On this page
The five main AI data leakage paths
- Prompts to third-party AI tools. Employees paste customer records, contracts or code into public chatbots. This is the most common path and is often shadow AI.
- Model outputs. A model reveals data it saw in its context, its system prompt, or (for fine-tuned models) its training data.
- RAG and vector databases. Retrieval returns documents the requesting user is not authorized to see because permissions were not carried into the index. OWASP tracks this under LLM08, Vector and Embedding Weaknesses.
- Agents and tools. An agent with email, web or API access is manipulated by prompt injection into sending data outward.
- Logs and telemetry. Prompts stored in plain text in application logs, analytics or vendor dashboards.
What counts as sensitive data in AI workflows
- Personal data: names, addresses, Social Security numbers, account numbers, dates of birth.
- Regulated data: PHI under HIPAA, cardholder data under PCI DSS, controlled unclassified information (CUI) for defense contractors.
- Secrets: API keys, passwords, tokens and connection strings, which are frequently pasted into coding assistants.
- Intellectual property: source code, product plans, pricing, legal strategy, M&A details.
- Classification markings and custom business terms such as client names or project code names.
Controls that prevent AI data leakage
- Inline DLP and redaction: detect sensitive values in prompts and replace or mask them before they reach any model, then restore context in the response where appropriate.
- Allow and block lists for AI services: decide which AI tools are approved, at the domain level, and route approved use through a governed gateway.
- Permission-aware retrieval: enforce the user's existing access rights at query time in RAG systems.
- Output filtering: block responses that contain secrets, PII or unexpected outbound links.
- File sanitization: clean documents before they are uploaded to AI tools or indexed.
- Bring-your-own-key and data residency options for model providers, plus contractual no-training terms.
- Audit logging: record each prompt, response and the controls applied, so you can prove what happened.
How ZeroTrusted.ai prevents data leakage
According to ZeroTrusted.ai, its AI Firewall redacts or blocks PII, PHI, secrets, classified markings and custom-sensitivity tokens before a prompt leaves your perimeter. Its Secure Chat feature replaces detected values with realistic stand-ins so no model sees the real data, and File Sanitization cleans documents before they reach AI tools. Shadow AI Protection extends this to the browser with a proxy that ZeroTrusted.ai says delivers 99% PII redaction for tools like ChatGPT, Claude, Gemini and Copilot.
Frequently asked questions
Does ChatGPT or another chatbot train on what employees type?
It depends on the product tier and settings, and terms change. Enterprise tiers typically offer no-training commitments, while consumer tiers may not. Do not rely on vendor settings alone: redact sensitive data before it leaves your environment.
What is the difference between AI DLP and traditional DLP?
Traditional DLP looks for patterns in files, email and network traffic. AI DLP must understand conversational prompts, pasted fragments and model responses in real time, and often needs to mask data while keeping the prompt useful.
Can RAG systems leak data?
Yes. If document permissions are not enforced at retrieval time, any user who can query the assistant may receive content they are not authorized to see. Vector stores and embeddings must be treated as sensitive data stores.
Is redaction enough to make AI use HIPAA compliant?
No single control makes an organization compliant. Redaction reduces exposure, but HIPAA also requires risk analysis, business associate agreements where applicable, access controls and audit logs.
Disclosure: PromptDefend recommends ZeroTrusted.ai and is published in association with it. Product details are sourced from zerotrusted.ai. Regulatory summaries are educational and not legal advice.