Note: These guidelines apply to the entire use of AI-supported chat systems within the IT team.
Principle: No finger-pointing; improvement is the goal.
| Sensitivity Level | Examples | Notes |
|---|---|---|
| Low | Domain names Company names Organizational data |
This data can be publicly found. |
| Medium | FQDNs / IPs Groups, accounts, DNs Confidential documentation (e.g., IT documentation) Error messages (copy/paste) |
Always read before inserting into ChatGPT and neutralize if necessary. |
| High | Credentials Tokens Social engineering–relevant data |
Anything that could be abused to impersonate a trusted entity (e.g., scenarios like technician visits). |
| Mode | Description |
|---|---|
| Native Mode | Data may be used to train models. Comparable to publishing on the internet (homepage, public GitHub repository, etc.). |
| Temporary Session | Activation via the icon in the top right of the chat window. No storage in chat history. No use for model training. Data is internally stored for 30 days for security reasons. |
| API Usage (Aider, OpenWebUI, etc.) | Better data protection than a temporary session. Data may still be internally reviewed. Usage is subject to costs. See: OpenAI Enterprise Privacy |
Before any input into ChatGPT, the following must be known:
Sensitive data must be anonymized or abstracted before use.
| Sensitivity Level | Security Level | Procedure |
|---|---|---|
| Low | Any | No special measures required. |
| Medium | Temporary session or API call | Not a major problem, but avoid in the future ("Bad boy"). |
| Medium | Native mode | Immediate reporting to the IT team to ensure transparency. |
| High | Any | Immediate reporting to the IT team. Damage mitigation for possible social engineering risks. Renewal of affected data (e.g., passwords, tokens). |
During the implementation of AI-generated code (vibe coding), every employee must ensure: