Can you Trust AI with sensitive data? The Short Answer is No.

We all do it. You're up against a deadline, you've got a messy spreadsheet with client data or a tricky client email, and it's tempting to paste it straight into ChatGPT or Claude and let the machine do the work.

But before you upload anything sensitive, here's what you need to know.

What the experts say

Forbes puts it bluntly: "as a general rule of thumb, any conversation that you have with an LLM should be considered as exposed to a third party."

Stanford University raises the same red flag: "AI systems are so data-hungry and intransparent that we have even less control over what information about us is collected, what it is used for, and how we might correct or remove such personal information."

And here at home, the Australian Government recommends "implementing strict access controls, zero-trust infrastructure, secure data transmission and storage, secure API endpoints, and monitoring for anomalous behaviour" (precisely because LLMs can't be relied on to handle data securely on their own).

These aren't just claims thrown out into the abyss. These Issues have already happened.

In June 2026, an OpenAI agent gained unauthorised access to the Medicare Statistics Reporting Service portal (a system administered by Services Australia) after hitting blocks while searching for medicine spending data. The agent accessed both public and non-public files and wrote files to an internal server. The worst part? The government didn't find out until months later. No personal medical records were accessed this time, but it's a perfect example of data being reached that the AI provider was never meant to touch.

In 2025, a security researcher discovered more than 143,000 conversations with tools like Claude, Copilot and ChatGPT sitting accessible on Archive.org. And in July this year, the BBC reported that hundreds of Claude conversations (some containing personal and work information) were discoverable through a simple Google search, because links users had shared were being indexed by search engines.

The pattern is clear: once your data goes into an AI platform, you lose control of where it ends up.

So what AI platforms can you trust?

The key is understanding how your data is actually handled. That comes down to 3 things:

• Transparency: Does the company clearly explain how it collects, stores and uses your data? Check the privacy policy and T&Cs before you upload anything (boring, we know, but worth it).
• Track record: Has the company earned user trust? Both Anthropic and OpenAI have had incidents that erode consumer confidence, so don't assume the biggest names are the safest.
• Data usage: What happens to your data once it's fed into the LLM? Is it used to train future models? Is it deleted after your session? Look for platforms that let you opt out of training, offer enterprise tiers with data processing agreements, or guarantee Australian data residency (which comes with stricter data handling rules under our Privacy Act).

Don't think that you can't trust AI, because there are platforms out there that have the correct security measures in place. Just make sure you ask!

The bottom line

Treat every AI conversation like it could be read by someone else. Never paste in client details, financials, tax file numbers or anything you wouldn't want on the front page of the internet. If your business is using AI tools, make sure you've got a policy around what can and can't be shared, and stick to enterprise versions with proper data protections where you can.

AI is an incredible tool when it's used well. Just make sure the only thing you're uploading is de-sensitised work, or you use a platform that you can genuinely trust.