Data Sanitizer · Blog

How to safely use ChatGPT with company data

AI assistants are incredible for debugging, drafting and analysis — but the moment you paste a real log, config file or customer record into one, that data leaves your control. Here's how to get the help without the leak.

What's actually risky to paste

The danger isn't "using AI" — it's the specific values hidden inside what you paste:

• Secrets: API keys, passwords, tokens, connection strings, private keys.
• Infrastructure: internal IPs, hostnames, server names, cloud resource IDs.
• Identities: usernames, emails, employee IDs, customer names.
• Regulated PII: names, addresses, dates of birth, SSNs, payment cards.

Most company AI policies exist precisely because a single pasted secret can end up in a third party's logs or a future training set. You usually can't un-share it.

The safe workflow: redact, then paste

You rarely need the AI to see the real values — you need it to understand the structure. So replace each sensitive value with a consistent placeholder before you paste:

• Redact locally so nothing sensitive ever hits the network.
• Use consistent tokens — the same value always becomes the same token (e.g. every occurrence of one IP becomes IP_INT_01). The AI can still reason about relationships.
• Restore the answer — when the AI replies using those tokens, swap them back to real values on your side.

This keeps the reasoning intact while the secrets never leave your machine.

Why client-side matters

A redaction tool that uploads your data to "clean" it just moves the leak. The only way to be sure is a tool that runs entirely in your browser — no server, no account, no telemetry. You can verify it yourself: open your browser's Network tab and watch that nothing is sent.