Your Company's AI Chats Are Training Someone Else's Model. A Toggle Won't Fix It.
August 3, 2026 (4w ago)
Ask an engineering leader whether their company's AI chats are training OpenAI's or Google's next model, and most will say no — we're on a Team plan, IT flipped the training toggle off, we're covered. Ask about the AI chats actually happening inside the company, on whatever tab was already open when someone needed a quick answer, and the honest answer is usually: nobody checked. Employees have pasted company information into AI tools at a 77% clip, and 82% of those employees did it through a personal account — outside the admin console, the audit log, and whatever setting IT configured months ago.
The Setting Nobody's Account Has
The consumer AI chat products default in opposite directions, and the difference matters more than most people realize. ChatGPT's Free, Plus, and Pro tiers train on conversations by default — there's a toggle in Settings → Data Controls to turn it off, but it's off only going forward, and it does nothing for chats that already happened. Google's consumer Gemini app and its free AI Studio API keys work the same way: on by default, opt out via "Keep Activity." Anthropic is the outlier — Claude's Free, Pro, and Max tiers default to not training on your conversations; you have to actively opt in.
None of that is the setting that actually matters for a company, though. The line that decides whether a conversation trains a vendor's model isn't paid vs. free — it's consumer chat product vs. API. OpenAI doesn't use API traffic for training by default. Anthropic's API deletes inputs and outputs after seven days and never trains on them. Google's paid Gemini API and Vertex AI carry the same commitment — but its free AI Studio key does not. An org-wide toggle an admin sets in a Team or Enterprise console only reaches the seats IT actually provisioned. It does nothing for the ChatGPT tab an engineer had open on their personal account before they ever got assigned a company seat.
| Product | Consumer tier default | API tier default | |---|---|---| | OpenAI / ChatGPT | Trains on conversations; opt out in Data Controls | API traffic excluded from training | | Google Gemini | Trains on conversations and free AI Studio keys | Only the paid API / Vertex AI is excluded | | Anthropic / Claude | Opt-in required to train | API traffic excluded, deleted after 7 days |
The setting that protects a company's data was never the training toggle in someone's personal account settings. It's which side of the consumer-vs-API line the conversation happens on — and shadow AI usage lands almost entirely on the wrong side.
The Leak Isn't in the Sanctioned Tool
32.3% of ChatGPT usage inside enterprise environments happens through personal accounts — sessions that never touch SSO, never show up in an admin console, and never respect whatever data-retention setting the company configured. It's not because employees are careless. It's because the sanctioned tool has a seat-request queue, a locked-down model list, or simply isn't open in a tab yet, and the personal account already is. The share of employee AI prompts containing sensitive data has tripled since 2023, from 11% to 34.8%, and organizations with unmanaged AI usage pay an average of $670,000 more per breach — with roughly 247 days passing before anyone notices the exposure at all.
Policy memos don't fix a routing problem. Telling people not to use their personal ChatGPT account doesn't remove the reason they opened it in the first place: it was faster than whatever the company provisioned.
Give People Somewhere to Go
The actual fix is removing the gap a personal account fills, not policing the account itself. That means one AI chat client that's provisioned the moment someone's employee account exists, running on infrastructure the company owns — not a vendor's shared consumer product with a training default baked in.
That's the shape of a self-hosted deployment. Wirebase runs against your own PostgreSQL, and every model call — OpenAI, Anthropic, Google, xAI, Groq, Ollama, OpenRouter — goes out through provider API keys the organization holds itself, encrypted at rest, added once by an admin instead of scattered across everyone's personal accounts. Because it's API traffic by construction, it lands on the side of that table that doesn't train the vendor's next model — the one caveat being to use a paid Google key rather than a free AI Studio one, since that's the exception even on the API side.
None of this is bolted on after the fact. Every key added and every model enabled is a row in the same audit log that tracks role changes and workflow edits — visible with the account, not gated behind a separate enterprise tier someone has to go ask for. The point isn't that self-hosting makes anyone more disciplined about what they paste into a chat window. It's that there's no longer a faster, unsanctioned option sitting one tab away.
Shadow AI wasn't a discipline problem before language models, and it isn't one now — it's what happens when the approved tool is slower to reach than the unapproved one. Fix the gap, and the personal-account habit has nowhere left to go.
See what a company-owned AI chat platform looks like at wirebase.com.