How to Avoid Sharing Sensitive Data With AI

Keeping sensitive data out of AI tools is not a single setting. It is a combination of choices about what you share, which accounts you use, how your organization decides what is permitted, and how those decisions stay visible when staff change. Getting each layer right reduces the chance that a useful AI habit creates a data problem.

A tool like fenbs can hold the approved handling rules and project summaries your team shares with AI apps, while the sensitive material itself stays outside the shared record. That separation keeps the useful context in one place without pulling in data that should not leave your systems.

Start with data minimization

Data minimization means giving an AI tool only what it needs for the task at hand. If you are drafting a client email, the AI needs the topic and the tone, not the client's full account history. If you are summarizing a document, paste the relevant section rather than the whole file.

The question to ask before each prompt is: does the AI need this specific detail to give a useful answer? For many tasks, the answer is no. Replacing real names with placeholders, removing account numbers, and describing context without quoting documents is enough.

This approach also makes your prompts more portable. A prompt that works on a description of the problem does not accidentally carry personal or confidential data the next time someone reuses it.

Redact before you paste

Redaction is the habit of removing or replacing identifying details before pasting text into an AI tool. For a legal team, that might mean replacing client names with "Client A." For a finance team, replacing specific dollar amounts with "the agreed amount." For HR, replacing employee names with job titles.

Redaction does not require special software. It is a habit you build into how you prepare a prompt. Some teams keep a short redaction checklist on their internal wiki: what categories of information must always be removed before sharing with an AI tool.

Make the checklist specific to your work. A medical practice handles different categories than a law firm. What counts as sensitive in your context should be decided by the people responsible for data handling, not assumed to be obvious.

Use work accounts, not personal ones

Using a personal AI account for work blurs which organization owns the interaction. Most enterprise AI plans include controls that a personal plan does not: data is not used for training, conversation logs are retained for a defined period, and an administrator can set policies for the workspace.

If your organization has an enterprise or team plan for an AI tool, use it for work tasks. If it does not, check with the person responsible for data handling before using a personal account for anything sensitive. That check takes ten minutes and removes a significant ambiguity.

For developers, the same applies to API access. Read the data handling terms for the API tier you use, particularly whether inputs are retained or used for model improvement. Check the vendor's own documentation rather than relying on a summary. See how to use AI tools at work for a broader checklist.

Know which connected tools can see what

Modern AI apps can connect to email, calendars, documents and other services. When you grant a connection, the AI can read from those sources automatically. It is worth reviewing which connections you have enabled and what each one can access.

Check connected apps in your account settings for each AI tool you use. Remove connections you no longer need. For connections you keep, understand what the AI reads automatically versus what it reads only when you ask. A connection that reads all emails to provide context is different from one that searches a specific inbox on request.

For Microsoft tools in your organization, Microsoft AI tools covers the relevant settings for Copilot and related services. For Google tools, Google AI tools covers connected-app controls.

Set team rules for what is and is not permitted

Individual habits matter, but they are not enough. Staff change, new hires join without knowing the unwritten rules, and good habits erode under deadline pressure. Written team rules make the expectations explicit and give everyone the same starting point.

A useful rule is specific enough to apply to a real situation. "Do not share sensitive data" is too vague. "Do not paste client account numbers, social security numbers or health records into any AI tool" is actionable. List the categories of data that are off-limits, and name who to ask when a situation is unclear.

Rules also need a home. A rule buried in an email thread from six months ago is not a working rule. Keep current rules somewhere the whole team can find them, and update them when the tools or the work change.

Document your choices for the next review

AI tool capabilities and data policies change. A data-handling decision that was accurate six months ago may need updating. Record not just the decision but the reasoning: "We chose not to use the document connector because client files contain protected health information." That reasoning tells the next reviewer what to check when they revisit the rule.

Set a regular review date for your approved-tool list and data rules. Quarterly is a reasonable starting point for most teams. When a new AI tool is proposed, check it against the existing rules before approving it for work use.

How to do this with fenbs

1. Create a free account. Start a project for your AI governance decisions.
2. Write each data-handling rule as a Decision. Record who decided it and the reason it applies.
3. Add a task for each review cycle. Set a next-step note so the upcoming review stays visible.
4. Connect your AI apps over MCP from Integrations. They will read the Decisions before answering work questions.
5. When a new AI tool is proposed, add a task to evaluate it. Record the outcome as a Decision once approved or declined.

A personal board is free and a reasonable place to track your own rules. When the decisions apply to a whole team, a team board gives each member a role with appropriate access and keeps the history of who decided what.