What Never to Paste Into ChatGPT: Client Data Rules for Agencies and Firms

Never paste anything into a public chatbot that identifies a client or could harm them if it leaked: Social Security numbers, birth dates, policy and claim details, financial account numbers, passwords, signed contracts and anything covered by a confidentiality agreement. Use an approved business tool for client work, and keep a one-page rule your whole team can follow.

Your team is probably already using AI. The question is whether you decided how, or whether it just happened. This post gives you a plain list, a way to sort what goes where and one small step to take this week.

Why this matters to you

In insurance, national surveys show AI use is growing faster than rules for it. The Liberty Mutual 2026 Independent Agency Growth Study (about 1,200 agency principals and staff, national) found that 65% of agents used AI at work in the past year, yet only 18% of agencies have a well-defined AI policy and only 22% trust AI with client data. IA Magazine, Aug 20, 2026. The Big "I" 2026 Agency Universe Study (1,376 respondents, national) lists security and privacy as a barrier for 48% of agencies. Insurance Journal, Sep 24, 2026.

Put simply: people are using the tools, and most offices have not told them where the line is. In Florida, where agencies handle hurricane claims and firms handle public projects, that line matters more.

The three buckets

The easiest rule is not a long list. It is three buckets.

The never-paste list

For every office

• Personal identifiers. Social Security numbers, driver's license numbers, dates of birth tied to a name, home addresses tied to a claim or a policy.
• Financial account details. Bank, card and payment account numbers, and anything a client gave you to pay with.
• Passwords, access codes and API keys. Yours and your clients'.
• Anything under a confidentiality agreement. If a contract says it is confidential, it does not go into a public chatbot.
• Health information. Medical details from claims, injuries or employee files.

For insurance agencies

• Policy numbers together with a client's name.
• Claim files, adjuster notes and loss details.
• Underwriting information and carrier-confidential materials.
• ACORD forms that are filled in with real client data.

For A&E firms

• Client contracts, fee schedules and proposals with pricing.
• Drawings, models and reports a client has marked confidential.
• Bid strategy, pricing approach and competitor notes for an open pursuit.
• Employee records and anything from a personnel file.

A quick test: if you would not put it on a postcard, do not paste it into a public chatbot.

What "private" actually means: read the plan, not the logo

"Is ChatGPT safe?" is the wrong question. The right one is: which product, which plan, who set it up and what do the terms say?

OpenAI states that, by default, it does not use data from ChatGPT Enterprise, ChatGPT Business, ChatGPT Edu or its API platform, including inputs and outputs, to train or improve its models. OpenAI, Business data privacy, security, and compliance. That page covers those business products. It does not address free or personal ChatGPT accounts, so do not assume the same terms apply there. Check the settings and terms for every plan your team uses.

Two more points that matter in an office:

• Personal accounts are the weak spot. If an employee uses a personal login, your office has no control over the settings, the history or what happens when that person leaves.
• "Not used for training" is not the same as "safe for anything." Even with a business plan, you still decide what data your office is allowed to send, and who can see it.

Where to start: one small, safe step

You do not need a long policy to begin. Spend 20 minutes this week on this:

1. Ask your team one question. "Which AI tools do you use for work, and on what kind of account?" Make it safe to answer honestly. You are mapping use, not catching people.
2. Write the three buckets on one page. Use the table above. Add your office name and today's date.
3. Name one approved tool for client work and say who owns the account.
4. Share it, and review it in 90 days.

A short note on how we build

These rules are also how we think about our own products. For example, Blueprint AI works with the permissions of the person asking, does not save changes without confirmation and logs each action. Whatever tools you choose, ask every vendor the same three questions: what can it see, does it ask before it saves, and can you see what it did?

How we use AI ourselves. At Bright Coast, our own insurance agency, general AI tools help us draft email templates for client communication, using general knowledge only, and set up follow-up automations for clients. At Designda, our own engineering firm, the team is about to connect Claude for daily tasks, because their work involves less sensitive content. How each person uses it varies by role.