How to stop staff pasting client data into AI tools

The three remedies that do not work

A policy line. "Do not enter confidential information into AI tools." Everyone signs it. Nobody consults it at the moment of pasting, because the paste feels like a small, private act and the policy is a document read once during onboarding.

Training. Better than nothing, and it decays. Awareness training moves behaviour for a few weeks. The behaviour it is competing against saves someone twenty minutes, every day, forever.

Domain blocking. Moves the activity to unmanaged devices. You lose the logs, keep the exposure, and add friction that staff correctly perceive as the security team making their work harder.

All three share an assumption: that the leak is a discipline problem. It is not. It is a design problem. The safe action is slower than the unsafe one, so the unsafe one wins.

Five steps that do work

1. Decide what actually must never leave

Not everything is sensitive. Get specific: client names, contact details, account and case numbers, financial figures, health information, credentials and API keys. A short, concrete list is enforceable; "confidential information" is not.

2. Detect it where it is typed

Detection has to happen in the browser and in the desktop applications where staff actually work, at the moment of composition. A scanner that runs on an email gateway does not see a chat window.

3. Redact before the send, not after

Once the prompt has been transmitted, the exposure has already occurred; nothing downstream undoes it. Substitution has to happen locally, before transmission, with the real values replaced by placeholders.

4. Restore automatically so the output stays usable

This is the step that determines whether staff adopt it. If redaction returns a generic answer full of placeholders, people will bypass the tool to get a usable one. If the real names and figures are put back into the reply on the device, the user gets exactly the output they wanted and the model never saw the data. The safe path becomes the path of least resistance.

5. Log everything

Each event should record what type of entity was found, how many, when, and how long it took — with an identifier you can search. This is what converts an assurance into evidence, and it is what auditors, insurers and enterprise clients increasingly ask for.

What good looks like in practice

A support agent pastes a complaint containing a customer's name, email and a disputed amount. The sensitive values are highlighted as they appear. The agent can override any of them with one click. The model receives placeholders. The reply comes back with the placeholders in place, and the real values are restored locally before the agent reads it. The whole exchange adds roughly 68 milliseconds and one line to an audit log.

Nobody had to remember a policy. Try it on your own text.

See it on your own data.

A 30-minute walkthrough of detection, redaction and restore on the kind of documents your team actually handles.

Book a demo