Short answer: yes, with a few settings and one team habit in place. The real risks aren't science-fiction hacks — they're ordinary mistakes that are easy to prevent once you know where to look.
If you run a small business and your team uses ChatGPT, Claude, Gemini, or an AI chatbot on your site, you've probably wondered whether it's actually safe. Here's the honest version, in plain English, with the fixes.
This is the most common one by far. Someone pastes a customer list, a contract, or health or payment details into a personal ChatGPT account to "get help with it." On a personal/free plan, you have less control over how that data is handled. The fix isn't to ban AI (people just hide it) — it's a one-page rule: fine for drafting and summarising, never paste customer names with details, health info, card numbers, or passwords. If you handle regulated data, use a business or enterprise plan with the right data agreement instead of personal accounts.
If your website chatbot can talk about refunds, prices, or bookings, assume a customer will get it to promise something — then screenshot it. The fix is one setting: route anything binding to "our team will confirm." Speed on drafting, a human on anything a customer could act on.
When you connect an AI assistant to your email or calendar, the consent screen often asks for broad access — "read and send email," "read all files." Most tools only need a slice of that. And the AI assistant that can send on its own is the one that sends the wrong thing to the wrong person. Turn auto-send off (AI drafts, a person sends), remove connections nobody uses, and give each tool its own limited login rather than the owner's master account.
Dramatic "someone will hack ChatGPT and steal everything" scenarios are rarely how small businesses get burned. The damage almost always comes from your own settings and habits — which is good news, because you can fix those yourself in an afternoon.
There's an extra risk: people can often pull your hidden instructions or uploaded files back out of it just by asking the right way. If you've loaded a custom GPT with your prompts, pricing, or private documents, it's worth testing whether it leaks them. We cover how in how to test your AI chatbot for prompt injection.
We put all of this into a free 10-minute checklist for small businesses — what your AI tools can reach, and the exact switches to flip. No sign-up, no passwords.
Open the free checklistPrefer someone to go through your actual tools for you? That's what the AI Tools Safety Check is for.
Related guides: How to test your AI chatbot for prompt injection · OWASP LLM Top 10: a plain-English checklist
Built with AI, reviewed by a human. General information, not legal or security advice.