AI Supply Chain BriefIs it safe to paste supplier data into ChatGPT? A buyer's checklist
Short answerOnly in a tool your company has approved, and ideally only after you anonymize. OpenAI says ChatGPT Enterprise and Business don't train on your data by default, and Microsoft says the same for Copilot with a work account. A personal ChatGPT account is different: your chats can train its models unless you switch that off. Export-controlled data never goes in.
Not legal adviceThis page summarizes what OpenAI and Microsoft say on their own pages, checked October 19, 2026. Vendor terms change, and your company's AI policy decides what you may use. When the two disagree, your policy wins.
Buyers want to use AI on quotes, contracts and forecasts. The two real questions are whether the data could end up training a model or being seen by someone it shouldn't, and whether you're breaking your company's rules or an NDA. The answer depends far more on which plan you're signed into than on the brand of the tool.
Which AI tool are you using? The plan matters more than the brand
| You're using | Trains on your chats by default? | What the vendor says |
|---|---|---|
| ChatGPT Enterprise, Business, Edu or the API | No | "We do not train our models on your data by default" (OpenAI enterprise privacy) |
| Microsoft 365 Copilot or Copilot Chat, signed in with a work account | No | Prompts, responses and data accessed through Microsoft Graph "aren't used to train foundation models" (Microsoft Learn) |
| Personal ChatGPT (Free or Plus) | Yes, unless you turn off "Improve the model for everyone" | With it off, "your new conversations won't be used to train OpenAI models" (OpenAI Help Center) |
| Personal ChatGPT, Temporary Chat | No, but kept for up to 30 days | Temporary chats "are not used to improve OpenAI models" and "may be retained for up to 30 days for safety purposes" (OpenAI Help Center) |
| A tool your company hasn't approved | Doesn't matter | Don't paste work data into it. Your policy applies. |
"Not used for training" is not the same as "nobody can ever see it". Your data is still stored and processed under the vendor's terms and your company's settings. OpenAI's own advice for ChatGPT users is blunt: "Users should not share sensitive information in ChatGPT that they wouldn't want to be used or reviewed." (OpenAI). One more detail from the Help Center: giving feedback on a response (thumbs up or down) can allow that whole conversation to be used for training, even if you've switched training off.
What did a real leak look like?
In 2023, Engadget reported that "soon after Samsung's semiconductor division started allowing engineers to use ChatGPT, workers leaked secret info to it on at least three occasions, according to The Economist Korea" (Engadget). The reported cases involved source code, a request to optimize code, and meeting minutes. Samsung reportedly limited prompts to 1,024 characters, and Fortune later reported that it banned employee use of generative AI tools at work, a ban the company said would be temporary.
The lesson for buyers: none of this needed a hacker. People pasted what they were working on into a tool that wasn't set up for it.
What should you never paste?
Outside an approved, governed tool, never paste:
- Export-controlled technical data (ITAR or EAR). Don't paste it into general AI tools at all, even approved ones, unless your export-compliance team has said in writing that the tool is authorized for it.
- Supplier pricing under NDA, unredacted contracts, and anything marked confidential or proprietary.
- Personal data: names, emails and phone numbers, plus bank details and credentials.
- Customer names, program names and unreleased part numbers.
How to anonymize a supplier quote in 2 minutes
Fictional exampleExample Castings Co., Example Valve Co., the buyer, the part and every number below are made up. example.com is a reserved domain that can't belong to a real company.
Before (don't paste this):
Quote Q-88231 from Example Castings Co. to A. Buyer, Example Valve Co., for part EV-2210-Rev C (impeller, Program X): $14.20/ea at 8,000/yr, tooling $18,500, lead time 9 weeks, valid to Dec 31. Contact a.buyer@example.com.
After (fine for an approved tool):
Quote from Supplier 01 for Part A (cast impeller): $14.20/ea at 8,000/yr, tooling $18,500, lead time 9 weeks, valid to [DATE].
| Removed | Replaced with | Why |
|---|---|---|
| Supplier name, quote number | Supplier 01 | Identifies the supplier and the deal |
| Buyer name, email | (removed) | Personal data |
| Part number, revision, program name | Part A (cast impeller) | Can identify your product or customer |
| Exact validity date | [DATE] | Not needed for the analysis |
The numbers usually stay, because the analysis needs them. If even the prices are sensitive, multiply every price by the same factor (for example × 1.37), tell the AI you did, and divide the results by 1.37 afterward. Ratios, rankings and percentage differences come out the same. Keep a private key that maps Supplier 01 and Part A back to the real names, and never paste the key.
Settings to check today on a personal account
Only if your company's policy allows personal accounts for work at all (many don't):
- Turn off Improve the model for everyone in ChatGPT's data controls.
- Use Temporary Chat for anything work-related.
- Delete uploaded files and chats when you're done, and don't use the feedback buttons on work chats.
OpenAI explains each control on its Data controls in ChatGPT help page; check it for the current wording and retention details rather than relying on a summary.
A 6-point checklist before you paste
- Approved tool? Is this tool and plan approved by your company for this kind of data?
- Anonymized? Supplier, people, part numbers, programs and customers replaced with codes.
- Nothing export-controlled? If you're not sure, the answer is no until export compliance says otherwise.
- Smallest excerpt? Paste the table or clause you need, not the whole file.
- Output checked? Recheck every number and claim before it goes into an email, PO or report.
- Could you show it to the supplier? If pasting it would embarrass you in front of the supplier or your legal team, don't.
This page backs the short safety checks in ChatGPT prompts for procurement and Copilot prompts for procurement. For AI on contracts, see the contract review use case; for product specs and customs codes, see HS code classification with AI. How we source and check claims: About.
The prompts in our kit are written for anonymized or sample data like the "after" version above.
More prompts like this: free 8-prompt sample · full AI Prompt Kit for Supply Chain Teams (from $7). It's our own product.
FAQ
Is ChatGPT safe for confidential information?
It depends on the plan and your company's policy. OpenAI says it does not train on business data by default for ChatGPT Enterprise, Business, Edu and the API. Personal accounts are different, and OpenAI itself advises users not to share sensitive information they wouldn't want used or reviewed. Anonymize first, and only use a tool your company approved.
Is it safe to upload work documents to ChatGPT?
Only if your company has approved the tool and plan for that kind of document. Even then, upload the smallest excerpt you need, remove names and identifiers, and never upload export-controlled, NDA-restricted or personal data unless your policy explicitly allows it.
Does ChatGPT store my data, even after I delete a chat?
OpenAI's Help Center says Temporary Chats may be retained for up to 30 days for safety purposes. For other retention questions, check OpenAI's own data controls and privacy pages, which change from time to time, rather than relying on a summary.
What happened with Samsung and ChatGPT?
In 2023, engineers in Samsung's semiconductor division reportedly pasted confidential information into ChatGPT on at least three occasions soon after it was allowed, including source code and meeting minutes, according to The Economist Korea as reported by Engadget. Fortune reported that Samsung then banned generative AI tools at work, a ban the company said would be temporary.
Does Microsoft Copilot use my company's data to train AI?
Microsoft says that with enterprise data protection, prompts, responses and data accessed through Microsoft Graph aren't used to train foundation models. That applies when you're signed in with a work account. Your company's policy still decides what you can use it for.
Can I put export-controlled or ITAR data into an AI tool?
Not without written approval from your export-compliance team that the specific tool is authorized for that data. If you're unsure whether something is export-controlled, treat it as if it is and ask them first.
