Remove Sensitive Data Before Sending to ChatGPT

Scrub PII Before Sending Prompts to ChatGPT

ChatGPT runs on OpenAI servers. Every prompt you send, including any internal IPs, customer emails, or API keys in your text, is transmitted to and processed by those servers. For developers debugging production code or HR teams drafting sensitive queries, this is a real data governance risk.

By default, OpenAI may use conversations to improve its models unless you opt out or operate under a zero-data-retention agreement.¹ Even with retention controls in place, the transmission window exists the moment you click send. Replacing sensitive values with tokens before the prompt leaves your machine closes that window entirely. OpenAI receives only placeholders, never the real data.

What OpenAI receives from your prompts

ChatGPT processes your full prompt on OpenAI infrastructure. Consequently, internal server addresses, customer email addresses, API keys, and database connection strings travel off your network the moment you submit. Even a casual debugging query such as "why is 10.0.1.42 returning a 503?" discloses an internal IP to a third party. Scrubbing transforms that query to "why is [IP_1] returning a 503?" before it leaves your browser, so OpenAI only ever processes the structural question, not the infrastructure detail.

The transmission happens before any OpenAI retention policy takes effect. Your prompt reaches their servers, gets processed, and a response returns, all within a few seconds. During that window, the raw text of your prompt exists on OpenAI infrastructure. For organizations handling GDPR-regulated data, that transmission alone may constitute a cross-border transfer requiring a legal mechanism under Article 46.² Scrubbing before the prompt leaves your browser eliminates the identifiable content from that transmission, reducing the data OpenAI receives to structural placeholders that carry no personal or infrastructure information.

Data types the scrubber removes

Around 22 sensitive types are detected automatically: IPv4 and IPv6 addresses, email addresses, all major API key formats (OpenAI sk-, AWS AKIA, GitHub ghp_, Stripe sk_live_/sk_test_, Google AIza, SendGrid SG., Twilio AC, NPM npm_, GitLab glpat-, Slack xox*), JWT tokens, database connection strings, PEM private key blocks, credit card numbers, US Social Security Numbers, phone numbers, and IBAN bank account numbers. Building on this, each unique value receives its own numbered token so the restoration step reconstructs the original exactly.

For ChatGPT specifically, the most commonly exposed types in developer prompts are IPv4 addresses (internal server IPs in debugging queries), API keys (accidentally included in config pastes), and database connection strings (embedded in error messages or stack traces). HR and business teams more frequently expose email addresses, phone numbers, and SSNs when drafting sensitive communications. The scrubber handles all 22 types in a single pass, so you do not need to pre-sort your text by data category before scrubbing.

Restoring real values in ChatGPT responses

After ChatGPT responds with tokens like [IP_1] and [EMAIL_1], paste the response into the Restore tab and upload the variables file you downloaded after scrubbing. The replacement runs locally in under a second. Your team gets a response that references real infrastructure values without OpenAI ever having received them. Conversely, skipping the scrub means the sensitive values are already in OpenAI's systems before any retention policy can act.

The restore step works because the variables file acts as a lookup table. Each token maps to exactly one original value, and the replacement is deterministic: every occurrence of [IP_1] becomes the same IP address it replaced. For long conversations where ChatGPT references multiple tokenized values across several responses, the same variables file handles restoration across all of them. Download the file once after scrubbing, and you can restore any number of ChatGPT responses from that session without re-scrubbing the original text.

ChatGPT tiers and organizational data retention controls

ChatGPT Teams and ChatGPT Enterprise operate under tighter data handling terms than individual accounts. Teams accounts opt out of model training by default for all workspace users, so your organization's conversations are not used to improve OpenAI's models. Enterprise accounts add zero data retention at the request level: OpenAI does not log inputs or outputs after the response is delivered.³ Standard individual Plus accounts operate under broader terms and require manual opt-out under Settings → Data Controls → Improve the model for everyone.

Understanding your account tier matters for how you think about residual risk after scrubbing. Even on Enterprise, the transmission event occurs on every request: your prompt reaches OpenAI's infrastructure, a response is generated, and the session closes. Scrubbing before each prompt ensures that what reaches OpenAI on every transmission contains no identifiable values, making retention controls less critical because there is nothing identifying to retain.

Checking your active tier in the ChatGPT interface

Your subscription tier appears under Settings → Your Plan in the ChatGPT web interface. Teams accounts display "ChatGPT Team" under the plan label. Enterprise accounts require checking the admin console to confirm zero retention is enabled at the organization level. When uncertain about your tier, treat the account as a non-ZDR one and scrub all sensitive values before every prompt regardless.

Custom GPTs and third-party action data flows

Custom GPTs can extend the base ChatGPT interface with external API connections called Actions. When a Custom GPT has Actions enabled, your prompt may trigger a call to a third-party API endpoint chosen by the GPT creator. Any sensitive values in your prompt travel to OpenAI and, if an Action fires, to that third-party endpoint as well.

Scrubbing before interacting with a Custom GPT closes both channels simultaneously. The scrubbed prompt contains no sensitive values, so neither OpenAI's processing nor any triggered Action receives identifiable data. Check the Custom GPT's configuration (visible by clicking the GPT name, then Configure) to see which external services are connected before submitting any prompt that includes internal context or personal data.

Third-party Custom GPTs from the GPT Store

Custom GPTs published in the OpenAI GPT Store can connect to any external service the creator registered. For GPTs built by organizations outside your own, the connected APIs may not be documented publicly. Apply the scrubber for all interactions with third-party Custom GPTs that involve internal or personal data, since the external data flow is less transparent than with first-party OpenAI models.

ChatGPT memory and cross-session persistence of sensitive values

ChatGPT memory stores facts from your conversations and includes them as context in future sessions.⁴ A sensitive value mentioned once in a debugging session (such as a production hostname or API endpoint) can be saved as a memory and surfaced in completely unrelated future conversations. This mechanism carries data across session boundaries, converting a one-time transmission risk into a persistent context risk.

Disable ChatGPT memory under Settings → Personalization → Memory if your organization restricts sensitive values from persisting in external systems. Alternatively, review and delete specific memories under Settings → Manage Memories after any session that involved sensitive data. Workspace admins on Teams accounts can disable memory organization-wide from the Admin Console.

Scrubbing as a complement to memory management

Memory management and scrubbing address different risks. Memory controls prevent cross-session persistence, while scrubbing prevents single-session transmission of real values. For the highest-risk scenarios involving production credentials or customer records, apply both controls: scrub the prompt before sending and confirm that memory storage is off. The scrubber is the faster of the two steps and requires no account settings to take effect, which makes it the easiest control to apply consistently.

CapyToolkit runs the scrubber entirely in your browser, so this protection applies to every account type without depending on OpenAI retention settings. Because the variables file is the only place the real values live, you keep full control of the data while still getting a complete ChatGPT response after restoration. Applying it takes only seconds before each prompt.

When to use this

Use this before pasting any prompt into ChatGPT that contains internal hostnames, credentials, customer data, or any information covered by your organization's data handling policy.

Examples

Why is the connection from 10.0.1.42 to db.corp.internal timing out? The API key is sk-abc123xyz.

Why is the connection from [IP_1] to [DOMAIN_1] timing out? The API key is [API_1].

Draft a performance review for [email protected] who earns $95,000.

Draft a performance review for [EMAIL_1] who earns $95,000.