Do not paste personal data about donors, clients or staff, passwords or access keys, case notes, financial account details, or confidential funder documents into a general AI chat tool unless your organization has checked that tool's data terms and approved it. Use anonymized or invented examples instead.
Why a rule is needed
Staff use AI tools to draft grant text, summarize meetings and tidy emails. That is useful and low risk when the content is public or invented. The risk starts when someone pastes a client's story or a donor list to get a faster answer. Whether that data is kept, reviewed or used to improve a service depends on the provider's terms and your plan, and it differs between products.
A short rule to share
"Use AI tools for public or invented content. Do not paste anything that identifies a person, or any credentials, or anything marked confidential, unless the tool is on our approved list."
Put it in your staff and volunteer briefing.
Red, amber and green
| Category | Examples | Rule |
|---|---|---|
| Red, never paste | Passwords, API keys, client case notes, donor lists, bank details | Do not use a general chat tool |
| Amber, ask first | Draft board papers, unreleased funder reports | Check the tool's terms and ask a lead |
| Green, fine | Public web text, invented examples, your own style questions | Go ahead |
Anonymize when you need help
If you want help with a hard case, rewrite it with a made up name and strip identifiers: names, places, dates and unusual details. Re-read it to check that a colleague could not identify the person from what remains.
Check before you approve a tool
Ask the provider, and read the terms for your specific plan:
- Is our content used to train models, and can we opt out?
- How long is it kept?
- Who at the provider can read it?
- Can we delete our history and account data?
- Can each person use their own account with MFA?
Terms differ between consumer and organization plans, so do not assume the free version matches the paid one. Save a copy of the terms you reviewed, with the date.
Do not trust output blindly
AI tools can state wrong facts with confidence. Anything that goes to a funder, donor or the public needs a person to check it. That matters most for statistics, legal wording and names.
For teams that build with AI
If your nonprofit builds a chatbot or automates work with AI agents, add a review step for what the agent can read and do. Safeguard's MCP Guardrail and agent identity features address tool access for agents, and our post on questions about model intake is a good place to start.
Handling a mistake
Someone will paste something they should not have. Make reporting easy and free of blame. Ask them to note what was pasted, which tool and when, and tell the decision owner. Then check the tool's settings to delete the history if the plan allows it, and change any credential that was exposed. Quick, calm handling keeps people honest next time.
Quick check
Is it safe to paste a grant draft?
If it contains no personal data and nothing confidential, the risk is low. Check the tool's terms for unreleased documents.
Should we ban AI tools?
A ban often pushes use out of sight. A clear rule and an approved list works better.
Last reviewed: 19 October 2026.
