AI Trade Secrets: What Never to Paste In

AI trade secrets are a problem that appears the moment an employee pastes something useful into a chat window. A pricing model, a customer list, source code, an unreleased product plan or the text of a contract can all feel like harmless material for an assistant. Legally and commercially, they may be the information that gives your company its edge, and the way you handle them can decide whether that information stays protected as a trade secret at all.

This guide explains what counts as confidential, why pasting it into an assistant is a risk, what never to paste, how to work safely with placeholders and policies and which controls to look for in a tool. It is general information, not legal advice, and rules differ by country.

What counts as a trade secret

In most legal systems, a trade secret is information that has commercial value because it is secret, and that its owner has taken reasonable steps to keep secret. The overview of trade secrets summarises the concept, and the European Union has a trade secrets directive that sets a common standard for protection. The two important phrases are “commercial value” and “reasonable steps”.

Typical examples include source code and algorithms, formulas and recipes, manufacturing methods, supplier terms, pricing logic, customer and lead lists, internal financial results, merger plans, product roadmaps, security designs and unpublished research. Information does not need to be patented or marked “confidential” to qualify, but the lack of any protection measures can weaken a claim.

The second phrase matters for AI. If staff routinely paste sensitive information into external tools with no policy, no agreement and no controls, it becomes harder to argue that the company took reasonable steps to protect it. That is a legal reason, beyond the security reason, to set clear rules.

Why AI trade secrets need their own rules

A chat assistant is an outside service. When you paste text into it, the text leaves your systems and is processed elsewhere. What happens next depends on the provider, the plan and the settings: whether the text is stored, for how long, who can access it, whether it can be used to improve models and where it is processed. Some consumer tools have historically used conversations for training unless the user opted out, while business offerings often promise not to. Do not assume; read the terms for the exact product and plan you use.

There are also non-technical leaks. Chat histories can be seen on shared computers, exported by accident or shared by link. Browser extensions can read page contents. Staff can use personal accounts for work, which bypasses company controls. And generated answers can contain fragments of what you pasted, which then travel into e-mails and documents. Our article on shadow AI at work explains how unofficial use grows and how to bring it under control without banning everything.

What never to paste into an assistant

Category	Examples	Safer approach
Credentials and keys	Passwords, API keys, tokens, private keys, connection strings	Never paste. Use placeholders and rotate anything exposed
Source code and algorithms	Proprietary modules, pricing logic, security code	Share small, anonymised snippets only; follow your company rules
Customer and personal data	Names, addresses, contracts, support tickets with identifiers	Replace with placeholders or synthetic data
Financial and strategic information	Unreleased results, merger plans, budgets, board papers	Describe the structure, not the numbers
Product and research material	Unpublished designs, formulas, test data, patent drafts	Keep inside approved systems; ask for general methods only
Third-party confidential information	Client documents, partner data under NDA	Check the agreement before any upload
Legal and HR matters	Disputes, investigations, performance records	Use approved tools and minimal data

The simplest test is to ask: if this text appeared in a competitor’s inbox tomorrow, would it matter? If yes, do not paste it into a tool without an approved agreement and clear controls. Our general checklist on what not to share with AI gives more examples for individuals.

Work with the structure, not the secret

You can still get a great deal of value from an assistant without handing over the crown jewels. The method is to separate the structure of a problem from the confidential content.

Use placeholders. Replace names with labels such as [CLIENT A], numbers with ranges or invented values and product names with generic ones.
Ask for the method. Instead of pasting the pricing model, ask how to build a margin model with tiered discounts, then apply the answer to your private data in your own tools.
Use synthetic data. Invent a small dataset with the same shape as the real one to test formulas, queries or layouts.
Share minimal excerpts. If you must show code, paste only the smallest function that reproduces the problem, with names changed.
Describe, do not upload. Explain the architecture in words and ask for review questions.

Our guide on anonymising text before using AI shows a practical routine, including how to restore the original names afterwards. Anonymisation is not perfect: details such as rare job titles, dates and combinations of facts can identify a company or person. Review the text through the eyes of someone who knows your industry.

Writing a short AI use policy

A policy does not need to be long. One page that people read beats twenty pages they ignore. Cover these points:

Approved tools. Which assistants and accounts may be used for work, and which may not.
Data classes. What is public, internal, confidential and restricted, with examples for each.
Rules per class. Public and some internal text may be used freely; confidential only with approved tools; restricted never.
Anonymisation. When and how to use placeholders and synthetic data.
Review. Who checks AI-generated output before it is used externally.
Incidents. Whom to tell, and how quickly, when something sensitive was pasted by mistake, with no blame for prompt reporting.
Training. A short session for new staff and a refresher each year.

Our guide to a company AI use policy offers a template, and the article on what to do after an AI data leak covers the incident step in detail. Align the policy with your confidentiality clauses and your contracts with clients, since some agreements restrict sending their data to third-party tools.

What to look for in a tool

When you assess an assistant for work that touches confidential material, check these points in the provider’s own documents rather than in marketing pages:

Whether your chats and files are used to train models, and whether that can be turned off.
How long data is stored and whether you can delete it and export it.
Where data is processed and which subprocessors are involved.
What security certifications and audits the provider can show.
Whether business plans offer admin controls, shared workspaces and access management.
What the contract says about confidentiality, breach notification and liability.

For companies in the EU, a data protection impact assessment may be required for some uses; see DPIA for AI tools. Note that data protection law covers personal data, while trade secret protection covers confidential business information. A tool can satisfy one and still fail the other, so check both.

Using Ask Mio carefully

Ask Mio states that chats and files are yours, are not used to train models and can be exported or deleted at any time, and that it runs on its own servers. That helps, but it does not replace your own judgement or policy. Apply the same rules you would apply to any outside service: use placeholders, share the minimum and keep restricted material in your approved systems.

Mio works well for the safe parts of the job: drafting a policy, building a data classification table, writing training material, reviewing a contract clause you have anonymised or turning an incident checklist into a one-page guide. Business plans add shared projects and team seats for organisations that want one place for approved prompts; compare plans on the pricing page.

Special cases: code, contracts and client material

Code. Developers gain a lot from assistants, and code is also where leaks are most likely. Agree on a rule for what may be shared: for example, open-source code and generic functions are fine, while modules that contain pricing logic, security checks or customer data are not. Strip comments that mention clients, remove configuration files and never include secrets. If your company uses an approved coding tool with a contract, use it for proprietary code and keep personal accounts for public material only.

Contracts. Reviewing a clause with an assistant is helpful, but a full contract often contains names, prices and terms that are confidential to both parties. Many agreements forbid disclosure to third parties without consent. Paste only the clause you need, replace the party names and amounts and ask for general risks and alternative wording. Your lawyer should still approve the final text.

Client material. Documents that belong to a client may be covered by a confidentiality agreement that you cannot waive on their behalf. Check the agreement first. When in doubt, ask the client, or work with a redacted version.

If something has already been pasted

Do not panic and do not hide it. Act in this order:

Stop using the chat and note what was pasted, when and in which account.
Delete the conversation if the tool allows it, and check whether it was shared or exported.
Tell the person responsible for security or legal matters right away.
Rotate any credentials, keys or tokens that were included, whatever the provider’s promises.
Assess whether personal data or third-party confidential information was involved, because that can trigger notification duties.
Record the facts and update the policy or training so it does not repeat.

Quick, honest reporting limits damage. A culture that punishes mistakes encourages people to hide them.

Frequently Asked Questions

Can pasting information into an AI assistant destroy a trade secret?

It can weaken your position. Trade secret protection depends on taking reasonable steps to keep information secret. Pasting it into an unapproved tool with unclear data handling can be seen as a failure of those steps. Use approved tools, clear rules and anonymisation, and ask a lawyer about your situation.

Is it safe to paste source code into a chat?

Not by default. Check your company policy and the provider’s terms first. Where allowed, share the smallest snippet that shows the problem, with names changed and no secrets. Never paste keys, tokens or proprietary algorithms into a tool that is not approved for that data.

Does a no-training promise make confidential data safe?

It reduces one risk, but not all of them. Data may still be stored, logged, accessed by staff or exposed by account sharing. Ask about retention, access controls and contracts, and still share the minimum. A promise on a website is weaker than a contract term.

What is the safest way to use AI with sensitive projects?

Separate structure from content. Use placeholders and synthetic data, ask for methods instead of uploading originals and keep restricted material in approved systems. Add a short written policy, train staff regularly and make it easy to report mistakes without blame, so problems surface early.

Should my company ban AI tools?

A ban rarely works, because people use personal accounts instead. A better approach is to approve specific tools, define what may be shared, train staff and monitor for unofficial use. Give people a safe way to get the benefits so they do not look for risky ones.

Does Mio keep my confidential text?

Mio keeps your chats so you can return to them, and you can export or delete them whenever you like. They are not used to train models. For confidential work, still use placeholders, share the minimum and follow your organisation’s own policy and contracts.

The Bottom Line

AI trade secrets are protected by habits, not by hope. Know what your confidential information is, keep credentials and restricted material out of prompts, work with placeholders and synthetic data, and publish a one-page policy that people can follow. Choose tools by their documented data handling, and report mistakes quickly. You can start with the free plan for safe tasks and compare business options on the Ask Mio pricing page.

AI Trade Secrets: What Never to Paste Into an Assistant