How do I stop employees pasting customer data into ChatGPT?

A policy and training help, but people still make mistakes. A control on each device that checks prompts, files and screenshots before they are sent and blocks or redacts sensitive data is the reliable layer. Inveil does this with one install per machine.

Do small businesses need AI data loss prevention?

In the Wakefield Research survey for PagerDuty, 40% of employees at companies with fewer than 1,500 staff had entered customer data into public AI tools, compared with 27% at larger firms. Small teams are exposed even without a security department.

How can a small team protect personal data in AI tools without an enterprise security stack?

Choose a tool that works on the device rather than a gateway or enterprise platform. Inveil is one small background app per machine, with rules you set yourself and a single dashboard for metrics.

Smaller companies are more likely to put customer data into public AI tools

A 2026 survey found staff at smaller companies are more likely to enter customer data into public AI tools. Here is what that means for a small team without a security department.

By Inveil · 15 October 2026

Summary

A Wakefield Research survey for PagerDuty found 40% of employees at companies with fewer than 1,500 staff have entered customer data into public AI tools, against 27% at larger firms. 66% of respondents used AI tools even though they believed company policy prohibited it. For a small team, protection has to work on the device, with no gateway to host and no security team to run it.

Wakefield Research survey of 1,250 office professionals, for PagerDuty

Each dot is 1%

40%

of staff at companies under 1,500 employees have entered customer data into public AI tools.

01

27%

of staff at larger companies did the same.
02

66%

used AI tools even though they believed company policy prohibited it.
03

~70%

of enterprise workers use public AI through personal accounts, per TELUS Digital.

Figures are as reported by the sources linked below.

The research

Wakefield Research surveyed 1,250 office professionals in Australia, Japan, the UK and the US between 9 and 20 April 2026. Respondents worked at companies with at least $500 million in annual revenue, and IT and technology roles were excluded. PagerDuty published the results on 11 June 2026.

Smaller companies leak customer data more often

Across all respondents, 43% had entered work-related correspondence into public AI tools, 34% had entered customer data and 31% had disclosed financial information or confidential documents. At companies with fewer than 1,500 employees, 40% had entered customer data, compared with 27% at larger organisations.

Smaller teams tend to have fewer written rules and no one whose job is to enforce them. The data still ends up in the same chatbots.

A policy alone does not stop it

66% of respondents used AI tools even though they believed company policy prohibited it. A separate TELUS Digital survey, reported by CXM, found that over 50% of enterprise workers enter sensitive company data into public AI tools, nearly 70% do so through personal accounts, and only about 25% say AI safety training is required.

Writing an AI policy is a sensible first step. It cannot catch an SSN pasted into a prompt at 5pm on a Friday.

"Organisations are blind to the risks of shadow AI."

Bret Kinsella, General Manager, Fuel iX at TELUS Digital

What a small team can do

Small teams cannot run a gateway, route all traffic through a proxy server or hire a security team. They need protection that works on the device and is simple to roll out.

Write a short AI policy, then back it up with a technical control so it does not rely on memory.
Check prompts, files and screenshots on each machine before they reach an AI tool.
Block the most sensitive data and redact the rest, so people can keep working.
Tell people what was removed, so they learn the rules by doing.
Report usage per person and per provider in one dashboard, so there is something to manage.

Where Inveil fits

Inveil is data loss prevention (DLP) for AI tools, made for small teams. You install one small background app on each machine and set your rules. It checks prompts, files and screenshots on the device and blocks or redacts sensitive data before it leaves. Metrics go to a single dashboard. There is no gateway to host and no network to re-route.

Inveil is data loss prevention (DLP) for AI. It checks prompts, files and screenshots on each employee's machine before they reach an AI tool, blocks or redacts sensitive data by your rules, and logs every event.

Common questions

How do I stop employees pasting customer data into ChatGPT?: A policy and training help, but people still make mistakes. A control on each device that checks prompts, files and screenshots before they are sent and blocks or redacts sensitive data is the reliable layer. Inveil does this with one install per machine.
Do small businesses need AI data loss prevention?: In the Wakefield Research survey for PagerDuty, 40% of employees at companies with fewer than 1,500 staff had entered customer data into public AI tools, compared with 27% at larger firms. Small teams are exposed even without a security department.
Is an AI usage policy enough?: No. In the same survey, 66% of respondents used AI tools even though they believed company policy prohibited it. A technical control on the device backs the policy up.
How can a small team protect personal data in AI tools without an enterprise security stack?: Choose a tool that works on the device rather than a gateway or enterprise platform. Inveil is one small background app per machine, with rules you set yourself and a single dashboard for metrics.

Sources: