Account setup and privacy before your first work chat

Check permission before uploading anything

Find out whether your employer or client permits AI use, which services and account types are approved, and what information may be shared. A personal subscription does not override an organization's security or confidentiality rules. When the policy is unclear, ask the person responsible for it before using real records.

Use official provider sites to create or access your account. Do not follow unsolicited account-verification links, share your password with a colleague, or give an assistant a login code.

• Choose the approved email/account, not whichever session is already open.
• Enable the provider's supported account-security protections, such as multi-factor authentication where available.
• Confirm you are in the intended personal or organizational workspace.

Review controls in your actual account

Data handling differs by service, account type and settings. Review the provider's current guidance on training use, retention, chat history, memory, shared links, uploaded files and connected tools. Do not infer business-account protections from a consumer-account tutorial.

Turning off one setting does not mean that every record disappears or that all processing stops. Deletion and retention behavior can include exceptions. If a particular guarantee is required for your work, obtain confirmation through your organization's approved process.

• Who can access this workspace or a shared conversation?
• What does the provider say about use of this account's content?
• Which memory or personalization features are enabled?
• Which tools have access, and how can that access be revoked?
• Where should an accidental disclosure be reported?

Make the first test deliberately harmless

Use fictional notes, synthetic names and invented addresses. Removing a person's name from a real document may not be enough: dates, locations, financial details and free-text notes can still identify them. Use the minimum information needed and avoid sensitive details altogether when practicing.

Treat connections as separate permissions

Connecting email, storage or another service can expand what an assistant can access. Verify the requested permissions and your organization's approval, even if the tool is convenient. Start with the narrowest supported access. Know how to disconnect it.

Do not assume Ginny can see an inbox or drive because you purchased a product. Tool availability, account permissions and product-specific guidance still apply. Review actions before any message is sent or a record is changed.