Guide · AI data leaks
How do I stop employees pasting company data into ChatGPT?
Last reviewed:
Short answer
Combine a clear rule with a technical control at the point of use. Publish an AI policy that says which data must never go into AI tools, then enforce it in the browser, where files and text are sent. VAHTOR’s Files rule cancels PDF, Excel and office file attachments to AI tools before they leave the tab, and credentials and secrets are flagged on the device.
How to do it
- 1
Define what must never go into AI
For example customer personal data, credentials and API keys, financial reports and confidential documents. Keep the list short and concrete.
- 2
Give people an approved alternative
Blocking everything can push use to personal devices and accounts. Decide which AI tools are approved, and for what.
- 3
Publish the policy and get it accepted
Ask everyone to accept the current version, and keep a record of who has.
- 4
Enforce it where data leaves: the browser
Stop whole files being attached to AI tools and flag secrets before they are sent, instead of finding out afterwards.
- 5
Train people and review alerts
Explain why the rules exist, run a short quiz, and use alerts to adjust your rules.
How VAHTOR does it
VAHTOR runs the check in the browser on the employee’s laptop — not on a network proxy. If a Files rule is on, the attach is cancelled, a banner is shown, and an alert is logged without the file contents.
- PDF and Excel attaches blocked in the tab
- Credentials and secrets flagged on the device
- No root certificate, no SSL interception
- Chat text is not stored
- Real-time Data Leak Prevention (DLP) is part of the Business plan
Frequently asked questions
Can I block file uploads to ChatGPT without blocking ChatGPT?
Yes. With a Files rule, VAHTOR cancels PDF, Excel and office file attachments to AI tools, while the tool itself can stay approved.
Does VAHTOR read what people type into ChatGPT?
No. The extension matches patterns on the device. The dashboard stores a detection type and a risk level — not the prompt.
Should we just block ChatGPT completely?
It is simple, but it can push use to personal phones and accounts where you have no visibility. Approving specific tools and controlling what data goes into them keeps usage visible.
Which VAHTOR plan includes data leak prevention?
Real-time Data Leak Prevention (DLP) is part of the Business plan: €499 / month + VAT for up to 100 employees.