All packs
Data safety · Every AI tool

Approved tools and accounts

Personal vs company accounts, shadow AI, extensions, meeting bots, connectors and sharing. Where your data actually goes.

Start: Where your data goes

About this pack

Approved tools and accounts teaches where your data goes when you use an AI tool, and how to decide before it goes in. The same brand can give very different protections on a personal plan and a work account. You'll check browser extensions, meeting bots and app connectors, ask for a new tool the right way, and clean up share links and old access.

Best for: Anyone who uses AI at work or for clients, from employees to freelancers and small business owners.

Good for

  • Telling a company account from a personal one, even in the same tool
  • Checking what a browser extension, meeting bot or connector can reach
  • Writing a clear request to get a new AI tool approved
  • Removing share links and app access you no longer need

Where people slip

  • Thinking a personal plan with training turned off counts as approved
  • Mixing up no training with how long chats are kept
  • Granting an app access to all your Drive files when it needs one
  • Forgetting that a share link shows the whole chat
Can I use my personal ChatGPT account for work?

Not for work data unless your company or client allows it. A personal plan doesn't carry your company's contract, admin controls, retention settings or audit logs, even with training turned off.

What is shadow AI?

AI tools or features used for work without approval. That includes new AI features that appear inside apps you already use, which need review too. The fix is to ask for the tool through your approval process.

Does no training on my data mean my chats are deleted?

No. Training and retention are separate controls. A tool can skip training on your data and still keep your chats until you or an admin delete them.

Is it OK to use an AI meeting notetaker?

Check first. A third-party bot sends the meeting to another company's tool. If you use your own, announce it, offer an opt-out and stop if anyone objects. Consent rules vary by place, so follow your company's process.

Milestone 1

Know where your data goes

Pick the approved tool and the right account before any work data goes in.

0 of 2 lessons complete
Where your data goes3 exercises
Same brand, different account4 exercises
Milestone 2

Extensions, bots and connectors

Judge what a browser extension, meeting bot or connector can reach, and grant only what the task needs.

0 of 2 lessons complete
Browser extensions and meeting bots5 exercises
Connectors and OAuth scopes5 exercises
Milestone 3

Bring new tools in safely

Request a new AI tool the right way, share outputs with care and remove access you no longer need.

0 of 2 lessons complete
Shadow AI and getting a tool approved5 exercises
Share links, history and cleanup5 exercises