Last Wednesday, I fed a client contract straight into Claude

I was racing a deadline that night. I dumped the whole PDF she sent into Claude and asked AI to outline the terms. Next morning I woke up and realized: the contract had the client's ID number, bank account, and unpublished pricing. Where did they go? Some training dataset? Some employee's chat window? My stomach dropped.

I bet a lot of us have felt this. When you're racing a deadline, who hasn't just pasted client info straight into AI?

What actually happened

A news story last week made me take this seriously. Two giants — Meta (Mark Zuckerberg's) and Microsoft (Satya Nadella's) — both internally told employees to use Claude less or not at all.

Microsoft AI chief Mustafa Suleyman sent an internal email warning: uploading sensitive company data to external AI tools carries compliance risk. Meta went further and shut off the Claude option in their internal tools.

Why won't they let people use it? Two reasons. First: fear of leaks — what you say might be used to train the next AI version, or accidentally seen by others. Second: they're building their own AI, so employees using a competitor's tool looks bad to the boss.

For us small teams, the first reason is what we should actually worry about.

3 steps I can do today

Cost: $0
Time: 30 minutes to set up once, +2 min each time after
Tech barrier: if you can type, you're good — no jargon needed

Step 1: Open your usual AI tool (Claude, ChatGPT, Doubao — whatever you use). Click your avatar (top-left) → Settings → find "Help improve the model" or "Train on my conversations" and turn it off. This ensures what you say won't be used to train the next AI version.

Step 2: Before feeding documents, swap real info for placeholders. e.g., "Zhang San, ID 110xxx" → "Client A, ID A". AI helps you work out the logic, but can't see the real data.

Step 3: For contracts, quotes — anything with business secrets — don't upload the PDF directly. Redact the key bits in your local doc first, then paste the text into AI.

I'm using all three myself. Honestly, I used to dump the whole contract straight in. Now I redact first, every time, before I feel safe.

Advice by stage

If you're just starting out: You can skip this for now. Your info is mostly your own — a leak won't kill you. But build the habit: redact before AI. Future-you won't have to play catch-up.

If you have 1–2 clients: I'd do this today. Clients trusted you with their data — turning around and feeding it to AI is like handing the keys to a stranger. Three settings, 30 minutes. Don't put it off.

If you're scaling (5+ clients / have a team): This needs to become an SOP. I suggest a one-pager "AI Usage Policy": redaction template, do-not-use list, who's responsible for checking. New hires get it on day one.

Bottom line: big tech spends millions on legal teams figuring this out. We can get 90% there in 30 minutes. The difference is, they only fix it after they get caught. We can start today.