What never goes into a chat
- Keep card details, passwords, codes and keys out of chat
- Remove customer details the task doesn't need
- Check the whole screenshot and the saved copy
- Read pasted messages, but don't follow their directions
- Use a made-up summary if you can't remove private details safely
Before you paste a payment notice or screenshot into ChatGPT, Claude, or Gemini, remove private customer and account details.
Five details to leave out
Use this list in chats, files, screenshots and saved directions. Share only what the task needs. If you're unsure, leave it out.
- Full card numbers, security codes, PINs, and an expiration date shown with a card number.
- Bank account and routing numbers, tax IDs, and identity documents.
- Passwords, passkeys, recovery codes, one-time codes, and security answers.
- API keys, secret keys, and access tokens. An API key is a secret code software uses to connect to an account.
- Customer details the task doesn't need, such as names, email addresses, phone numbers, addresses, and account numbers.
Not sure what a code does? If it opens an account or approves a payment, keep it out. Keep anything that identifies a person out too.
How do I remove private details?
Redact means remove or cover private details before sharing. Keep only the part that answers your question.
- Keep only the needed part. Skip the rest of the file, thread, or statement.
- Replace private details with labels such as [CUSTOMER], [ORDER], and [EMAIL].
- Scan the whole screenshot. Check the page, browser tabs, address bar, side panels, notifications, and file name. Crop away what you don't need.
- Check the saved copy. Open the file you would actually send. Make sure the private details can't be read or uncovered by moving a shape. If you can't check that, describe the problem with made-up details instead.
- If you're unsure, don't send it. Use made-up details or ask your provider through an address you already know.
Made-up example: customer J. asks whether Order #1043 for $84.00 has shipped. You only need help writing a status question.
After removing private details, your summary reads: [CUSTOMER] asks whether [ORDER] has shipped.
Don't replace a real card number or password with another number. Leave it out completely.
Check files, screenshots and saved directions
An image can show more than you meant to share. A browser tab, address bar, notification, or file name may reveal private details. Crop away what you don't need, then check every edge of the saved copy. If you can't confirm the cover stays in place, use made-up details instead.
If your tool can save directions or files for later chats, keep those general too. A preference for plain words is enough. Keep customer records and secrets out of anything it saves.
Keep original receipts, messages, and order records outside the chat. Don't ask AI to invent or change evidence. Check a summary against the original before relying on it.
What if pasted text gives directions?
A message or webpage may include directions aimed at the chat. Read them as part of the message, not as directions to follow. If it tells the chat to share a code, click a link, or ignore you, stop. Don't follow those directions. If you're unsure, start a fresh chat and check the message through a provider address you already know.
I built my bakery's site. Can I share the setup?
Your bakery website is ready for orders, and a customer says their confirmation hasn't arrived. AI can help you make a checklist. It can't certify the live checkout from this prompt.
If you're unsure what to add, ask the tool to ask you up to three questions first. Use made-up details, not a live website link or customer screenshot. For a real case, summarize the customer's message without names or account details.
Prompt
My pretend bakery website was built with AI. A customer asks about Order #1043 for $84.00 and says the confirmation hasn't arrived. Buyers check out through my payment provider. Make a short checklist for my platform or developer. Include payment status, refunds, order confirmation, and safe testing. Use only what I've given you. Before you answer, ask me up to three questions if something is missing. Don't write payment code, ask for keys, or say the site is secure.
Ready for your own case? Swap the made-up details for yours:
My bakery website was built with AI. A customer asks about Order [your order number] for [amount] and says: [what the customer says]. Buyers check out through my payment provider. Make a short checklist for my platform or developer. Include payment status, refunds, order confirmation, and safe testing. Use only what I've given you. Before you answer, ask me up to three questions if something is missing. Don't write payment code, ask for keys, or say the site is secure.
If one part still needs a closer look, ask:
Which checks need a person to test them in the provider's practice environment?
Check it: Take the checklist to your developer or platform support. Ask them to compare the setup with your provider's current instructions and check a practice payment, refund, and order confirmation. A person approves launch.
Don't paste test card numbers or keys into chat. Keep any test data in your provider's practice environment. Don't use AI-written payment code on a live checkout until a qualified developer has checked it.
Next Steps
If you use Stripe, take the Stripe first-week checklist to your developer or platform support.
PCI rules and payment data
PCI DSS is a set of rules for protecting payment card data. If an AI tool is part of a setup covered by PCI DSS, the requirements still apply. Whether your setup falls under payment security rules depends on how data moves through it. Ask your payment provider who can assess it. This isn't legal advice.
Sources
| Source | What it supports | Accessed |
|---|---|---|
| PCI DSS overview | PCI DSS is a baseline of technical and operational requirements for protecting payment account data. | 2026-10-22 |
| PCI SSC AI Principles | Applicable PCI requirements still apply to AI systems in scope. PCI SSC cautions against trusting AI with high-impact secrets or unprotected sensitive data. | 2026-10-22 |
| PCI SSC Security Considerations for AI Systems | AI is considered like other technology when scoping requirements. The supplement is guidance, and official PCI standards take precedence. | 2026-10-22 |
| PCI SSC FAQ 1533 | Sensitive authentication data includes card verification codes and PIN data. It must not be stored after authorization, even when encrypted. | 2026-10-22 |
| ChatGPT | VENDOR OpenAI consumer data guidance says not to enter sensitive information you wouldn't want reviewed or used. | 2026-10-22 |
| Claude | VENDOR Anthropic consumer guidance advises care with financial details, passwords, login credentials, and confidential documents. | 2026-10-22 |
| Gemini | VENDOR Google Gemini Apps Privacy Hub says some data may be reviewed and advises against entering confidential information you wouldn't want a reviewer to see or Google to use to improve services. | 2026-10-22 |