What Not to Paste Into an AI Tool

by Kirk Cole

Pasting a document into an AI tool takes seconds. That speed hides a decision. Whatever you paste goes to another system, under that system's terms.

Most tasks do not need the sensitive parts. A tool can tighten a collections email without the customer's name, or fix a spreadsheet formula using made-up numbers. Decide what goes in before you paste.

Decide what stays out

By default, keep these out:

  • Identity numbers: Social Security and other taxpayer ID numbers.

  • Account access: bank and card numbers, passwords, and API keys.

  • People's information: payroll records and customer details.

  • Unreleased financials: statements, forecasts, or deal terms not yet shared outside the company.

Placeholders do most of the work. Swap real details for labels like Customer A or [ACCOUNT], and put the real ones back at the end.

When you redact a PDF, use a feature that removes the text. A black box drawn on top can leave the words in the file, where anyone can copy them out.

Check the account, not just the tool

The same tool can come with different terms on a personal plan and a business plan. Before anyone uses one for work, check how long it keeps what you enter, whether your inputs can be used to train or improve its models, and who can see past conversations.

Then keep a short list of approved tools, with the account type to use and the kinds of data each may handle. Give the list one owner. A list nobody owns goes stale the first time someone signs up for something new.

Have a plan for mistakes

Say someone pastes a real payroll export to fix a formula, then sees what was in it. Speed matters more than blame.

Tell the right person first: whoever owns the tools list, or the business owner. Delete the conversation if the tool allows it, but do not treat that as the end.

Change any password that was shared. Revoke any exposed API key and issue a new one. If customer or employee information was involved, ask your attorney whether any notice is required.

Then fix the cause, whether that is a clearer rule or a practice copy of the spreadsheet with fake data.

The goal is not to avoid AI. It is to make the careful choice the easy one: a short list of what stays out, an approved account, and a clear next step when someone makes a mistake.