topic Re: Using Public LLMs with Sensitive Data – Are We Being Careful Enough? in SAS Software for Learning Community

Using Public LLMs with Sensitive Data – Are We Being Careful Enough?

rom_c — Thu, 29 Jan 2026 12:14:08 GMT

Hi everyone,

With the rise of public LLM tools (ChatGPT, online AI assistants, etc.), many of us use them to debug code, generate SAS scripts, or analyze problems faster.

But I’ve been wondering about something important —

If we paste real client data, production code, or sensitive datasets into public tools, there may be privacy and compliance risks.

Some things to consider:

Data may be stored or logged externally
Possible exposure of confidential information
Regulatory concerns (HIPAA, GDPR, company policies)
Intellectual property leakage

A few safer practices I’ve started following:

Use dummy/sample data instead of real data
Mask sensitive fields
Check company policies before uploading
Prefer internal/enterprise AI tools if available

Curious how others here handle this —
Do you use LLMs with your SAS workflow? Any best practices you follow?

Would love to hear different perspectives.

Re: Using Public LLMs with Sensitive Data – Are We Being Careful Enough?

Rachel_McLawhon — Thu, 29 Jan 2026 17:55:35 GMT

I'm with you! It’s a challenging balance—leveraging these tools while keeping sensitive information protected. Your best practices are spot‑on, and I also make a point to be more cautious than necessary when handling anything sensitive.

Thankfully in my role, the situations that demand heightened data privacy are usually pretty clear. Still, it’s always better to be safe than sorry!

Re: Using Public LLMs with Sensitive Data – Are We Being Careful Enough?

rom_c — Mon, 02 Feb 2026 05:33:53 GMT

Totally agree — using public LLMs with sensitive data always feels risky.

We ran into the same challenge internally, which is actually why we built Questa AI. The idea was simple: anonymize/redact sensitive data locally first, then send only sanitized content to any LLM so nothing confidential is exposed or used for training.

It’s been working well for privacy-sensitive workflows, and there’s a free tier if you’d like to try it out. Would love any feedback from this community too.