What to mask before you upload a document to an AI assistant

Before you upload a document to an AI assistant, mask everything that points to a real person or gives access to a system: names, contact details, ID and bank numbers, health details, passwords and keys. Mask your employer's and clients' secrets too. Use consistent labels such as [NAME1] rather than black bars, so the assistant can still follow who did what.

This guide covers contracts, CVs, medical letters and log files, and what five AI vendors said about your data in September 2026. These terms change.

What sensitive data sits in a typical business document?

More than you think. Most documents mix several of these families:

• Direct identifiers: full names, signatures, photos.
• Contact details: emails, phone numbers, postal addresses.
• Official numbers: ID card, passport, social security, tax number.
• Money: IBAN, card numbers, salaries, prices.
• Special categories under Article 9 of the GDPR (EU), such as health data or trade union membership.
• Access secrets: passwords, API keys, tokens, internal URLs.
• Business secrets: client names, margins, deal terms.

Then there is what you do not see. According to Microsoft, a Word file can carry comments, tracked changes, the author's name and hidden text. Adobe says a PDF can hide metadata, comments and hidden layers. All of it travels with the file.

Should you black it out or replace it with consistent labels?

It depends on what you want back. A black bar removes a value for good, which suits a number nobody needs, like an IBAN. But in a contract full of bars, the assistant cannot tell the buyer from the seller.

Consistent labels fix this: the same value always gets the same label. Jane Example becomes [NAME1], Acme Test Ltd becomes [COMPANY1]. The assistant can still answer: [NAME1] must give [COMPANY1] 30 days of notice. You read the answer with your original at hand.

The GDPR (EU) calls this pseudonymisation. Under Article 4(5), the data can no longer be linked to a person without additional information, kept separately. Recital 26 adds that such data is still personal data. Labels lower the risk, but the law still applies.

What do AI vendors do with the files you upload?

It depends on the vendor and, even more, on the plan. Here is what each vendor's documentation said in September 2026.

• OpenAI: its help center says it may train on your ChatGPT chats unless you turn off Improve the model for everyone. ChatGPT Business, Enterprise, Edu and API data are not used by default.
• Anthropic: its privacy center says consumer chats train its models only if you allow it, though flagged chats may train its safety systems. Claude for Work and the API are not used by default.
• Google: its Gemini Apps Privacy Hub says chats can help train its AI when Keep Activity is on. Human reviewers see some chats, disconnected from the account; reviewed chats are kept for up to three years. Google asks you not to enter confidential information.
• Microsoft: its documentation says prompts, responses and Microsoft Graph data in Microsoft Copilot at work (formerly Microsoft 365 Copilot) are not used to train foundation models.
• Mistral: its help center says Vibe (formerly Le Chat) data is used for training by default unless you opt out, except for Enterprise customers.

Three lessons follow. First, not used for training does not mean not stored or never read. Second, OpenAI, Anthropic and Mistral say a thumbs up or down can let them train on that chat. Third, these pages change: check the current version for your plan, and note the date.

What do company policy and confidentiality duties require?

A vendor's promise does not replace your own duties. If the document belongs to your employer or a client, first check that you may share it at all.

In March 2023, the UK's National Cyber Security Centre advised against putting sensitive information in queries to public large language models, since the provider can see them. France's CNIL recommends internal rules on allowed and forbidden uses of generative AI. The GDPR's data minimisation principle (EU, Article 5) points the same way: share only what the task needs.

If you are a lawyer, a doctor or an accountant, your professional secrecy rules come on top. Check them first.

What should you mask in each type of document?

Use this table as a starting point. Keep the last column in mind: mask everything, and the answer is useless.

How do you prepare a document step by step?

1. Work on a copy. Keep the original to read the answer.
2. Ask whether the assistant needs the document at all. A retyped question with no real data may do.
3. Check your company policy and the vendor's terms for your plan.
4. Remove hidden data with Word's Document Inspector or Acrobat Pro's Sanitize.
5. Replace people and companies with consistent labels. Redact useless numbers with a real redaction tool, not a drawn shape.
6. Read the final file line by line, looking for clues such as job title plus employer.

On long files, a detection tool saves time. ONYRI Sanitize is one: a web app that finds and masks values in your browser, without uploading the file. It exports a PDF or PNG made of images, with no text layer. Black bars come with every plan; consistent labels need the Pro plan.

It has limits. Detection is not exhaustive, and there is no detector for medical terms in words or company names without a legal form: add those yourself. The original cannot be restored from the export, so review each item in the preview and keep your original.

Whatever the tool: share the least you can, label what the answer needs, and check the file yourself before it leaves your computer.

Frequently asked questions

Sources & references