What Data is Safe to Use?

Every prompt is a data-handling decision. Notre Dame classifies data into four sensitivity levels, and they govern what can go into which AI tool — including your code, your test data, and that log file you were about to paste.

The four levels

Level What it covers AI use
Public Information intended for broad release. No adverse effect if shared. Safe for all AI tools.
Internal Business data for internal circulation only. Potential operational impact. Approved AI tools only.
Sensitive Role-restricted information. Serious privacy or operational risk if leaked. Approved AI tools only — and think twice about whether the prompt needs it at all.
Restricted SSNs, credit card numbers, health data. Never enter into AI. No exceptions, no approved tool, no workaround.
Unsure about a data type? Don't share it with an AI tool. The approved AI tools page is the authoritative reference for levels and per-tool approvals.

What this means when you're coding

The tools page covers prompts in general. Coding adds a few places sensitivity hides:

Your code has a classification too

Hardcoded configuration, embedded queries, internal URLs, even comments can carry Internal-or-above information. When you paste code into a chat, you're sharing everything in it — not just the part you have a question about.

Test data defaults to synthetic

Never test with real people's records when made-up ones will do. Ask your AI to generate realistic synthetic data — it's genuinely good at this, and it removes the risk entirely.

Dumps and logs are where Sensitive data hides

Database exports, error logs, and stack traces routinely contain real emails, names, and tokens. Skim before you paste; redact or synthesize instead when in doubt.

Secrets are their own category

Passwords, API keys, and tokens never go into prompts at any sensitivity level — they get environment variables and secret managers. Full treatment: Secrets & credentials.

A 10-second gut check before any paste

  1. What's the sensitivity level of everything in this paste — data, code, and log lines?
  2. Is this tool approved for that level, on my ND account?
  3. Could a synthetic or redacted version answer the same question?

If any of those answers gives you pause, stop and ask us. A two-minute question in the Developer Interest Group chat beats an incident report.