Is ChatGPT safe for confidential customer technical documents?

When is ChatGPT safe for confidential customer technical documents, and when not?

ChatGPT is safe for confidential customer technical documents only when the account setting, the reader scope and the value check are all in place; any one missing turns the verdict to no. The condition table below decides whether an account and workflow can be used to draft a confidential customer technical document for a chemical product.

The row that most often fails is reader scope: a business account keeps your inputs out of training, but it does not stop margin or another customer's results reaching the customer.

Read the table as a chain: the first three rows decide whether the input stays out of model training, and the last three decide whether the finished document is fit for its reader. A business workspace passes the first test and can still fail the second, because no account setting knows who the document is for or which values came from a record. Fix the account first, then the workflow.

Does ChatGPT keep or train on the customer data you paste in?

ChatGPT may train on customer data you paste in on Free, Plus and Pro unless training is turned off, and a stored conversation is a copy of your customer's data held outside your company. OpenAI states that for Free, Plus and Pro "we may use your content to train our models", and that turning off "Improve the model for everyone" stops new conversations from being used (OpenAI Help Center, 2026). On those plans, a thumbs up or down can still put the entire conversation into training. For Business, Enterprise and Edu, OpenAI does not use prompts, responses or files to improve its models unless the organization has signed a separate agreement allowing it (OpenAI Help Center, 2026). Training and retention are separate questions. OpenAI's privacy policy says deleted conversations are removed within 30 days unless it must retain them longer, for example under a legal obligation, and content already de-identified for training while training was on is not removed (OpenAI Privacy Policy, 2026); qualifying business organizations can configure how long OpenAI retains business data (OpenAI, 2026). Customer data also carries your own duties. The EU Trade Secrets Directive protects information only when reasonable steps keep it secret (Directive (EU) 2016/943, Article 2), so check your agreements before pasting a customer's formulation or process data into any outside service.

Why does pasted internal information end up in a customer technical document?

Pasted internal information ends up in a customer technical document because a general AI chat has no way of knowing which parts of the paste are internal. A paste from a working file often holds the conclusion and its evidence next to review comments, margin figures, an internal confidence rating and results from another customer's plant. Asked to write a customer letter, the chat treats all of it as material and smooths it into fluent prose, where an internal note is harder to spot than in the original file. Gaps get filled too. NIST describes confabulation as generative AI systems generating and confidently presenting erroneous or false content (NIST AI 600-1, 2024), so a missing test temperature or lot number can appear as a plausible value. Milne Open Textbooks warns that generative AI models may provide invalid responses and that a knowledgeable reader will pick up on that quickly (Milne Open Textbooks, accessed 2026). For a customer engineer, one invented value can undo the credibility of the whole document. The risk sits in the workflow, not only in the account setting.

What should you do instead of pasting company records into ChatGPT?

Instead of pasting company records into ChatGPT, set the reader's disclosure scope first, give the tool only the scoped facts with their sources, and mark every value you have not confirmed. Work in four moves. First, write who will read the document (internal, customer or manufacturer) and what that reader must decide. Second, copy into a clean note only what that reader may see: product, test method, conditions, results and conclusion, each value with its source document. Leave review notes, scores, margin and other customers' data in the internal file. Third, mark every value without a source in the note as "not confirmed", and keep the mark in the draft until someone checks it. Fourth, before sending, compare each number in the draft against its source. The same method works with any tool, a template or a blank page. Lubinpla's document writing follows that order: it reads company records first, then public sources, asks the user once about what it still could not settle, applies the reader rules, and leaves anything it cannot confirm as an estimate with its basis stated or marked unconfirmed.