A client emails your firm: do our files ever go into ChatGPT, and what settings do you use? If nobody on your team can answer in one sentence, you do not have an AI problem. You have a client confidentiality problem. A vague answer can cost a renewal, an insurer's questionnaire, or an audit conversation. A clear answer takes about ten minutes of settings and one page of rules.
This is the checklist I use for small offices. It covers the controls that matter in ChatGPT and the policy that makes them stick.
The situation
Take a made-up six-person bookkeeping firm. A client, a dental practice, asks in writing whether payroll and patient billing files are ever put into ChatGPT, because their insurer now asks every vendor. At the same time, the office manager knows a new bookkeeper pasted a client payroll export into ChatGPT last week, on a personal login, and nobody knows what settings that account has.
That is the pattern in most small firms: no bad intent, no policy, personal accounts on default settings.
The settings, in the order I check them
Click your name at the bottom left, choose Settings, and open Data controls. Menu names and options change by plan, so trust your own screen over this list.
1. Improve the model for everyone. The on-screen description says it controls whether your chats are used for model training. On personal plans, switching it off stops new chats from being used to train OpenAI's models. Do it on every account anyone uses for work. OpenAI says business plans such as ChatGPT Business and Enterprise do not train on your business data by default, but confirm the terms for your own plan. Turning training off does not delete your history and does not make chats secret.
2. Shared links. Data controls has a Manage button for shared links. The dialog says anyone with a link can view the shared chat, and deleting a link stops others from viewing it but does not delete your original chat. A link to a client conversation can sit there for months, so put a monthly review in the calendar.
3. Memory. Under Personalization, Enable memory lets ChatGPT personalize answers from your chats. On a shared work login it can carry one client's details into another client's chat. Most firms turn it off on shared accounts and review the memory summary on any account that keeps it on.
4. Temporary Chat. The icon at the top right starts a chat that ignores memory, plugins and custom instructions and stays out of your history. The notice at the bottom says that, for safety, a copy may be kept for up to 30 days. So it is safer, not secret. It does not replace removing names and account numbers first.
5. Export before you delete. Export data keeps a record. Delete all chats removes everything. A sensible rule: export first, and only the account owner deletes.
The one-page team policy
Settings only work if everyone follows the same ones. Mine fits on a page:
1. Use only the firm-approved ChatGPT account (a business plan if possible).
2. "Improve the model for everyone" stays off.
3. Memory stays off on shared logins.
4. Use Temporary Chat for anything sensitive.
5. Never paste passwords, full bank or card numbers, Social Security numbers,
health details, or confidential client files.
6. Review Shared links monthly. Export before you delete.
7. Not sure? Ask the policy owner before you paste.
Adapt it to your own client contracts and local rules. This is not legal advice, and your contracts come first.
Common mistakes
- Fixing the setting but not the habit. Training off does not make it safe to paste a Social Security number. Remove or mask personal details first.
- Leaving one personal account out. The policy only works if every account that touches client work follows it.
- Forgetting shared links. They outlive the conversation that created them.
- Assuming Temporary Chat means nothing is kept. The notice itself says otherwise.
Before and after
Before: a client asks, and you reply "we think it's fine" a week later. After: one approved account, a written answer you can send the same day, and a team that knows what never goes into a chat. The time you save is the open-ended scramble every time a client, insurer or auditor asks how you use AI.
Practice it without touching your real settings
I built this into a free, 16-step hands-on lesson. You play the office manager of the bookkeeping firm on a practice copy of ChatGPT, so no setting is changed and nothing is sent, and you finish with the one-page policy to copy: ChatGPT: Keep Client Data Safe, Set Up Your Team's Data Controls in 10 Minutes.
Top comments (0)