What happens to confidential data pasted into ChatGPT?

What happens when an employee pastes a document into ChatGPT?

The text goes to OpenAI's servers. On personal plans (Free, Go, Plus, Pro), OpenAI says content is used to train its models, with an opt-out in settings ("Improve the model for everyone"). Paying for a personal plan doesn't change that.

The conversation stays in the account history until its owner deletes it. The company sees none of it: no record of what was sent, no way to delete it, and the account leaves with the employee.

Most of the time it's a client contract to summarize, a salary sheet to clean up, a live bid to proofread: data you would never hand to a vendor without a contract. What the GDPR says about it is on the page ChatGPT and GDPR.

What happened at Samsung in 2023?

In March 2023, Samsung's semiconductor division allowed ChatGPT. Within weeks, Economist Korea reported three cases: one engineer pasted source code to fix a bug, another pasted code from a tool that flags faulty equipment, a third uploaded a meeting recording to get minutes.

Samsung first capped each prompt at 1,024 bytes. In early May 2023, according to Bloomberg, an internal memo banned generative AI on company computers, tablets, phones and internal networks.

Nothing was hacked: three employees wanted to get their work done faster with the tool at hand.

Shadow AI: is it already happening at your company?

Shadow AI is the use of AI tools the company hasn't chosen or approved. In Microsoft and LinkedIn's 2024 Work Trend Index (31,000 people in 31 countries), 78% of AI users bring their own AI tools to work, and 80% at small and medium-sized companies.

A ban alone rarely holds: an employee who wants to save an hour will use their phone. What works is giving them something better, on a company account.

What do the business plans of ChatGPT, Claude or Copilot change?

They settle the training question. OpenAI doesn't train on ChatGPT Business and Enterprise data by default. Anthropic does the same for Claude Team and Enterprise. Microsoft says Microsoft 365 Copilot doesn't use your prompts, its answers or the files it reads to train its models.

They add an admin console: who has an account, which features are on, and the ability to cut access when someone leaves.

They don't settle everything. These plans are priced per user, so anyone without a license keeps using a personal account. And the assistant only knows your files if someone connects it and sets each person's permissions.

What should you do this week?

Five steps, in this order:

• Ask three teams which AI tools they use, and make clear nobody will be penalized. You'll get the real list.
• Sort your data into three levels: public, internal, confidential (clients, payroll, finance, code, live bids).
• Give an approved tool, on a company account, to everyone who needs it, not just leadership.
• Write a one- or two-page AI use policy: approved tools, data that stays out, human review.
• On the personal accounts that remain, have people turn off model training in settings.

What changes with an agent connected to your documents?

Employees no longer need to paste documents into a personal tool, because the agent already knows your files. Saména reads your documents where they live, in SharePoint, OneDrive or Dropbox, read-only, in the folders you choose. No copy of your files is kept.

What Saména keeps from your documents is encrypted with a key unique to your company, and the master key is stored outside the database. Servers are in France and the database is in the European Union. If your requirements call for it, Saména can run on your own servers or on a dedicated instance.

You choose the model: Claude, models from OpenAI, or Mistral if you prefer a French model. They run in Europe and keep none of your data.

The subscription covers the whole company with unlimited users, so nobody is left on a personal account for lack of a license. Agents cite the documents behind every answer, and nothing goes out until someone at your company approves it.

Frequently asked

Does ChatGPT Plus protect data better than the free version?

No. According to OpenAI, Go, Plus and Pro follow the same rule as the free plan: content can be used for training unless the user opts out. Business and Enterprise are the plans that change that rule.

Can we ban ChatGPT at work?

On company computers and networks, yes, which is what Samsung did in 2023. On personal phones, no. A ban holds better when an approved tool sits next to it.

Does GDPR apply when an employee pastes client data into ChatGPT?

Yes, as soon as personal data is involved (a client's or an employee's name, a file number tied to a person). The company remains responsible for that data, even when an employee sends it to a tool the company didn't choose.

Does Saména train models on our documents?

No. The model you choose runs in Europe and keeps none of your data, and what Saména keeps from your documents is encrypted with your company key. Everything can be deleted on request.

Can we keep ChatGPT or Copilot alongside Saména?

Yes. Your agents live in the Saména app and are also available from Claude, ChatGPT or Copilot. Your teams keep the assistant they know.