# What you should never paste, and why A short, clear line between what's fine to share and what could get you in trouble, plus what to do if you already pasted it. **Time:** 7 minutes **What you'll have when you're done:** A rule you can apply in about five seconds, a way to strip a document in under a minute, and the steps to take if something has already gone in. **Before you start:** - Any AI chat tool you're allowed to use - Something real you've been hesitant to paste ---Most advice here is some version of "be careful." That's useless at the moment you're actually deciding, with a document open and a deadline behind you. Here is a line you can apply in about five seconds. --- ## Structure is safe. Identifiers are not. Nearly everything valuable about your problem is in its **shape**. Nearly all the risk is in the **labels** attached to it. A late invoice is a late invoice whether the customer is Northwind Traders or [CUSTOMER]. The awkward conversation with your child's teacher has the same shape whether the school is named or not. The tool needs the situation. It does not need the identity. So the question isn't "is this sensitive." It's: **Would this still be useful with the names, numbers, and identifiers replaced?** Almost always, yes. That means you can have the help without the exposure, and it takes under a minute. --- ## The list that's actually never Short, because a long list gets ignored. - **Anything that grants access.** Passwords, API keys, recovery codes, one-time codes, session links. - **Financial and identity numbers.** Full card numbers, bank account and routing numbers, Social Security numbers, passport and driver's license numbers. - **Other people's identifying details.** Home address, phone number, date of birth, medical information, a child's school and daily routine. - **Records you hold on someone else's behalf.** Customer data, patient data, employee files, anything covered by a contract or a policy you'd have to go and look up. - **Material under an agreement.** Unreleased contracts, deal terms, pre-announcement figures, code you don't own. - **Anything you'd have to report if it leaked.** If a breach form exists for it, that's your answer. One line runs underneath all six. **Other people's information isn't yours to make this decision about.** You can accept a risk on your own behalf. You can't accept it for a customer, a colleague, a patient, or a nine year old. --- ## The list that's fine, and worth saying out loud A guide that only warns produces someone who won't use the tool for anything, which is its own kind of loss. - The shape of your problem, with the names taken out - Your own writing, pasted so it can match your tone - Anything already public: published policy, a marketing page, a manual - Real numbers with the labels changed, or realistic invented ones - Your own questions, worries, and half-formed thinking That last one covers more ground than people expect. "I need to tell my landlord the water heater has broken again and I want to sound firm without being rude" contains nothing dangerous and is a genuinely good use of the thing. --- ## Stripping a document in under a minute Replace each real value with a placeholder, and keep the **kind** of thing intact so the answer still fits: ``` Northwind Traders -> [CUSTOMER] Sarah Whitfield -> [MANAGER] $48,250 -> [AMOUNT, mid five figures] March 14 -> [DATE, about six weeks ago] Lincoln Elementary -> [SCHOOL] ``` Keeping the shape matters. "[AMOUNT]" on its own loses the fact that it's large enough to need approval, and the advice changes with it. Then tell it what you've done, so it doesn't fill the gaps back in: ``` Names and figures below are replaced with placeholders in square brackets. Leave them exactly as they are. Do not guess what they stand for and do not invent replacements. ``` Map the placeholders back yourself when you paste the result into the real document. That final step is yours, and it's the whole point. **One thing that doesn't work:** pasting the real document and asking it to redact the sensitive parts. To do that, it has to receive the sensitive parts. The removal has to happen before the text leaves your screen, which means it happens in your document, by you. --- ## The honest gray areas **Your own personal data.** Your decision to make. Worth knowing you're making it: your medical symptoms or your finances in a chat window are held by a company, under terms you probably haven't read. **Work data with no written policy.** Assume the strict version until somebody puts it in writing. "Nobody said I couldn't" has never once worked as a defense, and asking produces a real answer in a day. **Health, legal, money, and anything about a child.** Not forbidden. These are the places where a confident wrong answer costs the most, so keep the identifiers out and check the substance against a person who is accountable. **A work account with a signed agreement.** Often genuinely different from a personal one, with different retention and training terms. Different, not exempt. The list above still applies to other people's records. --- ## If you already pasted something This happens, including to careful people. The order matters more than the speed. 1. **If it was a credential, change it now.** A password, a key, a code. Rotating it is the only step that truly fixes anything, and everything else on this list can wait until it's done. 2. **Delete the conversation.** This reduces exposure. It does not guarantee the data is gone from every system that touched it, so don't treat deletion as an undo. 3. **Check your data controls setting** so the same thing isn't happening quietly with everything else you type. 4. **If it was covered by a policy, tell whoever handles that, today.** This is the step people put off, and putting it off is the only thing that reliably turns a small incident into a serious one. Reported early it's a mistake. Found later it's a cover-up. Nothing here is improved by panicking about it privately for a week. --- ## When it breaks **You can't tell whether something counts as a record.** Ask who would be upset if it appeared outside your organization. If a specific person comes to mind, treat it as a record. **Stripping the identifiers made the answer useless.** Usually the placeholders lost their shape. Put the kind of thing back: not [DATE] but [DATE, two days after the deadline]. **It keeps inventing replacements for your placeholders.** Repeat the instruction at the very end of your prompt. Long prompts drop negatives first, as step two covers. **Your workplace blocks the tool entirely.** Then this guide isn't your bottleneck. A large amount of the work, thinking a problem through, structuring it, drafting, checking your logic, never needed the real records at all. That's the whole subject of Working within limits. **Someone sent you a document containing other people's details.** Receiving it didn't make it yours. Strip it or don't paste it. **You're anxious about it after reading this.** Reasonable, and not something to be talked out of. The practical version is small: keep credentials and other people's identifiers out, and you've handled most of the actual risk. --- ## What to take from this You don't need a policy document. You need one habit: before pasting, look for names, numbers, and identifiers, and replace them. The rule that settles every borderline case is to assume anything you paste could be read by a person at that company one day. Not because it's likely. Because it's the assumption that turns a five minute deliberation into a five second one.

Next