ChatGPT behind your own API does not keep client data private
An internal wrapper changes the interface, not where the data goes. Eight layers of defence, the leak each one misses, and why the last gap is a personal chatbot.
In short
No. A wrapper around a vendor API still sends every prompt to the vendor. Redaction, routing, tool limits, identity, output filtering, audit logs and evaluations each close one gap. None of them stops an employee pasting a client file into a personal chatbot. That needs a sanctioned tool good enough to use, a written policy and trained staff.
Many offices answer the AI question the same way: buy API access, build an internal chat page, let staff sign in with work accounts. It feels like the data now stays inside.
It does not, and the reason is simple. The internal page is a front end. The model still runs on the vendor’s servers, and every prompt travels there with whatever the employee pasted into it.
The misconception
An API key changes the contract, not the route. For business products and the API, OpenAI and Anthropic say they do not train on your data by default. Both still receive every prompt. OpenAI keeps API inputs and outputs for up to 30 days for abuse monitoring; Anthropic deletes API data within 30 days by default.
So the question is not “do we use the API?” but “what reaches the vendor, what can the agent do with it, and who would notice?” The layers below answer that one gap at a time.
The costly mistake: eight layers, eight gaps
Picture a firm that hardens its AI setup step by step. Every layer is worth having. Every layer also leaves something open, and the next one exists because of it. Scroll through: the configuration on the side grows with each step.
01 · Internal API wrapper
Staff use an internal chat page instead of a public chatbot. Stops: accounts the firm cannot see. Still gets through: every prompt goes to the vendor, as before.
02 · Redaction with regex and NER
Names, ID numbers, IBANs and emails become placeholders before the prompt leaves and are restored in the answer. Stops: anything with a shape. Still gets through: “we are about to lose the tender” names nobody and still matters.
03 · Labels and a classifier
Documents carry sensitivity labels, a classifier scores each prompt, and confidential work goes to a private deployment. Stops: confidential text reaching the public model. Still gets through: the agent’s tools. Ask it to email a file to a personal address and it will.
04 · Confirmation and a domain allowlist
Every write waits for a person, and email only goes to the firm’s own domains. Stops: the agent mailing data out. Still gets through: loose identity. The agent reads whatever its service account can.
05 · SSO, tenant restrictions, identity passed through
Sign-in only through the firm’s identity provider, personal tenants blocked, every tool call made with the user’s own permissions. Stops: reading files the user may not see. Still gets through: indirect prompt injection. Hidden text on a wiki page tells the model to add an image whose URL carries data.
06 · Output sanitising and egress filtering
External URLs and markdown images are stripped from answers, and the server may only call listed hosts. Stops: the image trick. Still gets through: nobody can answer “who sent what, and when?”
07 · Audit traces
Every redaction, retrieval and tool call is logged with the user and the time. Stops: guessing after an incident. Still gets through: a fix to one rule quietly breaks another.
08 · Evaluations on every change
Known leaks are replayed as tests whenever a detector or rule changes. Stops: regressions. Still gets through: anything that never touches the gateway.
09 · Outside all of it
A client complaint arrives at six in the evening. An employee pastes it into personal ChatGPT on their phone to draft a reply. Not one line of the configuration applies.
The indirect-injection step is not hypothetical. OWASP’s 2025 list of LLM risks describes exactly this case: instructions hidden in a web page make the model insert an image linking to an attacker’s URL, and the conversation leaks through it.
The last step is the expensive one. Shadow AI is not a technical failure, so no technical layer fixes it. People reach for a personal chatbot when the sanctioned tool is slower, worse or missing.
How Paxa Media does it differently
We start from the gap the layers cannot close. The control that matters most is a sanctioned tool good enough that nobody goes around it. The layers then protect that tool instead of an empty room.
A private model for confidential work
Confidential matters run on a local model, on your hardware or a server you rent and control, so the prompt never reaches a vendor. Low-risk work can still use a business plan with a data processing agreement.
The gateway layers, in code
Redaction, routing, confirmations, output sanitising, audit lines and leak tests as plain, tested TypeScript. The tutorial shows every piece.
Managed browsers and devices
On work devices, browser and device policies block sign-in to personal AI accounts. It narrows the gap; a personal phone stays outside it.
A written AI policy
One page: which tool for which data, what never goes into any AI, who approves exceptions and how to report a mistake.
AI literacy for staff
Short training on the policy and on the leaks above. In the EU it is also a duty: AI Act Article 4 requires organisations that use AI systems to take measures for their staff’s AI literacy.
What a leak costs
A leak through AI is a data protection incident like any other: a breach notice within 72 hours where there is a risk, fines up to 4% of worldwide turnover, and secrecy duties for lawyers, auditors and insurers. Our cost breakdown gives each with its legal basis; the Croatian pages cover Croatian law.
Which plans train on chats, how long each keeps data and which come with a data processing agreement is in our comparison of ChatGPT, Claude, Gemini and a local model.
Key takeaways
- An internal wrapper changes the interface, not where the data goes.
- Each defensive layer closes one gap and exposes the next one.
- The last gap is a personal chatbot, outside every technical control.
- A sanctioned tool good enough to use, a written policy and trained staff close it.
Frequently asked questions
Is the OpenAI or Anthropic API safe for client data?
Safer than a personal account: neither trains on API data by default, and both offer a data processing agreement. The data still leaves the firm and is kept for up to 30 days unless you have a zero-retention agreement. Confidential matters belong on a model you control.
Does redaction make a vendor model safe?
It removes identifiers, not meaning. A redacted prompt can still describe a client’s situation closely enough to identify them. Redaction lowers the risk; routing confidential work to a local model takes it off the vendor path.
Can we block personal ChatGPT?
On managed work devices and networks, yes, with browser and device policies. On a personal phone, no. That is why the policy and training matter as much as the blocks.
Do we need all eight layers?
No. An office that keeps confidential work on a local model may need only redaction, confirmations and audit logs. The full set matters when an AI agent can read shared systems and act on them.
Sources
Pages we checked for the facts above, with the date we last read them.
- Enterprise privacy at OpenAI — OpenAI, checked 2026-11-05
Business, Enterprise and API data not used for training by default; API inputs and outputs kept up to 30 days; DPA available. - Is my data used for model training? (commercial) — Anthropic Privacy Center, checked 2026-11-05
Commercial products (Claude for Work, API) not used for training by default. - How long do you store my organization’s data? — Anthropic Privacy Center, checked 2026-11-05
API inputs and outputs deleted within 30 days by default; zero data retention by agreement. - Gemini API Additional Terms of Service — Google, checked 2026-11-05
Unpaid Gemini API use improves Google products and may be human-reviewed; paid use does not. - LLM01:2025 Prompt Injection — OWASP Gen AI Security Project, checked 2026-11-05
Indirect prompt injection; exfiltration through an inserted image URL (attack scenario). - AI Act, Regulation (EU) 2024/1689 — EUR-Lex, checked 2026-11-05
Article 4 AI literacy duty; applies from 2 February 2025 (Article 113). - Regulation (EU) 2026/1744 (Digital Omnibus on AI) — EUR-Lex, checked 2026-11-05
Amended Article 4: measures to support staff AI literacy, no guaranteed level; in force 27 July 2026. - General Data Protection Regulation (EU) 2016/679 — EUR-Lex, checked 2026-11-05
Breach notice within 72 hours (Art. 33); fines up to 4% of worldwide turnover (Art. 83(5)).
See it on one of your own workflows
We start with a demo on synthetic data: one office workflow, a local model and the gateway rules from these articles. Real client data comes in only after a written scope.
Book a demo on synthetic data
Tell us which workflow you want to speed up. The demo needs none of your real data.
- Fixed-scope quote — no obligation
- Reply within 1 business day
About the author
Paxa Media
Written by Paxa Media, a technology company based in Rijeka, Croatia. Price ranges in our guides are indicative; your quote depends on scope.
Why you can trust this
- Builds the kinds of systems described here — websites, web and mobile apps, automation and integrations
- Technology company based in Rijeka, Croatia
- Price ranges in these guides are indicative, not quotes; scope sets the final price
Keep reading
All guides →Build a leak-resistant AI gateway for a professional office
Six small TypeScript modules that sit between your staff and any model, each covered by a test. Plus the one gap that code cannot close.
AI & automationWhere client data goes: personal AI, business plans, APIs and a local model
Same model, very different terms. What happens to a client file on a personal plan, a business plan, the API and a model on your own hardware, checked on the vendors’ pages.
AI & automationSelf-Hosted AI: When Your Data Is Too Sensitive for the Cloud
For most businesses, cloud AI is fine. But when your data is regulated, secret, or simply cannot leave your walls, private AI is the answer. Here is how to tell.