Is our company data safe in ChatGPT, Claude, Gemini or Copilot at work?

The real risk is the account type, not the AI

The same four letters, "ChatGPT," can mean two very different things depending on whether someone is signed into the company's paid business account or into their own free account on a work laptop. The second one is far more common than most owners realize, and it is the one to find and fix first.

Four questions to ask before you trust the answer

1. Is this a business or enterprise seat, or someone's personal free account signed in at work? Ask IT or check the account settings directly; do not assume from the invoice.
2. Who is the admin, and what can they see? A business plan has an admin console. If nobody can name the admin, nobody is managing it.
3. Does the plan say, in writing, that it will not use our prompts to train its models? Business and enterprise terms are built to say this; free consumer terms often do not, by default. Read the vendor's own current data-use page, since terms do change (each vendor's current data-use page is the source).
4. Where does our most sensitive data actually get typed? Customer records, financial figures, anything under an NDA — know which tool, and which plan, touches that work today.

What to watch for

• Shadow AI. Staff using a personal ChatGPT, Claude, Gemini or Copilot account for work because it is faster than asking IT for the company one. Find it before you police it.
• One client, four tools. A company might have a paid Microsoft 365 Copilot seat and still have staff pasting client numbers into a free Gemini app on their phone. The paid seat does not protect what happens outside it.
• Treating "AI" as one thing. The safety question is "which account, on which plan" every time, not "is AI safe."
• No record of which tool touched what. If something goes wrong later, knowing which tool and which account was used is the first thing anyone will ask.