Before uploading a document, decide whether you are allowed to share it and whether the entire file is needed. Then check the privacy and retention rules that apply to the product, account, and connected tools you will use. A familiar assistant name or a paid plan does not answer those questions by itself.
Identify the material and the purpose
Write down the intended task: summarize a public report, compare approved internal drafts, or extract decisions from meeting notes. Classify the file using your organization's actual rules. If you do not own the material, check whether its owner or your workplace permits this use.
Inspect more than the visible text. Files can contain comments, tracked revisions, hidden sheets, author details, embedded links, or old pages. A document that looks like a short proposal may also carry private discussions. Review a copy before deciding what to submit.
Provide the minimum useful input
A question about a clause may need that clause and its surrounding definitions, rather than an entire contract. A formatting task can often use a synthetic sample. Remove identifiers that do not affect the answer, but preserve relationships and units the assistant needs to interpret the example correctly.
Keep an unchanged original and label your edited copy. Redaction should actually remove information from the file you upload; covering text with a visible shape may leave the underlying text available. Reopen the copy and inspect what it contains before using it.
Read the terms for the service you selected
Check data use, retention, deletion, human access, and third-party processing separately. A statement about training does not automatically answer how long a file stays available or who can access a shared conversation. Consumer, business, developer, and enterprise services may have distinct rules.
For a concrete example, Notion's official AI security and privacy guide says customer data is not used for model training by default and separately explains retention and plan-specific settings. That is evidence about Notion's documented service, not a policy that can be transferred to every other assistant.
Record the policy page and date checked. If a feature uses a connected application or a different model provider, inspect the applicable information for that feature rather than assuming the account's simplest workflow covers it.
Inspect sharing and connected access
Before connecting a workspace, confirm which folders, pages, or accounts become available. Use access appropriate to the job. If your task concerns one approved folder, broad access to every shared drive may add unnecessary exposure and irrelevant context.
Review the destination as carefully as the input. A public share link, exported document, or message sent to another service can create a new copy of private material. Check the recipients and visible content before sharing. Removing an attachment from one screen may not remove copies already exported or distributed.
Check the output against its source
Ask the assistant to distinguish extracted information from inference. For a document summary, compare important names, dates, quantities, and decisions with the original pages. If the answer refers to a source location, confirm that location yourself. Privacy controls do not make a generated summary accurate.
Keep a short record of the product, account type, material submitted, purpose, and output destination when your work requires an audit trail. Avoid placing the sensitive contents into the record itself when a filename and description are sufficient.
You are ready to proceed when the sharing is authorized, the input is limited to what the task needs, the applicable controls are understood, and the result has a clear review path. For evidence checking after research, see the separate source verification guide.
