Support · ChatGPTDraft a short reply to Anna de Vries at anna@devries.example. Her refund is approved, and we will call her on +31 6 1420 2287 on Monday.
3 values would leave the device
Why SendSafe
AI is already in every workflow. With SendSafe, it can stay there.
Teams reach for an AI assistant many times a day, because it helps. SendSafe runs on the device and swaps personal data for neutral labels as a request is sent, so your people keep using AI.
SendSafeProtecting
ChatGPTPrompt sent
- Anna de VriesPERSON_1
- anna@devries.exampleEMAIL_1
- NL91 ABNA 0417 1643 00ACCOUNT_1
Answer restored
What leaves, every ordinary day.
People aren't careless, they're in a hurry. And each paste carries details that were never meant to leave.
Support · ChatGPT
Back office · ClaudeMake this confirmation warmer. Tom Bakker, refund to NL91 ABNA 0417 1643 00.
2 values would leave the device
Care coordination · GeminiSummarise for handover: Ruth Meijer from Zwolle. Prefers calls after 5pm on 06 5127 3904.
3 values would leave the device
Engineering · CopilotWhy does this test fail? expect(email).toBe("sanne@visser.example")
1 value would leave the device
Legal · MistralTighten clause 4 of the settlement with Mark Hendriks from Breda.
2 values would leave the device
Finance · ChatGPTWrite a payment reminder for invoice 8812 to Sanne Visser at sanne@visser.example.
2 values would leave the device
Three ways to handle AI and personal data.
Every company picks one of these, on purpose or by default. Here is what each one does to the work and to the data.
Ban AI
Block the tools at work.
- Con: Work moves to phones and personal accounts
- Con: IT loses sight of AI use that still happens
- Con: Teams lose the time AI saves
- Pro: No company data reaches an AI provider through official channels
Classic DLP
Scan traffic and block what looks sensitive.
- Con: A blocked prompt stops the person mid-task
- Con: Tuning rules for open text takes ongoing effort
- Con: Often inspects content centrally
- Pro: Familiar to security teams
SendSafe
Swap the details, keep the question.
- Pro: The prompt goes through, with neutral labels
- Pro: Details are restored in the answer, on the laptop
- Pro: Rules per team, reports per team, never per person
- Con: One control, not a full compliance programme
A general comparison of approaches, not of specific products.
Training can't stop a paste at 16:55 on a Friday.
Awareness matters, and it should continue. But good intentions are not a control, and the riskiest moments are the rushed ones.
Support · ChatGPTCustomer is waiting, can you turn this into a polite reply? Lena Vos, lena@vos.example, order #48213, refund approved.
Sent before anyone thought twice
People are busy
At the end of a long week, with a queue waiting, nobody stops to scrub a prompt by hand.
Sensitive data is not always obvious
An account number or phone number in a long pasted email thread is easy to miss.
A control does not rely on memory
SendSafe acts at the moment of sending, on every request, without asking anyone to remember.
Why local-first.
The safest place for a sensitive value is where it already is.
No new place to protect
A cloud filter would need to see every original value to replace it, creating a new copy of exactly the data you want to keep close.
Working on the device avoids that. There is no central store of employee prompts to secure, audit or breach. And because the AI still receives the full question with its context, the answers stay useful.
Where regulation comes in.
Pasting personal data into an AI tool is first a GDPR question: is there a lawful basis, where does the data go, and which processors handle it? The EU AI Act adds obligations around how AI is used and governed. SendSafe reduces how much personal data reaches AI providers. It does not make an organisation compliant on its own. This overview is not legal advice.
GDPR
Up to €20 million or 4%of total worldwide annual turnover, whichever is higher
Applies to personal data in any tool, including the prompts sent to an AI provider.
Source: EUR-Lex, Regulation (EU) 2016/679EU AI Act
- €35 million or 7%Prohibited AI practices
- €15 million or 3%Most other obligations
- €7.5 million or 1%Supplying incorrect information
Maximum amounts, as a fixed sum or a share of total worldwide annual turnover. For SMEs and start-ups, the lower of the two applies. The top tier is for prohibited practices, not for everyday use of an assistant. For a team drafting emails with AI, the duty that applies today is Article 4: support the AI literacy of your staff.
Source: EUR-Lex, Regulation (EU) 2024/1689When the AI Act applies, as of September 2026
- Prohibitions and Article 4 (AI literacy) apply
- Obligations for general-purpose AI models apply
- Digital Omnibus, Regulation (EU) 2026/1744, in force. Article 4 becomes a duty to take measures that support AI literacy
- Transparency obligations under Article 50 apply
- High-risk obligations for Annex III systems, deferred by the Omnibus
Questions about AI and personal data.
Short answers, with the sources on EUR-Lex. This overview is not legal advice.
Can you put customer data in ChatGPT?
Not without safeguards. Customer names, email addresses and phone numbers are personal data under GDPR, and when you send a prompt they go to the AI provider, outside your organisation. SendSafe swaps those details for neutral labels at the moment of sending, so the AI still gets the whole question, just not the details. The lawful basis, provider contracts and policies remain your organisation's responsibility.
What does GDPR say about personal data in prompts?
Names, email addresses and phone numbers in a prompt are personal data. Under Article 83 of the GDPR, fines go up to €20 million or 4% of worldwide annual turnover.
What does Article 4 of the EU AI Act require?
Article 4 is about AI literacy: it asks organisations to help their people use AI responsibly. It has applied since 2 February 2025. Since 27 July 2026, under the Digital Omnibus, Regulation (EU) 2026/1744, Article 4 has been a duty to take measures that support AI literacy.
What are the alternatives to banning AI?
A ban tends to move the work to phones and personal accounts, where IT loses sight of it. The two common alternatives work differently. Classic DLP scans traffic and blocks what looks sensitive, which stops a person mid-task. SendSafe swaps the details and keeps the question, so the prompt goes through with neutral labels. This is a general comparison of approaches, not of specific products.
The paste will happen. Make it a safe one.
Start with one team and one workflow, and see what changes.
Available formacOSWindowsiOSAndroid