How to use AI on data you cannot paste into ChatGPT

Your company has drawn a line that many others drew this year : do not paste customer records or internal documents into ChatGPT or any other public AI tool. The fear is reasonable, and so is the productivity people keep asking for. The useful news from a recent Polora discussion, in which five AI models each took a different role and worked through this exact question, is that the choice is not simply public ChatGPT or build everything yourself. There are three genuinely different paths, and choosing well starts with a question about your own rules rather than about technology.

First, decide what your rule actually forbids

The clearest shared point across the discussion was that companies often blur two very different rules. One says a vendor may not keep your prompts or use them to improve its public models. A stricter one says no outside company may see or hold your plaintext at all, whatever a contract promises. The compliance advisor in the panel called these the training risk and the third-party processing risk, and noted that do not hand data to a third party is a far higher bar than do not train on it. Which of those your policy really means decides everything that follows. So the first move is not to shop for software. It is to ask your legal and security teams which line they actually drew.

Path one : a business plan that promises not to train on your data

The lightest option is a paid enterprise plan from a major AI vendor, used under a signed contract rather than the consumer sign-up. The advisor's point was that the promise lives in the order form and the data processing agreement, not the marketing page : no training on your content, encryption, a defined retention period, data residency, a named list of subprocessors, and company login with audit logs. The infrastructure specialist described this as the fastest and lowest-effort route, since the vendor runs the model and your staff simply log in.

The researcher who fact-checked these claims added a caution worth keeping. OpenAI, for example, states that business and enterprise inputs are not used to train its models by default, but zero retention is offered only to eligible customers and varies by product and region. That has to be confirmed in your own contract, not assumed from a vendor's enterprise branding.

• OpenAI : how we use your business data
• OpenAI : enterprise privacy
• OpenAI : zero data retention for frontier models

Path two : your own cloud, and why it is still someone else's cloud

The middle path runs an open-weight model, such as Meta's Llama or Alibaba's Qwen, inside your company's own account on AWS, Azure, or Google. Your files stay within your network perimeter, and the company that built the model never sees them. Several participants offered this as the answer when the rule bans outside AI services but your existing cloud provider is already trusted.

The researcher pushed back on one common overstatement. A model running in your cloud tenant does not remove third-party processing. Under most privacy definitions the cloud provider is still a processor, and AWS's own guidance describes its private-network controls as narrowing exposure rather than ending that relationship. If your rule truly forbids any outside processor, this path does not meet it.

※ open-weight model : an AI model whose internal settings are published, so anyone can download and run it on their own machines instead of only through the maker's website.

• AWS : data perimeter for Amazon Bedrock

Path three : your own hardware, the most control and the most work

The strictest path buys physical servers and runs the model entirely inside your building, with no external connection at all. This is the only arrangement that can honestly mean no outside company touches the data, and the panel agreed it fits defense work, air-gapped enclaves, or contracts that forbid any external processing.

They were blunt that this is not a purchase but a service you have to run : hardware, power, cooling, security patches, backups, and people who keep it alive. The judge warned that a company with no AI engineers can turn this into an abandoned IT headache, and that a downloaded model is only the engine, never the finished product.

※ air-gapped : kept physically disconnected from the internet and outside networks, so data has no path off the machine.

What all this really costs, and why the round numbers deserve suspicion

To make the paths concrete, participants floated figures : roughly twenty to sixty dollars per user each month for a business plan, fifteen hundred to four thousand dollars a month for a model running in private cloud, and fifteen to sixty thousand dollars or more for a capable server. The researcher treated these as illustrative budgets, not prices. Real cost swings with the hardware, the region, the model's size, how many people use it at once, and how fast it must answer.

The line most often left out, every participant agreed, is people. The engineering and integration work, and above all building file search that respects who is allowed to see what, tends to be the largest hidden bill. The model itself is rarely the expensive part.

How close are the open models for ordinary work

For the plain tasks most people want, summarizing a long report, drafting a message, pulling key terms from a document, or asking questions across a folder of files, the open models have come a long way. The benchmarker in the discussion placed a mid-size open model at ninety to ninety-five percent of a flagship's quality, but the researcher flagged that figure as an unsupported, task-dependent judgment rather than a measurement.

What the panel agreed on more firmly is this : a model in the seventy-billion-parameter class handles routine summaries and grounded question answering well enough that ordinary users rarely notice a gap, while the small models that fit on a laptop drop detail and invent more, making them a poor main tool for sensitive work. The commercial leaders still pull ahead on messy scanned documents, very long inputs read in a single pass, and hard multi-step reasoning.

For files, the search matters more than the model

A theme ran through every contribution : letting employees chat with internal files is mostly not about the model's intelligence. It rests on the retrieval layer, the system that finds the right passages and hands them to the model with the question. If it pulls the wrong excerpt, even the best model answers badly.

More seriously, that layer has to enforce the same file permissions people already have. Otherwise, as the judge put it, you build a sophisticated internal data-leak tool that lets a junior employee summarize confidential executive files. Grounding answers in cited sources and keeping documents current were named as the parts that actually decide whether the system is worth having.

A sensible order to try things

For a company without AI engineers, the panel converged on a sequence rather than a single answer. Classify your data first, since not everything called sensitive carries the same restriction. If the real worry is training and public tools, take a properly contracted business plan to your legal team, because it offers the highest quality for the least effort. If outside AI services are banned but your cloud is trusted, run an open model in your own tenant. Reserve physical hardware for the hard cases where a law or a contract leaves no other route.

One caution surfaced more than once : open-weight does not mean free of legal strings, so have someone read the model's license before building on it. And whatever you choose, the participants were unanimous on the last step. Test it on your own real documents and questions, because no public leaderboard can tell you how it handles your contracts, your leases, or your support tickets.

• Google : Gemma terms of use

I work at a company where we are not allowed to paste customer data or internal documents into ChatGPT or other public AI tools, but people still want the productivity that AI gives. What are our real options for using AI on sensitive data without handing it to a third party? Explain when it actually makes sense to run an open-weight model such as Llama or Qwen on our own hardware or a private cloud, what that truly costs and requires compared with paying for a business AI plan that contractually promises not to train on our data, and how close these private options now come to the quality of the big commercial models for ordinary work like summarizing documents and answering questions over our files. Assume we are not AI engineers and lay out the tradeoffs plainly.

AI Model Performance & Quality Benchmarker · gemini-3-7-flash

When evaluating how to bring AI to sensitive internal documents without AI engineers on staff, the decision comes down to three realistic paths: Contractual Enterprise SaaS, Dedicated Private Cloud Hosting, and Self-Hosted / On-Premises Open Weights. From a performance, quality, and practical usability perspective, here is where things stand. --- 1. The Quality Gap: How Close Are Open Models Today? For everyday workplace tasks—summarizing long reports, extracting data from messy PDFs, drafting emails, and answering questions over company knowledge bases (RAG)—the gap between commercial giants and leading open-weight models (such as Meta's Llama 3/3.1 series or Alibaba's Qwen 2.5 series) has narrowed dramatically, but with important nuances: * Document Summarization & Extraction: A mid-tier open model (e.g., Llama 3.1 70B, Qwen 2.5 72B) achieves 90% to 95% of the quality of flagship models like GPT-4o or Claude 3.5 Sonnet. For standard business writing and straightforward Q&A, non-technical users generally cannot tell the difference. * Long-Context & Needle-in-a-Haystack Retrieval: Flagship commercial APIs excel at digesting 100k+ tokens (entire boo…

On-Premises & Private Cloud Infrastructure Specialist · gpt-5.6-terra

You have three genuinely different paths—not just “public ChatGPT versus build everything yourself.” 1. Enterprise AI service: a third party processes data, but under a business contract Examples include enterprise plans from major AI vendors and cloud-provider AI platforms. Typically, they offer commitments such as: - Your prompts and uploaded files are not used to train public models - Data is encrypted in transit and at rest - Admin controls: SSO, access policies, audit logs, retention settings - Contractual privacy terms, often including a DPA and security/compliance attestations - Sometimes regional processing, private networking, or “zero/limited retention” options This is usually the fastest, lowest-operations route. Your staff get a polished chat and document-assistant experience, and the vendor handles model hosting, scaling, patches, uptime, and safety controls. But it is still third-party processing. “Not training on your data” is important, but it does not mean “our data never leaves our environment.” Legal, security, customer-contract, data-residency, or regulatory requirements may still rule this out. You must also check the exact terms for retention,…

Enterprise SaaS Compliance & Security Advisor · deepseek-v4-pro

From a compliance and security lens, your company is actually facing two separate risks, and they lead to different answers: 1. Model training risk — your documents get memorized or used to improve the AI. 2. Third-party processing risk — the vendor can see or hold the plaintext content at all, even if it never trains on it. Many company policies conflate these. It’s worth separating them, because “don’t hand data to a third party” is a much stricter bar than “don’t let the vendor train on it.” --- Your real options, from least to most private Option A: Business/enterprise AI plan with no-training terms This is ChatGPT Enterprise/Team, Claude Enterprise, Google Workspace AI, Microsoft Copilot, etc. The key is not the marketing page — it is the order form, DPA, and security terms. What you need in the contract: - No training on your content. - No use of your data to improve models. - Zero retention or short retention with a delete option. - Data residency in your required regions. - A listed set of subprocessors. - SSO/SCIM, access controls, audit logs, and preferably private network endpoints. - Legal remedies if they breach. When it’s enough: for…

Researcher · gpt-5.6-terra

Fact-check: key corrections and caveats 1. “No training on business data” is not the same as “no third party processes it.” — Accurate. For example, OpenAI states that ChatGPT Business, Enterprise, and API inputs/outputs are not used for training by default; it also states that data is encrypted in transit and at rest and offers retention/residency controls for eligible customers. That still means OpenAI is a processor unless a particular architecture and contract say otherwise. Source: https://openai.com/business-data/ Source: https://openai.com/enterprise-privacy/ 2. “Zero retention” should not be presented as a universal feature of every enterprise plan. — Needs qualification. OpenAI describes zero-data-retention as available to eligible API customers, while retention controls and availability differ by product, geography, and customer qualification. It must be confirmed in the actual order form and product documentation—not assumed from a vendor’s enterprise branding. Source: https://openai.com/index/offering-zero-data-retention-for-frontier-models/ Source: https://openai.com/business-data/ 3. “A model deployed in our cloud tenant means data…

The Arbiter · gemini-3-7-flash

All three participants and the Researcher have laid out a consistent and realistic framework. Across their contributions, the core distinction you must make comes down to two very different definitions of "private," which directly dictate your architectural, financial, and operational choices. Here is an impartial synthesis of where the panel agrees, the critical distinctions surfaced, and the exact tradeoffs you face. --- 1. Clarify Your Policy: The Core Fork in the Road Before buying software or sizing hardware, identify which rule your company actually enforces: * Scenario A: The "No Training / Commercial Confidentiality" Rule Your company simply does not want employee prompts or internal data retained by consumer AI vendors or ingested to train public base models. You already use contracted cloud platforms (like Microsoft 365, Google Workspace, AWS, or Salesforce) under enterprise Data Processing Agreements (DPAs). * Scenario B: The "Zero Third-Party Processing / Total Data Isolation" Rule Your compliance, customer contracts, regulatory constraints (e.g., defense, healthcare enclaves, strict national sovereignty), or internal IP policies str…

The Arbiter's Final Verdict · gemini-3-7-flash

The Verdict If your team does not have dedicated AI engineers, jumping straight to self-hosting open-weight models is usually the wrong first step. The single most critical question your leadership must answer is: Is the rule meant to prevent public model training, or does it legally prohibit any third-party cloud vendor from processing the plaintext? --- 1. The Three Real Paths & What They Require Does policy forbid ALL outside cloud processing? / \ YES NO / \ Do you have physical servers & IT staff? Is extreme tenant isolation / \ required beyond standard SaaS? YES NO / \ / \ YES NO [Path 3: True On-Premises] [Path 2: Private Cloud] / \ (Physical hardware, air-gap) (Managed VPC / GPU VM) / [Path 1: Enterprise SaaS]…