Client Secrets Paste-Stop Card

Use with Do Not Paste Client Secrets Into AI.

What this is not

Not employee workplace-secrets guidance (see the work-secrets article if you are on a payroll). Not legal advice. Not a guarantee about any vendor’s retention practices.

Before you paste, check

• Covered by NDA / confidentiality clause?
• Credentials or security details?
• Unpublished commercial figures or plans?
• Personal data about people other than me?
• Would the client be surprised which vendor receives this?
• Contract and written client approval cover this exact tool, tenant/account, purpose, and data class?

If any of the first five is yes without a clear yes on the sixth: stop.

Instead

1. Ask the client which tools are approved for confidential work; file the answer with the project.
2. If the contract permits it, reduce to a pattern question (abstract names, round numbers, no URLs/credentials) and re-check identifiability. Redaction does not automatically anonymize the data.
3. Do not paste what you do not need - even into “private” chats.

If you already pasted something you should not have

• Note what, when, and which tool
• Follow the contract and documented client incident route promptly; obtain legal or security guidance instead of deciding disclosure obligations alone
• Preserve relevant evidence and do not repeat the disclosure while responders assess it
• If credentials or access links were included, use the authorized route to revoke or rotate them
• Deleting the chat is not a full undo - treat transmission as serious