A document can contain more information than the question you want an AI tool to answer. Names, comments, revision notes, hidden spreadsheet tabs and surrounding pages may reveal details that are irrelevant to the task. Start by reducing the material, not by assuming that an “AI” label tells you how it will be handled.
This practical checklist sits within the Techleez guide collection. It helps you make a decision before upload; it is not a substitute for your employer’s rules or a service’s actual terms.
Define the smallest useful input
Write the task in one sentence. If you want help improving a paragraph’s structure, a fictional example may be enough. If you want a formula explained, provide the formula and a few invented rows rather than a customer database.
| Your task | Try this first | Avoid sending by default |
|---|---|---|
| Rewrite a message | A short excerpt with invented names | The entire email thread |
| Explain a spreadsheet calculation | The formula and synthetic sample rows | Real customer, payroll or payment data |
| Summarize a public policy | The public source or relevant section | Unrelated private notes attached to it |
| Check document formatting | A sanitized copy with sample text | Signatures, identity documents or confidential appendices |
Minimization is not a guarantee of anonymity. A rare job title, location and event date can identify someone even after a name is removed. Consider the combination of details, not just obvious identifiers.
Read the controls for the actual account type
Look for the provider’s current explanations of retention, model improvement, human review, workspace sharing and deletion. Personal, business and educational accounts can operate differently. Do not rely on a social-media screenshot from a different plan.
Write down what you can confirm and what remains unclear. If a document is confidential and you cannot establish an approved handling route, do not upload it. A temporary-chat option or a private browser window is not, by itself, proof that no data is retained or processed.
Inspect the file you are about to send
- Create a separate working copy.
- Remove sections that are unnecessary for the task.
- Review comments, tracked changes, hidden sheets and document properties in the application that created it.
- Use that application’s proper redaction or sanitization tools where needed.
- Reopen the resulting file and inspect its visible content and selectable text.
Drawing a black rectangle over a name can leave the original text recoverable. If you cannot verify a redaction method, replace the sensitive content with invented text in a new document instead. Keep the untouched original in its appropriate protected location.
Check links and collaborators
A file uploaded directly to a service and a file shared by cloud link can have different exposure paths. For a cloud link, inspect whether access is restricted to named people or available to anyone with the link. Review parent-folder permissions as well. The cloud-sharing guide explains that review.
For shared AI workspaces, check who can see the conversation, attachments or resulting project. Do not add collaborators simply because a tool recommends teamwork; access should match the task.
Use a harmless pilot and verify the result
Try the workflow on a fabricated document first. Check whether the tool answers the question, whether outputs reveal more than necessary, and whether you understand how to remove the test material. A successful pilot shows the workflow is usable; it does not prove every privacy promise.
When reviewing the answer, use the AI fact-checking workflow. Protecting the input and verifying the output are separate responsibilities.
Sources and scope
Background reviewed on 28 October 2026: NIST’s Generative AI Profile, which includes privacy and information-security risks, and Google Drive’s sharing guidance. Always check your chosen AI provider’s current, account-specific documentation before uploading sensitive material.