Putting client data in ChatGPT? Here is what can happen

ChatGPT swept into SME life like a gust of wind. Handy. Fast. Impressive. And free in its basic version. The catch is that what is free inside a US listed company is never really free. The data you paste there has value — for them. Not for you.

Here are three concrete cases we saw this year, anonymised but real.

Case 1: the law firm that “summarised” a divorce file

A partner at a small firm copy-pasted an entire divorce file — 47 pages, full identities, financial situations, sensitive documents — into ChatGPT to get a quick summary note.

What he did not know: by default, OpenAI may keep conversations to improve its models. And the firm’s account was not an “Enterprise” account that turns that collection off. The file data went to servers in the United States, with no contractual commitment on how it would be handled.

The cost: an internal audit triggered by bar ethics, a report to the data protection authority for traceability, three days of work blocked to reconstruct the chain of events. And a client lost when the story reached them — by chance.

Case 2: the accountant who wanted to “just” extract data

An accounting firm routinely pasted client balance sheets into ChatGPT to pull financial ratios automatically. On average, 200 balance sheets per month went to OpenAI’s servers.

An administrative check at a client surfaced a detail: a screenshot of a ChatGPT exchange with the client’s exact figures appeared in another firm’s conversation — likely after mixed contexts on OpenAI’s side or an accidental share.

The cost: a professional liability claim for breach of confidentiality, insurance premiums that doubled the following year, loss of four clients sensitive to sovereignty questions.

Case 3: the consultancy that published its custom “GPT”

An SME consultancy built a custom GPT for its sales team: client base, meeting notes, pricing, negotiation strategy. Handy to prep a meeting in two minutes.

Except that custom GPT features can, by default, expose some of the creator’s instructions and data if you ask the model the right questions. A curious competitor asked that GPT normal questions during a chat and recovered an internal price grid.

The cost: tenders lost because margins were now known, a full overhaul of the sales system, and internal unease about “who should have seen the risk”.

The underlying issue

None of these mistakes came from malice. All came from a productivity reflex that looks logical: “I have a powerful tool, I have a document, I paste, it goes faster”.

As long as the tool lives in the cloud, elsewhere, under foreign law, you cannot guarantee what happens to your data after you paste. Terms change. Settings change. Leaks happen.

What to do in practice

1. Set a written rule: “No client data goes on a foreign cloud tool”. Everyone signs. That simple.
2. Buy an Enterprise account if you insist on ChatGPT — collection is off by default. It is billed at headquarters, per user and per month.
3. Or install an assistant whose index stays with you. That is exactly what we build at Arobass.

Request a trial — we install an AroBox on your premises. Documents and the index stay on the box. To answer, the question and useful excerpts go encrypted to Arobass infrastructure.