Private research with AI: minimize what leaves your notes
AI research privacy starts by reducing the information you send, rather than assuming a private conversation makes every attachment appropriate. Build a minimum packet containing only the public excerpt and context needed for one question. Keep account identifiers, private notes and the mapping back to your portfolio outside that packet unless they are necessary and you have checked the destination’s handling terms.
Inventory the information before preparing the question
The NIST Privacy Framework provides an approach to managing privacy risk. The packet method here is an editorial workflow, not a claim that NIST certifies a particular AI service. List the original file, the fields it contains, the question to answer, the recipient and the copies the task will create. A research note may combine harmless public reporting with sensitive account balances or another person’s identity.
Removing a name does not automatically make a packet anonymous. An unusual combination of trade dates, employer, holdings and location can still identify someone. Reduce unnecessary detail at its source. If you only want an explanation of a public cash-flow footnote, the model does not need your account statement, cost basis or reason for owning the shares.
A hypothetical packet for a receivables question
Assume an investor has a document that contains a public annual-report extract, an account number, a position worth 40,000 assumed currency units and a private family comment. The question is whether the company’s receivables definition changed. The position and family comment add no evidence about that definition. They should not be included merely because they share the same file.
| Item | Send for this task? | Reason |
|---|---|---|
| Public note extract and report period | Yes | Establishes the definition being examined |
| Public report URL and page number | Yes | Allows the extract to be checked |
| Personal account number | No | Does not help interpret the note |
| Position size and purchase price | No | Not needed for the stated question |
| Local record identifier P17 | If useful | Lets you reconnect the answer without sending the identity map |
Keep the P17 mapping locally and avoid meaningful aliases such as a person’s name. An alias is an organizational aid, not a security control or a guarantee that other clues cannot reveal identity. Before sending, preview the exact prepared text rather than the original document’s visible first page.
Inspect hidden copies and outputs
Attachments can contain more than the selected excerpt: spreadsheet tabs, comments, document properties or image backgrounds may be relevant. Use a clean export with only the needed material and check that export directly. Do not assume that covering text with a rectangle removes the underlying content. When reliable redaction cannot be verified, omit the attachment and type a small public excerpt with its source instead.
Also inspect the response and any exported files. A model can repeat sensitive details it received; a later research memo may circulate farther than the original conversation. Record where the packet was sent and which derivative files were created. Check the actual provider’s retention, sharing and deletion controls before use. Interface deletion should not be interpreted as a verified deletion of every retained copy without supporting terms.
Stop conditions and limits
If the question genuinely requires a private record, reconsider the task boundary and use an appropriately controlled workflow. Data minimization is not permission to transmit confidential material. This method cannot establish a service’s security, resolve legal obligations or verify a provider’s deletion process. Its measurable outcome is narrower: you can show why every included field was necessary, and identify the copies you knowingly created.
FAQ
Can I just replace names with initials?
Initials remove one direct identifier but may leave enough context to identify the person. Review combinations of fields and remove details unrelated to the question.
Should I include my position to get a better explanation?
Only if the task actually depends on position information. Explaining an issuer’s accounting definition normally does not require a private holding amount.