ordinary business notes. Now IT can make a specific decision instead of a blanket one.

The caution was right. It just needed to be pointed at something specific. Until that's sorted, blocking everything is the safe answer. It also means the AI can't do much for you.

The trade-off: more reach, more to correct

Every connection you add makes AI more useful. It can pull the right context, draft from the actual file and take more work off your plate. It also widens what can go wrong.

The more you connect, the more likely it is that a draft will include something that shouldn't go out. A salary figure in a summary, say, or an internal note in a client proposal. Because a person reads every draft before it goes out, that's where it gets caught. No plan survives contact with day-to-day work, and some edge cases only show up once you're using it. That's how you learn where the lines are.

When it does, fix the draft, then turn the fix into a written rule so it doesn't come back: "never include internal pricing notes in client emails." Over the first few weeks those rules add up, and the setup gets tighter each time.

Lock it down and you'll have fewer of these to find, but the AI can do less for you. Most businesses land in between: start where a mistake is cheap, keep a person reading everything that leaves, and treat giving feedback as part of the job. The rest of this guide is how to set that balance.

Three settings

1. Training off, and a team workspace once there's more than one of you. On a personal plan, turn training off. Once a team shares client work, a business workspace means the company owns the accounts and data, can remove someone's access the day they leave, and can control which apps people connect.
2. Connections need approval. In Microsoft 365 or Google Workspace, your IT provider can require admin approval before anyone connects an AI app to email or files. That way, nothing gets connected without someone deciding to.
3. Drafts, not sends. Where the tool allows it, leave send and write permissions off to start. AI prepares the email and a person sends it. That also limits the damage if an email or web page contains hidden instructions aimed at the AI. Ask IT to turn sending and editing off in the settings, then test it. Telling the AI not to send isn't enough on its own.

Three decisions

1. What's restricted? Ask of any information: if it landed in a competitor's inbox or the news, what would actually happen? For most businesses the restricted list is short: government ID numbers, bank and card numbers, health records, trade secrets, and anything a law or contract says you can't share. If your clients expect discretion, or you sign confidentiality agreements with them, client names, home addresses and property or security details belong on that list too. For everything else, check with IT before you connect it.
2. What's in each system you connect? Many connectors can reach everything your login can open, not just one folder. So decide system by system, not file by file. If a few items are truly restricted, keep them somewhere the connection doesn't use, such as a separate account. Confirm it with a quick test, not an assumption. If some information can't go to any cloud service at all, a private AI model on your own hardware is an option. It costs more and does less, so keep it for that short list.
3. What can it do on its own? Start with AI drafting and a person checking everything. Then let it earn trust one task at a time. When a routine task has run a good stretch, say 20 times in a row, with no corrections, it's reasonable to give that task lighter review, and to step back in if a mistake shows up. AI can still write a polished draft with a wrong figure in it, and courts and tribunals have now dealt with AI-invented content in more than 2,000 decisions. So anything that goes to a client, commits money or affects someone keeps a person checking facts, figures and sources.

Why this holds up: layers that cover each other

No single control is perfect. What makes AI workable with sensitive information is a few simple layers, each covering the others' gaps.

1. What's in reach. Restricted information stays out of the systems AI can reach, or is labelled so the connection skips it, where your plan supports that. What isn't there can't leak.
2. What the connection can do. Only the connections IT has approved, read-only where you can, and no sending or deleting to start. Even if AI sees something it shouldn't, it has far fewer ways to move it.
3. How it's told to work. Written instructions, both in the AI's settings or project instructions and in your team's documented processes. For example: never put salaries or banking details in a summary, flag anything from the HR folder, and keep every client email as a draft. Instructions aren't a lock, but they steer the AI away from trouble. Expect this list to grow as you use it. Most of the useful rules come from corrections.
4. A person checks. Nothing goes out without someone reading it. That's the last catch for anything the other layers miss.

With all four in place, you can do serious work with sensitive information: summarizing client files, drafting from contracts, preparing board updates. These layers lower the risk. They don't remove it. Once a system is connected, the AI provider processes whatever the AI reads from it, before anyone reviews a draft.

What this looks like in practice

The owner or CEO of a 60-person services firm wants AI across email, calendar, the CRM and SharePoint.

The CEO connects each system after IT confirms its access and permitted use. The project instructions add the third layer: never put salaries or banking details in a draft, keep CRM pricing out of client emails, and flag anything from HR for review. The layers working together are what protect the business.

Does it matter if AI trains on your data?

On business plans, training is off by default, so for most businesses this is already handled. Training means a model learns general patterns from a very large number of conversations. It isn't someone reading your files. It matters most if you hold proprietary know-how you'd never want a competitor to benefit from, a contract says your data can't be used this way, or you've promised clients their information stays private.

Either way, it's one setting. Personal ChatGPT and Claude accounts let you turn training off. What a business plan really adds is control for teams: the company owns the accounts, can remove access when someone leaves, and can manage which apps people connect. For a one-person business, a personal plan with training off can be enough, if it fits the work.

Choosing the tool

Once the basics and your restricted list are in place, the main differences between Microsoft 365 Copilot, Claude and ChatGPT are where data is stored, how each fits the systems you already use, and which one your team will actually use. All three come from large, established companies, and Microsoft's Copilot itself runs on OpenAI and Anthropic models, so the choice is often about which app your team works in. If a contract requires your data to stay in your country, that decides it. Otherwise, a decent tool that gets used every day beats a perfect tool that never gets picked up. Staff told to use a tool they dislike often go back to personal accounts with no oversight, which is the riskiest outcome of all. Our side-by-side comparison goes into the detail.

Bringing in your IT provider

Your IT provider protects the business and knows your systems best, so bring them in early. Whether a risk is worth taking is a business decision, made with their advice.

The fastest way to a useful answer is to bring specifics. Not "is AI safe?" but: "Here's our restricted list. Here's the account. These are the connections we want. AI drafts and a person sends. What do you need to approve that?"

IT providers see many clients already using personal AI accounts with no guardrails. Arriving with a restricted list, a business account and drafts-only permissions makes their job easier.

How we do it, and how our clients do it

We run our own business on ChatGPT and Claude. AI prepares the work. Chase, our founder, approves anything that leaves the business: emails, posts, prices, legal terms, payments and account changes.

With clients, the AI runs in the client's own account, and we don't keep logins to their systems. We start from each client's priorities. When they want to get into the work, we help them do it quickly and safely. When security is their top priority, we work with them and their IT provider to be thorough and get it right. Either way, the settings and decisions above are in place before each system is connected, and their IT provider approves the account and every connection. AI drafts, and the client sends.

Where to start

Put the three settings in place with your IT provider. Connect the tools that hold everyday information you're comfortable using in your day-to-day work, and leave anything riskier until you've sorted out what's in it. Keep sending and editing turned off. Review everything before it goes out, give feedback when something's off, and turn the fixes into rules. Widen what the AI can reach and do as it earns trust, with IT's agreement.

Want a hand?

You can do all of this yourself with this guide. Working with us, you start further along, and you can lean on the system, on us, or both.

• Your system starts with safe-use rules already written in as instructions. That reduces a lot of the risk from day one. It doesn't remove it, so a person still reviews everything before it goes out.
• It includes guided onboarding, so whether you use ChatGPT, Claude or Microsoft Copilot, your AI can recommend the right settings and walk you through them.
• We advise on your situation: what you want AI to do, and what's sensitive in your business.
• We work with your IT provider directly and bring them specifics they can approve.
• When an early correction comes up, the system helps turn it into a rule, and so do we.

Not sure yet where AI fits in your work or your business? Our free AI Opportunity Map is a useful place to start.

Or book a 30-minute call to start the conversation.

Worth knowing

• In personal ChatGPT, a reply you rate with a thumbs up or down can still be used for training, even with training turned off.
• Many AI tools remember past chats. For sensitive work, use a temporary chat or turn memory off.
• Don't paste passwords or access keys into a chat, and remove AI access the day someone leaves.
• If a contract requires data to stay in your country, check where the tool stores data before you connect it.
• Privacy laws apply to AI like any other tool: collect what you need, use it the way people expect, and protect it. This guide isn't legal advice; for regulated information, ask a privacy lawyer.

Accurate as of September 30, 2026. AI plans, settings and features change often, so check your provider's current documentation before relying on any detail here.

Sources

• McKinsey, 88% of organizations use AI in at least one business function: The state of AI in 2025
• Microsoft, 90% of the Fortune 500 use Microsoft 365 Copilot: Microsoft AI in Action
• Microsoft and LinkedIn, 78% of AI users bring their own AI tools to work: 2024 Work Trend Index
• ChatGPT training settings, feedback and business plans: OpenAI, how your data is used to improve model performance and OpenAI business data privacy
• Claude training settings and commercial plans: Anthropic, updates to consumer terms and Anthropic Privacy Center
• Admin approval for AI apps: Microsoft Entra, configure user consent and Google Workspace, control which apps access Workspace data
• Connectors can reach everything your login can open: OpenAI SharePoint apps and Claude Microsoft 365 connector security guide
• Memory and temporary chats: OpenAI Memory FAQ and Claude Help Center
• Court decisions involving AI-invented content: AI Hallucination Cases database
• Canadian privacy law and generative AI: Office of the Privacy Commissioner of Canada