AI and Privacy: Decide What Your Team Can Share
Make AI privacy decisions before anyone pastes information into a chat. Classify the material, check the actual account and settings, and give assistants only the context the task needs.
Updated 6 min read
Managing AI and privacy means deciding what information an AI service may receive, how it may handle that information, and who may access the resulting work. Classify the material first, check the particular account and its settings, then share only what the task needs. A setting about model training does not answer every privacy question.
fenbs can keep approved sharing rules and nonsensitive project context available to connected assistants. It does not inspect uploads to other AI apps or guarantee that they meet your obligations. Your first useful decision is a clear boundary between material the team may share, material needing approval, and material that must stay out.
How do you decide what information can enter an AI app?
Start with one task, such as drafting a project update. Identify what the assistant actually needs to know and which person is authorized to approve sharing it. Ownership matters: having access to a client file does not by itself mean you may send it to an outside service.
- Identify the material: public reference information, internal project details, personal information, credentials, or confidential client work.
- Check the purpose: explain why each piece is needed for this task and remove anything unrelated.
- Identify the approved account and service: do not treat a personal account as interchangeable with an organization’s reviewed workspace.
- Check the applicable agreement and team rules. Ask the responsible privacy, security, or legal colleague when permission is uncertain.
- Use a synthetic example or stop for approval when the real information is unnecessary or the sharing terms are unresolved.
The NIST Privacy Framework (opens in a new tab) is a voluntary resource for identifying and managing privacy risk. Use the same practical starting point here: understand the information and its movement before deciding which controls are sufficient. A vendor’s general privacy statement cannot make that decision for every project.
Which account settings and terms need checking?
Read the documentation for the product and account you will actually use. Record where the answer came from and when someone checked it. If an administrator controls a setting, confirm the workspace setting rather than relying on what appears in a different person’s account.
| Question | What to look for | Why it matters |
|---|---|---|
| Can this content be used for training? | The account’s data-use terms, choices, and feedback exceptions. | A training preference addresses one use of the data. |
| How is content retained? | Retention, deletion, backups, and stated exceptions. | Closing a chat does not establish that all copies are gone. |
| Who can access it? | Workspace roles, shared links, collaborators, and administrative access. | A private drafting task can become shared work. |
| What does memory save? | The product’s memory and personalization controls. | Saved context can affect later conversations. |
| What goes to outside tools? | Connected services, their permissions, and their own terms. | An additional service creates another data-sharing decision. |
For example, OpenAI’s data controls documentation (opens in a new tab) says turning off Improve the model for everyone prevents new conversations from being used for model training. It also says this does not delete saved chats. Training controls and deletion are therefore separate questions, even within one app.
Anthropic’s commercial data-use documentation (opens in a new tab) says commercial inputs and outputs are not used for training by default, while explaining exceptions for feedback or other permission. It distinguishes commercial products from consumer accounts. Check the relevant terms instead of extending a statement about one offering to every account bearing the same brand.
How much context should you give an assistant?
Give enough to complete the task, then stop. An assistant helping write a meeting agenda may need the project objective, open decisions, and next milestone. It probably does not need attendees’ home addresses, payment details, or the full history of a client dispute.
Replace real details with invented examples when you are testing a prompt or asking about structure. Describe a customer as “Customer A” if identity is irrelevant. Removing names alone is not proof that material cannot identify someone: a unique job, location, event, or combination of details may still make the person recognizable.
Separate reusable work context from restricted source files. Save a statement such as “Use the approved accessibility requirements; the source is held by the project owner,” rather than copying a sensitive document into a shared note. Our guide to an AI brain explains what a useful work record contains.
In fenbs, keep the approved sharing boundary with the project’s Decisions and rules. The record should help the next assistant ask for the right information without becoming another unnecessary copy of the underlying sensitive material.
What changes when you share a project or connect a tool?
Review the audience again. A note that was suitable for one person may be unsuitable for everyone joining a shared project. Think about what a new member can read, what their assistant can retrieve, and whether the record includes details that were never needed for the shared work.
A tool connection also changes the path information can take. List the services involved and limit access to the task. If an assistant can read a broad source library, ask whether it needs that whole library. Check sharing and access in the source service as well as the AI app.
Before connecting an assistant to fenbs, choose an appropriate role and connection access. Those permissions govern the fenbs work record; they do not control what someone separately pastes into another chat. Our guide to using AI at work covers establishing a manageable first workflow.
What should you do if the wrong material was shared?
Stop further sharing and tell the person responsible for privacy or security in your organization. Record what service and account were involved, what happened, and when, without copying the sensitive content into a general task. Follow the relevant response process and have an authorized person determine the next actions.
Review available deletion and access controls, but do not promise that removing a visible chat reverses every disclosure. If credentials were involved, have the responsible person revoke or rotate them. If another service received the information, the response needs to consider that service too.
Once the immediate issue is handled, ask what would have prevented it. The answer may be a smaller source set, clearer instructions, or an enforced access restriction. Save the nonsensitive lesson and revised rule in fenbs so a later assistant does not repeat the same assumption.
Keep the sharing rule, not the sensitive payload
Record the human-approved information boundary in Decisions and rules, alongside nonsensitive context about the project. Connected assistants read those rules first when they fetch the AI context. Keep secrets and restricted source material out of the shared record.
Create a free accountFree for one person · No credit card · Works with Claude, ChatGPT, Cursor and more
How to keep approved privacy rules with fenbs
- Create a free account and add a project with a nonsensitive description of the work.
- Record the approved rules: allowed information, excluded material, and who must resolve uncertain sharing requests.
- Add AI context notes containing only the project facts an assistant needs, with references to source owners rather than unnecessary copies.
- Have connected assistants read the AI context before starting. Record a nonsensitive lesson when a sharing mistake changes the agreed practice.
fenbs is free for one person, with no credit card. It fits the job of keeping agreed work rules available across assistants. It is not the right fit for detecting sensitive information in outbound prompts, managing legal retention requirements, or certifying privacy compliance; it does not provide those controls.
Use the AI governance collection for related policy and review questions. Start by recording one precise sharing rule before the next upload, rather than asking a colleague to remember the decision from an old chat.