How should you protect confidential information?

Use public, approved product facts in test prompts wherever possible. Redact customer names, contractual terms, personal data, credentials and non-public security details from prompt-building material.

Ask your privacy or security owner to review account type, training settings, retention, subprocessors and deletion arrangements. OpenAI states that business-product and API inputs/outputs are not used for model training by default; that is a training policy, not a blanket statement that nothing is retained or that every workflow is compliant. (openai.com)

Keep raw customer evidence in an approved internal location, separate from the public prompt library. Treat fetched pages, uploaded documents and assistant outputs as untrusted research material—not instructions to change systems or disclose data.