What should never go into a prompt

Treat anything you type into an AI tool the same way you'd treat an email sent outside the organisation, because in a meaningful sense, it is.

Never paste in

• Client confidential information, unless you know your organisation's specific tool and agreement explicitly permits it.
• Personal data about identifiable individuals, employees, customers, patients, beyond what's genuinely necessary and permitted.
• Passwords, API keys, or any other credentials.
• Unreleased financial results, unannounced deals, or other market-sensitive information.
• Trade secrets or anything covered by an NDA with a third party.

If you wouldn't be comfortable with that information sitting on a server you don't control, outside your organisation's usual security boundary, don't paste it into a prompt.