Keep these out of a general chat
A pasted secret can remain exposed even if you later delete the visible message. Treat the following as data to withhold unless you have a clear, authorised reason and the right controls for the service you are using.
- Passwords, API keys, recovery codes, private keys, and connection strings.
- Client, employee, or patient records and identifying details.
- Contracts, invoices, and legal or medical documents containing private facts.
- Internal URLs, system diagrams, and confidential business information.
- Screenshots that reveal tabs, email addresses, access tokens, or customer names.
Replace the real case with a synthetic one
Describe the structure of the problem and invent harmless sample values. If you need help rewriting a sensitive email, explain the audience and intent without pasting names, account numbers, or the full thread.
I need to reply to a supplier about a delayed delivery.
Use these invented facts: agreed date July 8; no update by July 13.
Draft a polite request for a new date. Do not refer to a real person, order number, or contract.Know when redaction is not enough
Context can identify someone even after names are removed: a rare job title, exact date, location, or combination of events may still reveal them. For regulated or contractual data, follow the applicable policy and approved tooling rather than assuming a few black boxes make the document anonymous.
- Review the entire file, including metadata and embedded images.
- Check whether a screenshot shows browser chrome or background tabs.
- Use placeholders consistently so the model can still follow the logic.
- If the real data is essential, stop and use an authorised workflow.
Sources and limits
This checklist is a risk-reduction method, not a guarantee that a redacted document is anonymous. Provider data controls and retention settings can change.