Free reference card

The AI Data Safety Card

Everything you paste into an AI tool leaves your hands. Before it goes in, run it through three zones. The whole check takes about five seconds, and it's the difference between using AI well and explaining yourself to your security team.

The AI Data Safety Card as a hand-drawn portrait sketchnote — Sketchnote, portrait (PNG) →

The AI Data Safety Card as a hand-drawn wide sketchnote — Sketchnote, wide (PNG) →

Red: never paste

Some things don't go in. Not summarized, not partially, not "just this once."

Passwords, API keys, and access tokens
Customer or employee names, records, and contact details
Salary data, pricing, or financials that aren't public
Unreleased plans, roadmaps, and anything mid-negotiation
Anything covered by an NDA

A simple gut check for everything else: if you wouldn't say it to a stranger in an elevator, don't paste it into a prompt.

Amber: sanitize first

Here's the part most people get wrong. Real situations make the best prompts, and the instinct is to either paste the whole messy truth or give up and ask something generic. There's a middle path: keep the situation, swap the specifics for placeholders.

Instead of:

"Our client Meridian Health is threatening to walk over the March 3rd delivery slip, and their VP said our team is the problem."

Paste:

"Our client [client name] is threatening to walk over the [date] delivery slip, and their [role] said our team is the problem."

The AI never needed the real names. It needed the situation. You lose nothing, and nothing sensitive leaves the building.

Green: fine as is

Anything already published on your company's public site
Generic process questions ("suggest a retrospective format for a frustrated team")
Frameworks, practices, and how-to questions
Your own thinking and drafts, once you've checked them against the red list

If it's public, generic, or genuinely yours, you don't need to overthink it. This is most of what a good prompt needs anyway.

The five-second test

Before you hit enter, ask one question: if this exact text showed up on a stranger's screen tomorrow, would anyone at your company care? If the answer is yes, or even maybe, sanitize it or cut it. When in doubt, leave it out.

Print this. Pin it up. The habit takes a week to build and it never stops paying for itself.