What information should not go into AI tools

Six categories to decide first

Walk through these with whoever owns privacy and security for your business. Hero's list is a starting point, not a legal opinion.

• Customer, patient, tenant, or guest information
• Employee, applicant, and pay information
• Financial records, forecasts, and prices you do not publish
• Passwords, keys, and incident details
• Strategy and decisions that are not public
• Material a contract, a regulator, or a copyright holder restricts

Green, yellow, red

Green: public or approved material, in an approved tool, for an approved task. Yellow: you are not sure. Stop and ask. Red: credentials, highly sensitive personal information, or anything the policy forbids. Do not paste it.

Deleting a name is not enough

Dates, amounts, addresses, and odd details can still identify a person or a job. For practice, write a fictional example. Do not lightly edit a live customer file.

Four questions before you paste

Is this tool approved? Is this task approved? Am I allowed to use this information here? Could I explain it to the customer and to my manager?

Give people one place to ask

Name who answers, and how fast. Also name what to do if someone pastes the wrong thing. A clear path beats a ban nobody follows.