How to stop client details leaking into ChatGPT at work

Why the usual way fails

Banning AI rarely works, because the same tasks simply move to personal phones where the firm has no record of anything. Asking staff to delete details by hand works until a busy afternoon, and one rushed paste is enough. Enterprise data loss tools are built for very large companies, priced through sales calls, and mostly block the message instead of letting the work continue. Small firms usually have no IT department to install and maintain any of it, so the risk just sits there. And if client data does end up with an outside AI provider, the firm may have to explain that to the client and possibly to the regulator, which costs far more time than any letter the AI helped write.

How Particle Gateway helps

Particle Gateway replaces client names, National Insurance numbers, UTRs and bank details with placeholders on the staff member's own computer, before the message reaches ChatGPT or Claude. The person typing still sees the original message, while the AI only sees the placeholders. Detection and the audit trail run on the firm's machines, and only daily counts go to the company behind it. Today it covers ChatGPT and Claude in Chrome, and it also blocks pasted passwords and API keys. It is a managed service for firms without IT staff: the team installs it, keeps it updated and can switch it off remotely. The product is currently taking sign-ups through a waitlist, so expect to register interest first rather than download it today.

Step by step

1. Join the waitlist with your firm size and the tools your team uses most.
2. Let the Particle team set it up on your staff machines and keep it updated.
3. Staff keep using ChatGPT or Claude in Chrome the way they already do.
4. Client details in each message are swapped for placeholders before sending.
5. Check the local audit trail to see what was masked, without the details leaving the firm.

Tips

• Do not answer the risk with a ban. When AI is forbidden on work machines, people still use it, just on phones where you cannot see or protect anything.
• Check which tools your team actually uses before you rely on any filter. Particle Gateway works in Chrome today, while desktop apps, other browsers, coding agents and macOS are listed as coming soon.
• Treat passwords and API keys the same way as client data. A key pasted into a chat by mistake can be as damaging as a leaked account number.
• Write a one-page AI policy that says which tools are allowed and what must never be pasted. A clear rule plus a technical safety net works better than either alone, and it gives new staff something concrete to read on their first day.

Questions