# I Deleted 5 Things From This File Before ChatGPT Saw It. It Still Found The Problem.

## Executive summary

The video addresses the critical challenge of using powerful AI models on highly sensitive internal documents without violating data privacy. The speaker argues that traditional advice ('don't upload') is insufficient because useful work requires context. A proposed solution involves a workflow—demonstrated by the tool Airlock—that strips unnecessary Personally Identifiable Information (PII) and confidential details, then rebuilds a clean, sanitized copy of the file. This ensures the model receives only the minimum necessary context required to complete a specific task, keeping the original sensitive data local.

## Key takeaways

- AI requires minimal, targeted context: Instead of uploading entire files, define the job first and determine the absolute minimum information needed for the AI to perform the task. The model needs an operating plan, not PII like home addresses or API keys.
- Redaction is insufficient; rebuilding is necessary: Simply blacking out sensitive data (redacting) can leave behind metadata and structural issues in file containers (like Word comments/track changes). The safer approach is to rebuild the approved material into a separate, clean document.
- Define protected terms for context: Tools must allow users to define 'protected terms' (e.g., internal product codes) that are confidential but may not look like standard PII, giving the AI necessary contextual understanding.

## Technical details

- Data Sanitization Workflow: The process involves defining protected terms, identifying which data points are essential for the task (e.g., warehouse migration dates), and stripping all non-essential PII/confidential details (e.g., customer names, home addresses).
- Airlock Functionality: The tool analyzes documents against defined protected terms and necessary task context, generating a new, clean copy rather than redacting the original file.
- Security Risk Management: The speaker notes that security fatigue makes users prone to using unapproved routes (shadow IT), highlighting the need for better default privacy mechanisms in software design.

## Practical implications

- Adopt a 'job-first' approach: Before engaging AI, define the specific task and determine the minimum context required for success.
- Implement data sanitization tools that rebuild files rather than simply redacting them to maintain file integrity and remove hidden metadata.
- Establish clear internal protocols for defining and protecting confidential terms (e.g., project codes) that are not standard PII.

## Topics

AI Privacy, Data Sanitization, Build Engineering Workflows, PII Management, Generative AI, Airlock, Nate's Newsletter (Substack)

Source: https://www.youtube.com/watch?v=EuVvLwWZ5wc