Your employee just pasted your largest client's contract into ChatGPT to summarize key terms — and that data may have left your building forever. Protecting company data from ChatGPT, Microsoft Copilot, and similar tools is one of the most urgent and least-managed risks facing Metro East St. Louis businesses right now.
The AI Tools Your Employees Are Already Using — With or Without Your Permission
Most Metro East St. Louis businesses already have employees using ChatGPT or Microsoft Copilot at work regardless of whether leadership approved either tool. This is a policy gap, not an employee behavior problem, and treating it that way is the only productive starting point.
ChatGPT's free tier uses conversation data for model training by default unless users actively opt out — a setting most employees have never been shown. Microsoft Copilot operates under different rules depending on how your Microsoft 365 tenant is licensed and configured. Many Belleville and Edwardsville businesses have neither tool governed by a written policy.
What Actually Happens to Data You Type Into ChatGPT
When an employee submits a prompt containing sensitive business information to a personal or unmanaged ChatGPT account, that data is transmitted to OpenAI's servers, may be retained, and on free-tier accounts is used for model training by default. The data does not stay in your building.
OpenAI may also have human trainers review conversations. An HR manager pasting employee performance records into ChatGPT to draft a termination letter has sent that data out of the organization entirely — no audit trail, no way to retrieve or delete it. This is a broader cybersecurity posture issue, not just a policy oversight.
How Microsoft Copilot Differs — With a Critical Condition
Microsoft Copilot, within a properly licensed and configured Microsoft 365 environment, keeps data inside the organization's tenant. The critical condition: that configuration must be verified. Many Collinsville and St. Louis-area businesses run Microsoft 365 without confirming Copilot data handling is set up correctly — leaving them with a false sense of security.
| Tool | Default Data Handling | Business Controls Available |
|---|---|---|
| ChatGPT (Free) | Retained; used for model training | Opt-out only; no organizational controls |
| ChatGPT (Plus/Team) | Retained; training off by default | Limited; tied to individual accounts |
| Microsoft Copilot (M365) | Stays in tenant — if correctly configured | Strong; managed at the admin level |
The Compliance Risk Is Real — Especially in Regulated Industries
A single employee submitting patient intake notes or card payment records into an unmanaged AI tool can constitute a reportable data incident. Metro East Illinois businesses in healthcare, financial services, and retail face the clearest exposure.
- HIPAA: Submitting PHI to an unmanaged ChatGPT account is inconsistent with HIPAA compliance obligations and may require breach notification.
- PCI DSS: Pasting card processing logs into a personal AI account violates data handling requirements for any business accepting card payments.
- FTC Safeguards Rule: Auto dealers and financial services firms across Belleville and Edwardsville are subject to FTC Safeguards Rule requirements that treat AI data leakage as an information security gap.
An IT compliance framework that does not account for employee AI use is incomplete by definition in 2026.
Why Banning AI Tools Entirely Is the Wrong Answer
Blocking ChatGPT at the network level does not stop employees from using it — it pushes them to their phones on cellular data, completely outside your visibility. A ban creates a shadow IT problem and hands a productivity advantage to competitors who govern AI use rather than prohibit it.
Governance — defining what tools are approved, what data may be entered, and who has access — is the only approach that addresses both risk and business need. A managed AI platform built for business makes this practical for SMBs without a full internal IT team.
How a Managed AI Platform Closes the Gap
Hatz AI, offered by J&B Technologies as a managed AI platform built for business, gives Metro East St. Louis organizations a governed AI environment where the business — not OpenAI — controls what data goes in, what stays within the organization, and who accesses AI outputs.
J&B Technologies deploys Hatz AI through a structured Crawl → Walk → Run framework:
- Crawl: Establish an approved, business-grade AI environment with data retention controls before any employee use begins.
- Walk: Train employees on safe data inputs and build department-specific use cases — HR drafting policies, finance summarizing reports, sales generating proposals.
- Run: Measure productivity gains while maintaining a full audit trail of AI interactions across the organization.
Unlike a personal ChatGPT account, Hatz AI keeps AI activity visible and within organizational boundaries — a fundamental difference for any Metro East business with compliance obligations.
Practical Steps Metro East St. Louis Businesses Can Take This Week
Before engaging a managed IT provider, three immediate steps will reduce exposure and give you an accurate picture of where your business stands on AI data security.
- Audit current AI tool use: Ask employees which AI tools they use at work — most common are ChatGPT, Microsoft Copilot, Google Gemini, and Anthropic Claude. Review browser history with your managed IT provider for a fuller picture.
- Review Microsoft 365 Copilot settings: Verify with your IT provider that Microsoft 365 Copilot configuration and tenant data handling match your expectations — do not assume the defaults are correct.
- Draft an interim AI acceptable use policy: A one-page document defining which data categories — client PII, financial records, PHI — employees may never submit to any AI tool. A bridge to a proper managed solution, not a substitute for one.
Frequently Asked Questions
Does ChatGPT store the data my employees type into it?
ChatGPT's free tier retains conversation data by default and may use it for model training unless users opt out in account settings. OpenAI may also have human trainers review conversations. Paid enterprise tiers offer stronger controls, but most employees use personal free or Plus accounts with no organizational oversight.
Is Microsoft Copilot safe to use with sensitive business data?
Microsoft Copilot can be safe within a properly licensed and configured Microsoft 365 tenant, where data stays within the organization. The risk is that many businesses have never verified their configuration. An IT provider should audit tenant data handling settings before Copilot is used with sensitive information.
What is an AI acceptable use policy and does my small business need one?
An AI acceptable use policy defines which AI tools employees may use at work, what data they may never submit, and the consequences of violations. Any business whose employees have internet access needs one — in 2026, that means every business.
How do I stop employees from accidentally leaking client data through AI tools?
The most effective approach combines a governed AI environment — a business-grade platform that keeps data within the organization — with a written policy defining which data employees may never submit to any AI tool. Blocking AI at the network level alone pushes use to personal devices on cellular data, outside any organizational visibility.
Find Out If Your Employees' AI Use Is Putting Your Business at Risk
In a free 10-minute discovery call, a J&B Technologies advisor will ask about how your Metro East St. Louis team is currently using AI tools and walk you through exactly what a governed, business-grade AI environment would look like for your business.
Book Your Free Discovery Call
