How to prevent ChatGPT data leaks at work: where pasted company data goes and how to stop it

The volume is not hypothetical. A 2025 browser-telemetry study across enterprise users found that 77 percent of employees who use generative AI paste data into it, 82 percent of those pastes come from personal accounts the company cannot see, and about a fifth contain personal or payment-card data. Uploads are worse: roughly 40 percent of files sent to AI sites contained that kind of data. The paste is the leak, and these are the forms it takes.

Notice what these have in common: none of them generates a file transfer, a new domain, or a login your identity provider sees. Classic data loss prevention was built for attachments and uploads. Most of these channels never produce one.

Where the data ends up depends almost entirely on which account it was typed into. The same question in a consumer account and in a managed business workspace follows two different paths, and most employees do not know which one they are on.

The vendors publish these rules themselves. OpenAI states that content from its services for individuals may be used to train its models unless the user turns that off, and that Business, Enterprise, Edu, and API data is excluded by default. Google’s Gemini Apps privacy notice says activity is used to improve its models while the setting is on, that a subset of chats is reviewed by people, and that reviewed chats are retained for up to three years. Anthropic’s 2025 terms update asked Free, Pro, and Max users to choose whether their chats train future models, with five-year retention if they agree, and excluded Claude for Work and API use.

Then there is what nobody plans for. In 2025 a court order in a copyright case required OpenAI to retain consumer ChatGPT conversations it would otherwise have deleted, for months, while business plans were excluded. In March 2023 a bug showed some users the titles of other users’ conversations and exposed payment details of about 1.2 percent of Plus subscribers. In August 2025 OpenAI removed a “make this chat discoverable” option after shared conversations, some containing confidential material, turned up in search results. And the Samsung engineers who pasted source code into ChatGPT in 2023 did not do anything the tool warned them against. A prompt is a disclosure to a third party. Treat it as one.

No single control covers every channel. The sequence below starts with the cheapest control that removes the most risk and ends with the one most teams skip, which is the one that actually changes behavior at the keyboard.

Layers one and two are policy and procurement; our acceptable use policy guide has a one-page template. Layers five and six are tuning. Layers three and four are where most programs have a hole, because they require a control at the device rather than at the network, and that is new for many teams; the managed mobile guide covers the phone side with Intune, Jamf Pro, and Iru. The shadow AI guide explains why network and DLP controls miss prompt-based leakage. The short version is that the data never looks like a file.

Nullgen’s browser extension blocks the prompt box itself on ChatGPT, Claude, Gemini, Perplexity, Copilot on the web, and the 100+ other AI tools in its catalog, in Chrome, Edge, Firefox, and Safari. The page loads, the input stops accepting typed or pasted text, and nothing the employee tried to enter is sent anywhere, including to Nullgen. Tools you have approved are allowed by policy, for everyone or for the teams that need them.

The mobile app does the same job on managed iPhones and iPads by blocking known AI apps and websites on the device, and Android is next on the same enrollment. Everything links to one dashboard, where approvers handle requests and policies sync to devices in real time.

Nothing anyone types is read or stored. The extension recognizes a prompt field and blocks input to it; it does not inspect the text, keep browsing history, or send page content to Nullgen. That matters for the works council conversation as much as for the privacy review.

Be precise about the boundary, because an overstated control is the kind that gets switched off after the first exception.

Nullgen blocks known AI tools and the list grows continually, but it is a list, and new tools appear weekly. The approval log is your early warning: a request for a tool you have never heard of is usually the first time you hear of it.

Most teams can get from nothing to a working control in a month, and the first three weeks need no procurement cycle.