It depends on how the data is classified, not on the tool. Inside your organization's enterprise account, public and internal information is fine to use; customer data, PHI and exam material only go into restricted spaces with approval; and passwords, credentials and full card data never go in at all. Nothing from the organization goes into a personal account.
Most AI policies fail right here. They say "don't enter confidential information" and leave every employee to decide what counts as confidential.
Why isn't "nothing confidential" enough?
Because at a bank, credit union, insurer or hospital almost everything useful is confidential, and a rule that bans everything gets broken every day. People need to know what they can do, not just what they can't.
And because the definitions already exist. Under Regulation P, nonpublic personal information covers personally identifiable financial information: what a consumer gives you to get a product, what results from their transactions, and what you otherwise learn about them while serving them. It also covers lists of consumers built from that information. HIPAA defines protected health information and spells out exactly what de-identification takes.
How should data be classified for AI?
Four levels, all inside your organization's enterprise account:
| Level | Examples | Rule for AI |
|---|---|---|
| Prohibited | Passwords, credentials, access keys, PINs, full card numbers with security codes | Never, not even in the enterprise account |
| Restricted | Customer or member nonpublic personal information, account balances and transactions, PHI, exam reports, audit findings | Only in restricted spaces approved for that use, by authorized people, with the minimum data needed and with logging |
| Internal | Policies, procedures, manuals, vendor contracts, process analysis | Normal use in the enterprise account |
| Public | Published rates, brochures, website content | Normal use in the enterprise account |
No level goes into a personal account, not even public data. The problem isn't the data; it's that the organization doesn't control that account.
What do Claude and Gemini promise about your data, and on which plans?
The answer depends on the account, not the brand. As of October 2026, this is what each provider publishes:
| Tool and account type | Are your conversations used to train models? | What else to know |
|---|---|---|
| Claude Free, Pro or Max (personal accounts) | Only if the user allows it. If they do, data is kept up to 5 years; if not, 30 days | Consumer terms. The choice belongs to each person, not the organization |
| Claude Team and Claude Enterprise (organization accounts) | Not by default: the commercial terms bar Anthropic from training on customer content | Exception: if someone rates a response, that conversation may be used and kept up to 5 years. Admins turn this off with the Rate chats setting |
| Gemini on a personal Google account | Yes, if the Gemini Apps Keep Activity setting is on | A subset of conversations is reviewed by people, disconnected from the account, and kept up to 3 years. With the setting off, chats aren't used for training and are kept for 72 hours |
| Gemini in Google Workspace (organization account) | No, without the customer's prior permission or instruction | Chats and files aren't reviewed by people, interactions stay within the organization, and admins decide who can use the app |
Two takeaways. First, on personal accounts protection hinges on a setting each user controls, and the organization can't even see how it's set. Second, a provider not training on your data doesn't make that data public or internal. A customer file is still restricted inside Claude Enterprise or Gemini in Workspace, and the classification still applies. What ultimately counts is your contract and its data processing addendum; review them with compliance.
What's easy to miss?
Six details that turn an acceptable use into a leak:
- Removing the name doesn't de-identify. HIPAA's Safe Harbor method removes 18 categories of identifiers, including dates, small geographic units, account numbers and device identifiers, and requires no actual knowledge that the rest could identify someone.
- Outputs inherit the classification. An AI summary of a customer's file is still customer information.
- Connectors move data without anyone pasting anything. Connecting AI to email or shared drives gives it access to everything that person can see.
- Screenshots say more than they seem to. Open tabs, names in a sidebar, an account number in a corner.
- What goes in is kept. On Claude Enterprise, for example, conversations are kept indefinitely unless an admin sets a retention period.
- Exam reports have their own rules. For national banks, OCC rules bar disclosing non-public OCC information, including report of examination content, without OCC approval, with limited exceptions such as employees, auditors and consultants under a written contract that acknowledges the restriction. Other agencies have their own rules. Ask counsel before any exam material goes into an AI tool.
How do you use restricted data with AI responsibly?
When an approved use case needs customer data, these practices cut the risk:
- Minimize. Only the fields the task needs. Drafting a reply to a complaint doesn't need a Social Security number.
- Pseudonymize. Replace names and numbers with codes ("Customer A," "Account 1") and keep the key outside the AI tool.
- Use restricted spaces. A project with defined members, not a chat anyone can share.
- Turn on connectors by role. Only for the people who need them, and only to the folders that apply.
- Set retention. Restricted data shouldn't stay longer than your policy allows.
An honest caveat: no tool catches everything that shouldn't go in. Classification works when people understand it, so the examples have to come from their daily work, not abstract definitions.
How do we handle it at Andes?
We use AI every day under a written rule: no customer personal data goes into prompts. We implement Claude and we're a registered Google Workspace partner, so we set up both with these rules from day one. For regulated organizations, our AI governance package includes the AI policy, with rules for what data can go in, the use case inventory, the risk assessment and staff training. If you're still choosing the tool, see whether you need Claude Team or Claude Enterprise, and for the regulatory picture, what governs generative AI now that SR 11-7 is gone.
Do your people know what they can put into AI today?
If the answer depends on who you ask, the classification is missing. See our AI for regulated institutions service and let's build one your team can apply without asking anyone.
Sources
- CFPB, 12 CFR 1016.3, Definitions (Regulation P): https://www.consumerfinance.gov/rules-policy/regulations/1016/3/
- 45 CFR 164.514, Other requirements relating to uses and disclosures of protected health information (Cornell LII): https://www.law.cornell.edu/cfr/text/45/164.514
- 12 CFR 4.37, Persons and entities with access to OCC information (Cornell LII): https://www.law.cornell.edu/cfr/text/12/4.37
- Claude Privacy Center, Is my data used for model training?: https://privacy.claude.com/en/articles/7996868
- Claude Privacy Center, Configure custom data retention controls for Enterprise plans: https://privacy.claude.com/en/articles/10440198
- Anthropic, Updates to our Consumer Terms and Privacy Policy (August 2025): https://www.anthropic.com/news/updates-to-our-consumer-terms
- Google, Gemini Apps Privacy Hub: https://support.google.com/gemini/answer/13594961
- Google Workspace, Generative AI in Google Workspace Privacy Hub: https://knowledge.workspace.google.com/admin/gemini/generative-ai-in-google-workspace-privacy-hub