Blog | BeeSensible

Featured

ChatGPT in a web browser, illustrating how workplace prompts can include sensitive data

AI data leakage May 19, 2026 10 min read

ChatGPT and work data: the privacy risk is the paste

ChatGPT can be used safely at work, but the dangerous moment is often the first paste: customer records, HR notes, contracts, screenshots, and files copied into the wrong workspace.

ChatGPT is not automatically unsafe for business data, but account type and user behaviour matter. ChatGPT Business, Enterprise and Edu exclude workspace data from model training by default; personal ChatGPT workspaces can use chats for model improvement unless the user opts out. The bigger risk is still the copy-paste moment: an employee adds personal, confidential, or regulated data before settings, policy, or admins can correct it.

Read the article

Browse by topic

AI data leakage Email privacy GDPR and workplace AI Safe AI adoption Compliance and AI Comparisons

The hidden risks of AI chat logs

You delete a ChatGPT conversation and assume it is gone. But the chat log outlives the chat. A deleted conversation is not instantly nowhere, AI memory carries context forward, and on business plans an admin can read along. The one place you actually control this is the moment of pasting, not the settings afterwards.

Read the article

A decision-maker choosing between a free and a business AI account for the team

AI data leakage 8 min read

Free vs business AI accounts: the privacy difference

The biggest privacy variable in AI tools is not which tool your team picks. It is which account tier sits underneath it. A free login and an enterprise licence process the same prompt under very different terms.

Read the article

Microsoft 365 Copilot in a browser next to Word and SharePoint, illustrating how Copilot surfaces data a user can access

AI data leakage 11 min read

Microsoft Copilot inherits your access - including the files you forgot you could open

Copilot does not break permissions - it respects them perfectly. That is the problem. It makes every overshared folder, every stale 'anyone with the link', and every forgotten access right instantly findable by asking a question in plain English.

Read the article

DeepSeek chat open in a browser, illustrating where prompt data is stored and processed

AI data leakage 10 min read

DeepSeek at work: the question isn't the model, it's where your data lands

DeepSeek's model is impressive and openly licensed. But the app most people use sends every prompt to servers in China, under a legal regime with no EU adequacy. The privacy question is not how good the AI is - it's where your data sleeps, and who can ask for it.

Read the article

Google Gemini open in a browser next to Gmail, illustrating how an AI assistant sits inside the tools a team already uses

AI data leakage 11 min read

The two Geminis: which one your team uses decides your privacy risk

Gemini is not a website you visit - it's woven into Gmail, Docs, Drive, and your Android phone. The privacy question isn't only what an employee pastes into a prompt. It's which Gemini they are using, what it can already see, and what it's allowed to act on.

Read the article

Gmail compose window open on a laptop, illustrating how everyday emails share data with recipients

Email privacy 10 min read

Gmail at work: you can contract away Google, not the recipient

It is easy to worry about what Google does with your Gmail. But the platform risk is largely a contract problem - and contracts exist. The risk no agreement covers is the one that does the real damage: the data you hand to another person.

Read the article

Grok open inside the X app, illustrating how an AI assistant built into a social platform can publish conversations

AI data leakage 10 min read

Grok at work: the chatbot that publishes

Grok lives inside X, a platform built for publishing - and in 2025 its share button quietly turned hundreds of thousands of private conversations into Google-indexed web pages. When the AI sits inside a social network, 'share' and 'publish' blur, and so does the line between a work tool and a personal account.

Read the article

Meta AI inside WhatsApp and Instagram, illustrating an assistant embedded in personal social apps

AI data leakage 10 min read

Meta AI is the assistant inside your social apps - and that's the risk

Meta AI is not a separate tool you choose to open. It is built into WhatsApp, Instagram, Messenger and Facebook - the apps people use personally and, in many small businesses, for work too. It appears where the line between private and professional is already blurry, and it is a consumer product with no business protections.

Read the article

Mistral Le Chat open in a browser, illustrating an EU-based AI assistant and the limits of jurisdiction

AI data leakage 10 min read

Le Chat is the European option - and it still can't fix the paste

Mistral's Le Chat is the GDPR-friendly choice: a French company, EU data residency, no US CLOUD Act exposure by structure. All of that is real and genuinely valuable. None of it changes what an employee chooses to type into the box.

Read the article

Perplexity answer engine open in a browser, illustrating how a search-like interface invites pasting sensitive context

AI data leakage 10 min read

Perplexity feels like search - so people paste like it's private

Perplexity looks and behaves like a smarter Google, so employees treat it like one: typing in client names, internal context, and confidential questions as if it were a private search box. It isn't. It's an AI service that retains data by default - and whose crawlers have been caught ignoring the rules.

Read the article

HR professional working with employee data on a laptop, illustrating AI use in HR

GDPR and workplace AI 11 min read

Using AI Safely in HR: 7 Privacy Rules for Recruitment and People Operations

AI saves HR teams real time, but HR handles the most sensitive data an organisation holds. The biggest risk is rarely the AI itself - it is the moment a CV, a sickness record, or a review note is pasted into an open AI tool, and the moment an AI output is trusted without checking. Seven rules, and what settings do not solve.

Read the article

WhatsApp Web open in a browser with a draft message flagged for sensitive personal data, illustrating privacy risks of work messaging

Email privacy 11 min read

WhatsApp at work: why end-to-end encrypted doesn't mean safe

WhatsApp messages are end-to-end encrypted, which makes the app feel private. But encryption protects the message in transit - not who you send it to, which personal phone it lands on, or whether work data should be in a consumer channel at all. The biggest risks sit in the chat box, not the cryptography.

Read the article

Legal reviewer checking an AI vendor's data processing agreement

Compliance and AI 8 min read

Do you need a data processing agreement for an AI tool?

If an AI vendor processes personal data on your behalf, it is a processor and a data processing agreement (Article 28 GDPR) is usually mandatory. Free accounts do not have one. Here is when you need a DPA and what has to be in it.

Read the article

Outlook mailbox and new message on a laptop, illustrating privacy risks in everyday business email

Email privacy 10 min read

The privacy risks of email at work - and what Outlook settings don't solve

Outlook can be configured securely, but the biggest privacy risks don't come from Microsoft - they come from the email moment itself: the wrong recipient, a sensitive attachment, a forwarded thread. Settings help, but they don't protect against the most common failure: sending too quickly.

Read the article

Claude AI interface in a browser, illustrating how workplace prompts can expose sensitive data

AI data leakage 10 min read

What happens to your data in Claude? The privacy risks, explained

Claude can be a useful work tool, but account type determines whether Anthropic trains on your conversations. The gap that settings cannot close is the sensitive context employees paste before pressing Enter.

Read the article

An employee typing into an AI tool that remembers context from earlier conversations

AI data leakage 8 min read

How AI memory works (and how to manage it)

AI tools now remember things between conversations. Useful for preferences, risky for work: a client name or case detail you typed once can resurface in an unrelated chat weeks later. Here is how to view, manage, and delete memory in each tool.

Read the article

Blocking AI pushes use onto personal accounts and phones, out of sight as shadow AI

Safe AI adoption 8 min read

Blocking AI doesn't make you safer. It makes the risk invisible.

A hard block sounds like the safe choice. In practice it moves AI use to personal accounts and personal phones, beyond any visibility. That is shadow AI, and it is harder to govern than the behaviour you were trying to stop.

Read the article

Admin reviewing a dashboard of AI usage at work

GDPR and workplace AI 8 min read

Can an admin read your AI chats?

It depends on your account. On a free or personal account there is no employer admin above you, only the vendor. On a business or enterprise account, an admin can often reach your conversations through compliance and eDiscovery tooling.

Read the article

Sensitive data leaves the organisation through the browser, not the network or files

Safe AI adoption 8 min read

The browser became your biggest security blind spot

Almost all work now happens in the browser: AI tools, email, SaaS. That is where sensitive data leaves the organisation, not through your network or your files. But most security still watches logs, and by then the data is already gone.

Read the article

Data in a European data centre still falls under US law when the provider is American

Safe AI adoption 9 min read

Data sovereignty starts in the prompt field

Your data sits in a European data centre, so you're sovereign? Not necessarily. As long as the provider is American, the US government can reach it, wherever the servers are. And that choice isn't made by procurement, it's made by the employee who pastes something into a prompt.

Read the article

A practical way to use AI safely in a small business, in the tools you already use

Safe AI adoption 7 min read

Using AI safely in your SMB, without a big project

You don't need a security team or a large AI programme to use AI safely. Your people already use AI, and the risk lives in everyday haste. A practical layer handles it in the tools you already use, with no months-long project.

Read the article

Team workspace with laptops and browser-based AI work

Safe AI adoption 9 min read

Awareness training makes people aware. It doesn't change their behaviour.

A training on Monday does little when someone pastes a client file into ChatGPT under pressure on Thursday. Not from ignorance, but because the habit is stronger than the knowledge. Awareness only works in the moment, and everywhere: in AI tools, email, and social media.

Read the article

An AI policy on paper versus what employees actually enter into AI tools

Safe AI adoption 9 min read

You have an AI policy. Can you prove it's being followed?

Almost every organisation now has an AI policy. Very few can show what employees actually paste into ChatGPT, Copilot or Gemini. That gap between the document and the desk is the real risk, and it is wider than most leaders assume.

Read the article

Comparison between Zivver and BeeSensible for secure business email

Comparisons 12 min read

Zivver or BeeSensible? Two approaches to secure email compared

Zivver encrypts what you send. BeeSensible shows what you are about to send. Both are useful, but they work at different moments: Zivver protects the email after you send it, BeeSensible helps before you send it. Which approach fits which problem?

Read the article

Microsoft Purview and BeeSensible working as two layers: governance across the Microsoft estate and a warning at the moment of typing

Comparisons 17 min read

Microsoft Purview and BeeSensible: two layers, not a choice

Purview governs data after the fact across your Microsoft estate. BeeSensible marks sensitive data while you type, in the browser. Two moments, and together they cover more.

Read the article

AI data leakage 7 min read

Prompt redaction guide: remove, replace, or mask sensitive data before using AI

Concrete examples of risky prompts and safer alternatives for support, finance, legal, HR, healthcare, and product teams.

Read the article

Privacy officer reviewing an analytics dashboard at a workstation

GDPR and workplace AI 7 min read

GDPR and employee use of AI tools: a practical rollout guide

How to frame controller responsibility, DPIA work, employee guidance, data minimisation, and technical controls for workplace AI.

Read the article

Developer or product manager working at a laptop

AI data leakage 7 min read

AI data leakage prevention: how to stop sensitive data entering AI tools

A practical guide to reducing AI data leakage with policy, prompt hygiene, browser warnings, and evidence-backed rollout steps.

Read the article

Legal advisor reviewing AI Act obligations for an organisation

GDPR and workplace AI 9 min read

What does the AI Act mean for my business, alongside the GDPR?

The AI Act and the GDPR apply side by side. The GDPR covers personal data, the AI Act covers the AI system itself. Here are the facts that count and what most organisations must arrange now.

Read the article

Privacy officer reviewing AI tool usage at a workplace

GDPR and workplace AI 8 min read

Can my employer monitor whether I use AI?

An employer can check whether staff use AI tools, but not freely. The GDPR sets conditions on purpose, proportionality, and transparency, and works councils often have a say.

Read the article

Employee typing a prompt and checking which data it contains

AI data leakage 8 min read

What you can and cannot share with AI

A practical checklist of data you should never put in an AI tool, what is usually fine, and the rule of thumb that helps you decide in borderline cases. It applies beyond chatbots, to meeting AI, email assistants, and transcription too.

Read the article

Settings screen where training on your data is turned off

AI data leakage 8 min read

Does AI train on my data, and how do I turn that off?

Whether an AI tool uses your conversations for training depends on the account and the settings. How to turn off training, how to request deletion, and why that does not fix everything.

Read the article

Privacy officer working out GDPR measures for AI use

Compliance and AI 8 min read

GDPR and AI: which measures does the law require for AI use?

The GDPR does not mention AI, but it applies the moment you put personal data into an AI tool. Here are the concrete measures: lawful basis, data minimisation, processor role, transfers, and security.

Read the article

Security team assessing AI use within the NIS2 framework

Compliance and AI 8 min read

NIS2 and AI: what does the directive mean for your AI use?

NIS2 raises the bar on cybersecurity, governance, and incident reporting. AI tools are part of your attack surface and your supply chain. Here is how NIS2 and AI privacy meet.

Read the article

Security team bringing AI use under ISO 27001 controls

Compliance and AI 8 min read

ISO 27001 and AI: how does AI use fit into your ISMS?

ISO 27001 does not mention AI, but it requires policy, classification, supplier management, awareness, and data leakage prevention. Here is how to bring AI use under those controls.

Read the article

Healthcare worker handling patient data safely alongside AI tools

Compliance and AI 8 min read

BIO and NEN 7510: AI and privacy in government and healthcare

Government works with the BIO, healthcare with NEN 7510. Both demand strict handling of sensitive data. Here is what that means once staff start using AI tools.

Read the article

Using AI at work, without the data leaks.