Telling your team not to use ChatGPT is a losing battle. The realistic goal is to let them use it without sending client data, secrets, or confidential content to OpenAI. That's a control problem, and it's solvable.
What actually leaves when you paste into ChatGPT
Whatever you type into the prompt box is transmitted to the AI provider. If that includes a client's name and SSN, an account number, an API key, or a privileged document, it has now left your control. For regulated firms — legal, accounting, healthcare, finance — that single paste can be a reportable disclosure or a privilege waiver. The convenience is real, but so is the exposure.
The wrong fixes
Blanket bans push usage to personal devices. 'Just be careful' policies rely on every employee redacting perfectly under deadline pressure — they won't. Enterprise AI plans help with training-data promises but still send your raw text to the provider, and they don't cover the dozen other AI tools your team also opens.
The control that works: screen before send
The reliable fix is a layer that screens the prompt before it's submitted. Emil's browser extension runs on ChatGPT and catches SSNs (with or without dashes), account and card numbers, API keys, and confidential content as you type — then redacts it or warns you before the message is sent. The safe parts of your prompt still go through; the sensitive parts don't. Nothing about the content is stored; only the finding type and severity are logged for your audit trail.
Roll it out without friction
Because it works in the tools people already use, there's no new workflow to learn. Install once, and it activates on ChatGPT, Claude, Gemini, Copilot, and Perplexity automatically. Your team keeps the speed; you get the control and the evidence that client data stayed in.