Guide

How to stop staff pasting client data into ChatGPT.

Short answer

Give staff an approved way to use AI, put a check in front of it that swaps client data for placeholders before the message leaves, and keep a log the owner reads. A ban on its own tends to move AI use to personal phones and accounts the firm can't see.

Updated September 24, 2026 · SOPHIA XT LLC

1. Write down what is allowed

Staff can't follow a rule nobody wrote. Say which AI tools are approved, what may never go in (client identifiers, tax figures, passwords, anything marked privileged), and who to ask. Our sample AI policy is a starting point you can copy. Safe-Desk can publish the policy to staff and record who accepted it.

2. Approve an account, not just a rule

Business plans are the better starting point. OpenAI says it does not train on data from ChatGPT Business and Enterprise by default (OpenAI), and Anthropic says the same for its commercial products (Anthropic). Consumer plans differ: both companies may use chats to improve their models unless the user turns that off. Either way, what staff type still reaches the provider.

3. Put a check between the keyboard and the AI

This is the step that catches the paste nobody meant to make. The Safe-Desk extension for Chrome and Edge checks what staff paste or send on ChatGPT, Claude, Gemini, Copilot, Perplexity and DeepSeek. The Windows app does the same for the ChatGPT, Claude and Copilot desktop apps. Client data becomes a placeholder such as [SSN_1]; the staff member sees the real value again in the answer. Passwords and keys are stopped. File uploads to AI sites are stopped by default; the owner can set them to warn or allow.

Today the extension installs from a download using Chrome's Developer mode, because it is not in the Chrome Web Store yet. Once it is listed, IT can force-install it so staff can't remove it. See Install the extension.

4. Close the side doors

Private and guest browser windows don't run extensions. The install guide shows the browser policies that turn them off. Personal phones are outside any browser tool; the written policy covers them.

5. Read the record

The owner's log shows who sent what kind of data, when, and which rule caught it, never the value. Phone alerts arrive when something is flagged or stopped, and a monthly report sums it up. A pattern of catches from one person is a training conversation, not a disaster.

What this costs

Safe-Desk costs $19 per staff member a month, with a 14-day free trial. Each seat includes $5 of AI a month inside Safe-Desk, pooled across the firm, and AI beyond that is billed at the model's cost plus 30%. Using your own ChatGPT or Claude through the extension or the connector costs nothing extra. Optional setup: we set it up for $149 for up to 10 staff, $10 for each extra person.

Questions

Should we just ban ChatGPT?

A ban is simple to write and hard to enforce. Staff who find AI useful tend to keep using it on personal phones and accounts, where the firm has no control and no record. An approved tool with a check in front of it keeps the use where you can see it.

Can staff get around the extension?

Today, yes: each person installs it and could remove it. Once it is in the Chrome Web Store, IT can force-install it so it can't be removed or disabled, though a person can still sign it out, and the owner sees when a device stops checking in. It does not cover browsers or apps it isn't installed in, which is what the policy is for.

Will it slow people down?

Most messages pass untouched. When something is caught, the staff member sees the placeholder go out and the real value come back in the answer, so the draft is still usable.

Try it at your firm.

Start free trial See how it works