Pasting Work Code Into ChatGPT: What Actually Leaks

Whether it is safe to paste your employer’s code into ChatGPT comes down to one thing before anything else: whose account you are in. On a company Business or Enterprise plan, or through the API, OpenAI states that your inputs are not used to train its models by default, and there is a contract behind that promise. On your personal account, there is no such contract, and on consumer plans your conversations can be used to improve future models unless you turn that off yourself. Same code, same paste, completely different situation.

That is the technical half. The half that actually decides most cases is contractual, and this page covers both. It is education, not legal advice: if you need a binding answer about your own contract, that is a conversation with your manager or your legal team, not with an article.

What actually leaves your machine

When you paste a file into a chat window, the text goes to the provider’s servers and stays there for a while. That is the whole mechanism. It is worth being precise about it, because the imagined risk and the real risk are different things.

The imagined risk is that a model swallows your authentication logic and later recites it to a competitor who asks nicely. That is not how it works, and it is not what goes wrong.

The real exposures are more boring and more likely:

• Your text lives on someone else’s infrastructure, subject to their retention rules rather than yours.
• On consumer plans it can become training data unless you have opted out.
• Nobody at your company vetted the destination. If your employer has a security review process, you just routed around it.
• You lose the audit trail. If a client later asks where their material has been, “my personal ChatGPT” is a bad answer.

The last two are the ones that turn a shortcut into an incident, and neither of them requires anything to leak at all.

Consumer, business and API: the defaults that differ

This is the part worth getting right, because the plans genuinely behave differently and the difference is documented rather than folklore.

OpenAI’s enterprise privacy page states that it does not train on business inputs or outputs by default: that covers ChatGPT Business, Enterprise and the API. Anthropic publishes the same shape of commitment. Its privacy documentation says that by default it will not use inputs or outputs from its commercial products to train its models, with an exception where you submit feedback. We unpack that one in does Claude train on your chats. GitHub draws the same line for Copilot: per its own documentation, individual subscribers on Copilot Free, Pro, Pro+ or Max can opt out of their data being used for AI model training in their personal settings, while “GitHub does not use Copilot Business or Copilot Enterprise customer data to train AI models.”

Consumer plans are the mirror image. There, training on your conversations is generally the default and opting out is your job, not your employer’s. We keep the per-plan specifics in the plan comparison tool rather than in prose, because these settings change and a sentence in an article ages badly. If you are on a personal account today, the practical move is covered in our walkthrough on switching off model training in ChatGPT.

So the honest verdict, by account:

• ● Company account (Business, Enterprise, API): reasonable. No training by default, a data processing agreement in place, and your employer has accepted the risk on purpose.
• ▲ Personal account, training switched off, code stripped: caution. The training question is handled. The contract question is not.
• ⬣ Personal account, defaults untouched, file pasted whole: risky. Everything above applies at once, including the secrets you forgot were in the file.

The NDA framing: a contract question first

Here is the reframe that resolves most of these arguments. People debate pasting code as if it were a security question, and it is really a contract question wearing a security costume.

Your employment agreement almost certainly contains a confidentiality clause that predates ChatGPT by decades. It does not say “do not leak code.” It says something closer to: do not disclose the company’s confidential information to third parties without authorisation. A third party is exactly what OpenAI or Anthropic is when your personal account is the one talking to it. Whether the model trains on it is a detail inside that larger question, not a replacement for it.

This is why “we have no AI policy” is a weaker defence than it feels like. An empty intranet page does not cancel a signed clause. And if your employer’s work is done under client NDAs, there is often a second layer: contracts that name approved subprocessors, and a personal chat account is not on that list.

None of this means you are in breach. It means the question has an owner, and the owner is not you deciding alone at 6pm with a stack trace open. If your company genuinely has not decided, asking is a small act that makes you the person who raised it rather than the person who guessed. Our guide on what your employer can and cannot see covers the other half of that conversation.

What to strip, in the order that matters

Suppose you have concluded that a personal-account paste is acceptable for this particular snippet. Strip in this order, because the order reflects how much damage each item does.

Secrets first, because they are unrecoverable. API keys, tokens, passwords, connection strings, private certificates, webhook URLs with a signature baked in. A leaked key is not a privacy worry, it is an access grant. If one goes into a chat box, rotate it rather than hoping. This is the one item with no acceptable amount.

Identifiers second, because they are other people’s problem. Real customer names, email addresses, account and order numbers, internal hostnames, staging endpoints, employee names in comments. Test fixtures are a classic trap: they are full of what looks like fake data and is often a slice of production. If real people are identifiable in it, you have moved personal data somewhere unvetted, and in Europe that has its own consequences, which we cover in the GDPR reality check.

Last, the business logic. This is the actual intellectual property, and it is the cut that surprises people. Your CRUD layer is not a trade secret; every company has one. The pricing engine, the matching algorithm, the risk model, the thing your company is genuinely good at: that is the asset. Ironically it is also the code least likely to need ChatGPT’s help, because it is the code you understand best.

What remains after those three cuts is usually enough. Most questions you want to ask are about mechanics rather than meaning: why this async call resolves in the wrong order, what this type error means, how to restructure this loop. You can nearly always rebuild the shape of the problem with invented names and dummy values and get the same answer back. And whatever comes back still needs your judgement, which is a separate habit worth building: see how to review AI code you cannot read. If you want a second pair of eyes on a snippet before it goes anywhere, the paste check walks the same list in under a minute.

The safer routes your employer may already pay for

Before assuming your only option is a personal account, check what already exists. Companies buy these tools more often than they announce them.

A company ChatGPT Business or Enterprise seat solves the training and contract questions in one move. Copilot Business does the same inside your editor, without the copy and paste step that causes most accidents. If your team already has API credentials for anything, those inherit the no-training default too. And self-hosted or open-weights models exist for the cases where the code truly cannot leave the building, though someone has to run them.

If none of that exists, the ask is smaller than it sounds. A seat costs less than an hour of the incident-response meeting that a bad paste eventually causes, and “which of these should we buy” is a much easier conversation to start than “here is what I already did.” That is genuinely the whole play: get the paperwork to cover the habit people already have, rather than pretending the habit will stop.

Keep reading

GuidesAn AI Notetaker Joined Your Meeting. Can You Say No?Usually yes, and the polite moment is the first minute. What the bot captures, who reads the transcript later, and three scripts that aren't awkward.GuidesPasting Client Data into ChatGPT: The GDPR Reality CheckIt depends on your plan and the data. Consumer ChatGPT has no contract behind your client's data. Here is what GDPR asks for and the safer patterns.GuidesCan Your Team Admin See Your ChatGPT Chats? (Team & Enterprise)Possibly. On ChatGPT Business (the old Team plan) OpenAI says admins can view and export chats, though its pages disagree. Colleagues see only what you share.