iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Keep personal, confidential, regulated and secret information out of public AI tools. Before sending a prompt or file, remove identifiers, substitute realistic placeholders and submit only the minimum material needed. For necessary business use, select an approved service only after checking retention, training use, access, subprocessors, processing location, deletion and security terms. Protect the account with a unique password, a password manager and phishing-resistant multifactor authentication (MFA), then review every response for errors, privacy leakage, bias and harmful inferences.
Privacy duties still apply when information is entered into an AI system. The Office of the Australian Information Commissioner (OAIC), updated 17 January 2025, says organisations should not put personal or sensitive information into publicly available generative-AI tools as a best practice because submitted data can be difficult to track or remove and may face security or re-identification risks.
What information should never be pasted into a public AI tool?
Do not submit information that would create harm, a legal breach or a security incident if copied, retained or exposed. A public tool may store a copy even when the chat interface looks temporary.
Secrets and credentials
- Passwords, password-reset links and one-time codes
- API keys, access tokens, private encryption keys and recovery codes
- Cloud credentials, database connection strings and internal security configurations
Personal, sensitive and regulated information
- Identifiable customer, patient, student or employee records
- Health, biometric, financial-account, identity-document and precise-location data
- Legal case details, complaints and information about children or vulnerable people
Confidential business material
- Unreleased products, strategy, source code and acquisition or pricing plans
- Information received under a confidentiality agreement
- Anything classified as regulated, secret or restricted by your organisation
The Canadian federal guidance is categorical for public servants: “Public servants must not input personal information into publicly available online generative AI tools.” It explains that sending the information can be an unlawful disclosure because the supplier may retain a copy. Your own jurisdiction, sector rules and contract terms determine the exact legal duty, so involve your privacy or legal team when the classification is unclear.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How do I decide whether a prompt is safe to send?
Classify the material first, then choose the least risky way to complete the task. If the task can be done without personal or confidential data, remove it rather than trying to justify its inclusion.
| Classification | Typical examples | Safer handling |
|---|---|---|
| Public | Published documentation, a public press release or an openly licensed dataset | Use only the portion needed; still check that the service is approved for your account. |
| Internal | Routine process notes or non-public material with low impact if disclosed | Use an organisation-approved service and avoid combining details that could identify people or projects. |
| Confidential | Client agreements, unreleased plans or proprietary code | Keep out of public tools; use an approved environment only after contractual and technical review. |
| Personal or sensitive | Names linked to contact details, health information or employee records | Remove or de-identify it. Confirm legal authority, consent and an approved processing arrangement before any use. |
| Regulated or secret | Credentials, protected financial or health records, classified information | Do not enter it into a general-purpose public AI service. Follow your organisation’s specialised controls and incident procedures. |
Record the purpose and authority for using data, especially in an organisation. Canadian privacy commissioners recommend legal authority and meaningful consent, data minimisation, de-identification where possible, retention schedules, transparency and controls that prevent re-identification.
How can I anonymise data before using AI?
Use a repeatable transformation, not a quick find-and-replace. The goal is to preserve the task’s meaning while removing details the model does not need.
- Define the task. Write down the exact question the model must answer and the fields required to answer it.
- Delete unnecessary fields. Remove names, email addresses, phone numbers, account numbers, exact dates, precise locations, free-text notes and attachments that do not affect the task.
- Replace direct identifiers. Use consistent placeholders such as
Customer-A,Employee-17orProject-River. Keep the replacement key outside the AI service. - Generalise quasi-identifiers. Change an exact birth date to an age band, a street address to a region and a timestamp to a broader period when that still serves the purpose.
- Break rare combinations. A rare job title, unusual medical condition, small town and exact date together may identify someone even without a name. Remove or broaden combinations that make a person obvious.
- Send the smallest excerpt. Share only the lines, rows or code needed, rather than an entire document or database export.
- Inspect the prompt and attachment. Check hidden comments, document metadata, tracked changes, spreadsheet tabs and image text before uploading.
- Test re-identification risk. Ask whether a colleague with ordinary background knowledge could work out who a placeholder represents. If yes, remove more detail or do not use the service.
Why anonymisation is not a guarantee
De-identification lowers risk but does not prove that identification is impossible. A model can combine clues, infer sensitive attributes or reproduce a detail that was left in the text. Treat anonymised material according to the remaining risk and the applicable law; do not promise that a transformation is irreversible.
Do AI companies store prompts and use them for training?
There is no universal answer. Retention, review, training use, deletion and access differ by provider, product tier, account setting and region, and terms can change. A chat that disappears from your screen may still be retained in logs or backups for a stated period.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Before sending business or personal data, read the current privacy notice, data-processing terms and administrator controls for the exact service. Look for a documented way to disable model-improvement use, set a retention period and delete uploaded files, and determine whether support personnel or subprocessors can access content. Do not assume that an “enterprise” label alone changes the treatment of prompts.
What should I ask an AI provider before approving it?
Procurement due diligence should produce written answers tied to the intended data classification. NIST’s Generative AI Profile (2024) highlights third-party integration risks to intellectual property, privacy and information security and recommends due diligence, transparency, risk controls, service-level agreements and security attestations.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →| Question to ask | Evidence to request or record |
|---|---|
| Are prompts and uploaded files retained, for how long, and can retention be disabled? | Retention schedule, deletion setting and the scope of backups or abuse-monitoring logs. |
| Are inputs or outputs used to train or improve models by default? | Product-specific training-use terms and the administrator control that changes the default. |
| Who can access content? | Roles for support staff, reviewers, administrators and subprocessors, plus access logging. |
| Where is data processed and stored? | Countries or regions, transfer mechanism and any regional-processing option. |
| Can the organisation delete data and obtain confirmation? | Documented deletion workflow, completion evidence and treatment of backups. |
| What security controls exist? | Encryption in transit and at rest, authentication, logging, incident notification and independent-assurance reports. |
| What does the contract permit? | Confidentiality, permitted purposes, breach response, subcontracting, audit rights and exit/deletion clauses. |
| Is the service approved for this classification and use case? | Internal risk assessment, owner, approval date and conditions of use. |
Re-check these answers when the provider changes its terms, model, hosting region or subcontractors. Keep a register of approved tools and prohibited data types so staff do not have to interpret a long contract at the moment of a prompt.
Can I use work or client data in an AI chatbot?
Only when your organisation has approved the specific service and the use has a documented legal and contractual basis. A client’s permission to perform a service does not automatically authorise sending its information to a new AI supplier.
A safe decision path
- Identify the data owner, classification, jurisdiction and purpose.
- Ask whether a public document, synthetic sample or locally run process can solve the problem instead.
- Obtain the required authority or meaningful consent and document it.
- Use a provider whose retention, training, access, geography and deletion terms match the classification.
- Apply minimisation and de-identification before upload.
- Limit access to approved staff, log the use and set a deletion date.
- Review the output before it is shared with the client or used in a decision.
The UK Department for Education’s guidance for schools similarly advises checking that a tool is approved, understanding how it uses personal data and fact-checking results. For decisions affecting employment, health, finances, education, rights or access to services, do not rely on unreviewed AI output.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How do I secure my AI account and device?
Account security prevents someone else from reading your history or using your account, but it cannot control what the provider does with prompts. Apply both login protections and data-governance controls.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Use a unique password. Have a password manager generate and store a long random password that is not reused elsewhere.
- Enable phishing-resistant MFA. Where supported, use a FIDO2/WebAuthn physical security key. CISA identifies a physical security key as the strongest anti-phishing option among the MFA methods it lists. Keep a separately stored backup key where appropriate.
- Protect recovery paths. Store recovery codes securely, remove obsolete phone numbers and review authorised sessions and connected applications.
- Secure the device. Keep the operating system and browser updated, use full-disk encryption and avoid uploading sensitive files from a shared or unmanaged computer.
- Check extensions and integrations. Browser extensions, plug-ins and connected storage can read prompts or files. Install only approved components and review their permissions.
- Use organisation controls. Apply single sign-on, role-based access, audit logs and data-loss-prevention rules where the service supports them.
CISA recommends password managers for generating and storing unique passwords. NIST notes that encrypted vaults improve security but become high-value targets; use a strong master passphrase and MFA, and compare managers on encryption, recovery, compatibility, breach alerts, update practice and whether the vendor can access vault contents.
How should I handle an AI response?
Treat output as untrusted until a qualified person reviews it. A model can invent facts, expose information from the prompt, infer sensitive traits or produce biased recommendations even when the wording sounds confident.
- Check factual claims against authoritative, current sources and preserve the source trail.
- Search the response for names, account details, confidential passages or sensitive inferences that should not be redistributed.
- Verify calculations, code, citations, dates, quotations and policy interpretations independently.
- Test for unequal treatment or harmful assumptions, especially when the output concerns a person or protected group.
- Have the accountable human make the final decision and record what was reviewed.
- Remove prompt data and generated copies according to your retention schedule.
OAIC guidance treats generated or inferred information about an identifiable person as personal information. That means an AI-created profile or prediction can trigger the same privacy responsibilities as the original record.
What should I do if sensitive data was already pasted?
Act quickly, but do not assume that deleting the visible chat removes every copy.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Stop further sharing and preserve the prompt, time, account and service details for the incident record without circulating the sensitive content.
- Use the service’s deletion and account controls, then request formal deletion if the provider offers a support or privacy channel.
- Rotate exposed passwords, API keys, tokens and certificates immediately; revoke sessions and connected applications.
- Notify your security, privacy, legal or client-contact team according to the incident plan.
- Assess whether the provider, subprocessors or another party could have accessed the data and whether notification duties apply in your jurisdiction.
- Review why the upload happened, update the approved-tool list or data-loss-prevention rule and brief affected users.
How should I compare third-party AI tools?
Compare services on risk controls, not just model quality or price. The following axes cover the differences most likely to affect confidentiality.
| Comparison axis | What a strong evaluation records |
|---|---|
| Retention and deletion | Default period, configurable limits, deletion confirmation and backup handling. |
| Training or secondary use | Whether prompts and outputs are used for model improvement, abuse review or other purposes, and how to opt out. |
| Provider and subprocessor access | Named roles, access approval, logging and the current subprocessor list. |
| Processing geography | Storage and processing regions, transfers and regional controls. |
| Encryption and access controls | Encryption, SSO, MFA, role-based permissions, session management and key ownership. |
| Auditability and contracts | Independent assurance, incident notice, confidentiality, permitted use, audit rights and exit terms. |
| Administrative controls | Central policy settings, retention administration, export and deletion tools, usage logs and data-loss-prevention integration. |
| Identity and governance fit | Enterprise identity support, phishing-resistant MFA, approval workflow and alignment with your data-classification policy. |
What are safer ways to write prompts?
State the role and desired format without exposing the underlying person or secret. For example, replace a customer’s name with Customer-A, provide only the three paragraphs that need editing, and ask for “a neutral summary in five bullet points; preserve quoted figures exactly.” Keep the mapping between Customer-A and the real identity in a separate controlled system.
For analysis, use synthetic records that match the structure but not the people. For code assistance, remove credentials, proprietary endpoints and unique business logic, then test any suggested code in an isolated environment. For document drafting, provide policy excerpts that are already approved for sharing rather than uploading the full internal manual.
Which authorities explain these precautions?
The OAIC’s guidance, updated 17 January 2025, recommends that organisations avoid entering personal and especially sensitive information into publicly available generative-AI tools because of significant and complex privacy risks. The Government of Canada’s 2023 guidance prohibits public servants from entering personal information into public online generative-AI tools. NIST’s 2024 Generative AI Profile recommends procurement due diligence, transparency, risk controls, service-level agreements and security attestations for third-party integrations. Canadian privacy commissioners emphasise authority, consent, minimisation, de-identification, retention and anti-re-identification measures. UK education guidance calls for approval checks, understanding data use and fact-checking results. CISA states that strong passwords alone are no longer enough and recommends MFA, with physical security keys providing the strongest phishing resistance among its listed methods.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsFrequently Asked Questions
Does deleting an AI chat permanently erase the prompt?
Not necessarily. Providers may retain logs, backups or abuse-monitoring records for a stated period, so check the service’s deletion terms and request confirmation when the data is sensitive.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Is a paid or enterprise AI plan automatically private?
No. A paid tier may add administrative controls, but privacy depends on the exact contract, retention setting, training-use rule, subprocessors and processing region. Approve it only after reviewing those terms.
Can I paste a customer email if I remove the customer’s name?
Removing one name may not prevent identification if the message contains a distinctive event, date, location or account detail. Generalise or remove those clues as well, and confirm that the use is authorised.
Should I use a browser extension that sends pages to an AI assistant?
Treat the extension as another third-party processor. Review its permissions and retention policy, prevent it from reading sensitive tabs, and use it only if your organisation has approved the integration.
Recommended Free Tools
What is the difference between MFA and prompt privacy?
MFA protects your account from unauthorised login; it does not limit a provider’s retention, training use or employee access to prompts. You need both strong authentication and provider due diligence.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
