When to use this checklist
- Before pasting support tickets, reviews, call notes, CRM rows, estimates, invoices, survey responses, hiring notes, or sales summaries into an AI tool.
- Before asking AI to find patterns across customer messages or draft reply templates from real examples.
- Before sharing prompt examples with an employee, contractor, consultant, or public forum.
- Human-review rule: if the source note contains payment, legal, medical, safety, employee, child, tenant, contract, password, API key, or private address details, stop and route it through an approved secure workflow instead of a casual AI prompt.
Copy/paste redaction worksheet
Use case: support summary / sales-call recap / review pattern / SOP example / lead triage / other
Source owner: [person/team responsible for approving use]
Allowed purpose: summarize patterns / draft internal template / create checklist / improve process / other
Remove or replace: customer names, phone numbers, emails, addresses, payment details, account IDs, invoice numbers, private screenshots, login details, health/safety facts, employee names, exact dates when not needed.
Generalize: city/region instead of address, job type instead of full case history, price range instead of invoice line, role instead of name, week/month instead of exact appointment time.
Keep only useful context: product/service category, customer question, process stage, missing information, tone issue, delay reason, policy involved, and desired output format.
Risk label: public-safe / internal only / manager review / STOP AUTOMATION
Reviewer: [owner/manager] confirms redacted note is safe to paste.
Before/after example
Raw note that should not be pasted: “Jane Smith at 42 Maple Street called from 555-0100 about invoice 8821 and said her card ending 1234 was charged twice after the March 14 visit.”
Safer AI-ready version: “A customer reported a possible duplicate charge after a recent service visit. The team needs a neutral internal checklist for payment-dispute triage. Do not include names, addresses, card details, exact invoice IDs, or promises of refund. Mark anything involving billing as NEEDS OWNER REVIEW.”
AI prompt for checking redaction quality
You are reviewing whether a small-business note is safe to use in an AI workflow. Check only the redacted note below. Do not infer missing customer history, identity, payment status, legal facts, health/safety facts, consent, or employee performance. Return: (1) remaining private fields to remove, (2) useful context that is safe to keep, (3) risk label: public-safe/internal-only/manager-review/STOP AUTOMATION, (4) one safer rewrite, and (5) whether a human owner must approve before use. Redacted note: [PASTE].
Redaction rules that keep AI workflows safer
- Do not paste secrets: passwords, API keys, tokens, private URLs, internal credentials, and customer payment details never belong in a casual AI prompt.
- Do not invent customer history: if a customer’s prior contact, consent, payment, warranty, or complaint history is missing, label it missing instead of guessing.
- Separate examples from live work: use synthetic or heavily redacted examples for training templates; keep live customer decisions in approved systems.
- Keep the owner visible: every reusable AI workflow needs a named person responsible for allowed inputs, output review, and rollback.
- Review before customer-facing use: anything that changes pricing, refunds, policy, legal wording, availability, diagnosis, safety advice, or customer promises needs owner approval.
Where this fits in the AI workflow kit
Pair this checklist with the AI Tool Data Boundary Worksheet, AI Tool Usage Policy Template, AI Workflow Owner Matrix, free prompt governance checklist, and The Small Business AI Profit Kit.