Using AI on a Shared or Work Computer:
What Your IT Department Can See

Published August 9, 2026 · Updated August 17, 2026

This article is general information, not legal advice. For advice about your own situation, consult a qualified lawyer.

You did everything the privacy guides told you to. Training turned off. Temporary chat on. Maybe you went further and chose a tool built for anonymity. Then you typed the question into a laptop with your employer's asset tag on the bottom.

Here's the uncomfortable principle that governs this entire subject, and it's worth reading twice: the privacy of an AI conversation can never be better than the privacy of the machine you type it on. Every promise a chatbot makes (no training, no history, no identity attached) describes what happens after your words leave the device. None of it reaches backwards to cover the keyboard, the screen, the clipboard, or the disk. On a computer someone else administers, that's where the exposure lives.

This article is an inventory of what is actually visible, in the order the layers sit between your fingers and the model. Not worst-case speculation — capabilities named in the vendors' own administrator documentation.

First: What "Managed" Actually Means

A work laptop is usually enrolled. Somewhere in its setup, the device was joined to a management system — Microsoft Intune, Jamf, Workspace ONE or similar — which grants an administrator the standing ability to push configuration, install software silently, apply browser policy, and require security agents that you can't uninstall — and whose configuration, as opposed to their presence, you can't inspect.

This isn't surveillance creep or a rogue admin. It's the intended design of a corporate fleet, and most of it exists for defensible reasons: patching, malware, lost devices, regulatory obligations. But the same channel that pushes a security patch can push a monitoring policy, and the difference between the two is a checkbox in a console you have no access to. The honest posture is therefore not "my company would never"; it's "my company can, and I cannot verify what is switched on." You can often see that a device is managed, which agents run and which roots it trusts; what you can't see from your side is which policies are configured above them.

The Five Layers of Visibility

Layer 1: The network: where you went, and how much you said

Even with no software on your machine at all, traffic leaving a corporate network passes through equipment the company controls. At minimum that yields the destination, the timing, the frequency and the volume: that this device contacted an AI service at 11:40, again at 11:52, and pushed a few hundred kilobytes upstream. Encryption doesn't hide any of that. A large upload to an AI domain is a visible event even when its contents aren't. (Encrypted DNS and newer protocol features can obscure precisely which service a request is for; on a managed device, where the proxy configuration is also the employer's, that isn't something to rely on.)

Contents are a separate question, and the common assumption is wrong. "It's HTTPS, so they can't read it" is true against a stranger on the café Wi-Fi. It's not reliably true on a managed device, because HTTPS depends on your machine only trusting certificates from recognised authorities, and an administrator can install the company's own certificate authority into the device's trust store. Traffic is then decrypted at the corporate gateway, inspected, and re-encrypted onward. Your browser shows a padlock throughout, because from its point of view nothing is wrong: it was told to trust that certificate. This is a mainstream product category, not an exotic attack — Microsoft's own AI-governance documentation describes detecting "sensitive information shared with AI apps in browsers, applications, APIs, add-ins, and more" through a Secure Access Service Edge (SASE) or Security Service Edge (SSE) integration.

Layer 2: The browser: managed, and reporting

Here precision matters, because this layer is routinely overstated. An enterprise-managed Chrome profile reports a defined set of things to the admin console: per Google's documentation, installed extensions and their permissions, applied policies, device identifiers such as the machine name and BIOS serial, the OS and user account, and (for profile reporting) the signed-in user's email. Full browsing history is not part of that baseline feed.

What that baseline does establish is identity and posture: which human, on which machine, running which extensions. Deeper visibility comes from things layered on top, and one of them isn't a premium tier at all: Google's Chrome Reporting Extension for Windows reports an hourly aggregation of the pages users visit and the time spent on each, written to local JSON logs an employer ingests with ordinary tooling. Above that sit enterprise reporting connectors forwarding security events, and premium data-protection features that scan transfers for sensitive data and can generate URL-navigation events. The practical takeaway isn't "the browser sees nothing." It's that the browser is a managed component reporting to your employer by design, and how deep that reporting runs is a licensing and policy decision made above you.

One consequence people miss: an administrator can require the browser itself, force-install extensions into it, and block the alternatives. If a monitoring extension is mandated, choosing a different browser isn't the escape hatch it appears to be.

Layer 3: The endpoint: the layer that reads the prompt

This is the one that changes the conversation, and it's worth being exact rather than dramatic. Microsoft Purview's AI-governance documentation describes ready-made policies an organisation can switch on. Among them:

• A policy that "discovers sensitive content pasted or uploaded in Microsoft Edge, Chrome, and Firefox to AI sites" — covering, in Microsoft's phrasing, all users in the organisation in audit mode.
• An insider-risk policy that detects when users visit AI sites at all.
• Endpoint data-loss-prevention rules that can warn or block a user mid-action, with Microsoft's own illustration being a user pasting credit card numbers into ChatGPT.

And then the activity log itself. Purview's activity explorer records an event type called AI interaction, described in the documentation as: "User interacted with a generative AI site. Details include the prompts and responses." There's a separate, lighter event called AI website visit for the mere fact of browsing to one.

Read that again, because it's the sentence the rest of this article exists to deliver: on a corporate endpoint configured this way, the prompt itself becomes a logged, searchable record — not inferred from network volume, not reconstructed from a URL, but captured as text.

Two honest qualifications, because capability isn't the same as deployment, and Microsoft states them itself, immediately after the sentence above. Capturing the prompts and responses is conditional: it requires the organisation to have licensed it, onboarded the device, in several configurations deployed a browser extension to Windows users, and specifically enabled content capture in the relevant collection policy, which the one-click network policy doesn't do. For some unmanaged AI apps in Edge the captured detail may be the prompt text only. Read the event description as "can be configured to include the prompts and responses", not as a property every managed laptop has. Many employers have none of it. The point isn't that every company is doing this; it's that this is a product your employer can buy and enable without telling you anything you have not already agreed to, and you can't tell from your side of the screen whether they have.

Layer 4: The account: the admin console above your AI tool

If you use AI through a company account, the tenancy has an administrator, and the administrator has a console. The same Microsoft documentation lists a policy to "capture prompts and responses for regulatory compliance from enterprise AI apps, such as Chat GPT Enterprise" so they can be managed in compliance tooling including eDiscovery — the machinery used to produce documents in litigation and investigations.

There's a legal corollary that surprises people. On business and enterprise tiers the AI vendor typically acts as a processor for the organisation that bought it — Anthropic says so expressly for Claude for Work, while Google notes its customer may itself be either controller or processor, so the arrangement is common rather than universal. Practically, that means a request to delete your conversations goes to your employer, not to the AI company: the vendor's job is to follow the customer's instructions, and in this arrangement you aren't the customer. The privacy dial you're used to seeing in a consumer account is, in a corporate tenancy, someone else's dial.

Layer 5: The disk: what stays behind on the machine

Finally, the least technical and most frequently forgotten layer: traces sitting locally. Browser history and cache. Downloaded files, and the copies that survive in a temp folder after you delete the original. Anything synced into a corporate profile or picked up by a backup agent.

We should be straightforward about a wrinkle here that touches our own design. Privacy-focused AI tools (Secret Chat AI included) often keep your chat history in the browser's own storage rather than on a server. On your device that's a genuine privacy win: the archive is yours, not ours. On a machine you don't control, the same design puts the transcript on a disk your employer administers and may image, back up, or examine when the laptop is returned. The architecture didn't change; the ownership of the hardware did. Match the tool to whose computer it's running on.

Nobody Is Watching Live, and That Is Not Reassuring

The mental image of an IT technician reading your screen in real time is usually wrong — remote-support and screen-recording tools do exist, and in some roles are routine — but at scale it's the wrong thing to worry about. Monitoring at this scale is automatic: policies match, events land in logs, dashboards aggregate, alerts fire on thresholds. No human is reading your afternoon.

The risk isn't live observation. It's that a durable, searchable record exists, and that records get searched when circumstances change: a workplace investigation, a security incident review, a departure, a dispute, or litigation in which your employer's systems fall within scope. The question worth asking about anything you type isn't "is someone reading this now?" but "how would this read, out of context, to a stranger with a reason to look?" Ordinary AI chats have already surfaced in employment and family-court disputes, and a corporate log is a far tidier source than a personal account.

Two Workarounds That Do Not Work

Incognito or private browsing. Private mode is a setting about local storage on your own computer; it stops the browser writing history and cookies to disk. It does nothing to a security agent running with system privileges, nothing to a corporate proxy, and nothing to a managed browser policy, all of which sit outside the browsing session entirely. We covered the full extent of what it does and doesn't do in Incognito mode won't protect your AI chats.

A VPN on the work laptop. A VPN changes which network your traffic crosses. Changing the path can genuinely take you off a corporate proxy, but it doesn't remove the endpoint agent, which observes the text before it's ever encrypted, and the corporate root certificate stays trusted on the device for whenever the traffic returns to an inspected path. It may also be blocked by policy, and attempting to install one can itself be a logged event. See what a VPN actually protects for where it genuinely helps — which is a different threat entirely.

The pattern behind both: you cannot solve an endpoint problem from inside the endpoint. A tool you install to hide activity generally runs at a lower privilege level than the management stack watching it.

The Shared Computer Is a Different Problem

A family desktop, a hot desk, a hotel business centre, a library terminal, a shared workshop machine — here the adversary isn't a compliance dashboard. It's the next person to sit down, and the tools they need are already open.

What tends to leak, in rough order of likelihood: a still-signed-in session, because closing a tab isn't signing out; autofill and saved passwords; browser history and the address bar's suggestions, which will happily complete a search you would rather not re-demonstrate; downloaded files sitting in a shared Downloads folder; and any chat history the AI tool has stored in that browser profile, which persists across sessions precisely because it's meant to. On a shared machine, "I logged out" and "there is nothing left" are very different statements.

Practical countermeasures, cheapest first: use a separate operating-system account rather than just a separate browser profile — profiles are a convenience feature, not a security boundary; sign out deliberately and clear site data for the tool when you finish; keep downloads out of shared folders; and enable full-disk encryption so a powered-off machine isn't simply readable. And accept the limit: on a computer other people administer or physically hold, treat everything you type as potentially discoverable by them.

Is Any of This Legal? Mostly Yes, and That Is the Point

In the United States, employers generally have broad latitude to monitor their own equipment and networks — subject to real limits this article doesn't attempt to survey, including federal and state interception law, biometric statutes, sectoral rules and collective agreements. Several states layer a notice requirement on top rather than a prohibition:

• New York requires prior written notice on hiring to employees subject to electronic monitoring of telephone, email or internet usage, acknowledged by the employee, plus a conspicuously posted notice — Civil Rights Law § 52-c, in force since 7 May 2022, enforced by the Attorney General with penalties of $500, $1,000 and $3,000 for successive offences.
• Connecticut (Gen. Stat. § 31-48d) requires prior written notice of the types of monitoring that may occur, plus a posted notice, with civil penalties up to $3,000 and enforcement through the Labor Commissioner rather than private lawsuits.
• Delaware (19 Del. C. § 705) requires either a daily electronic notice or a one-time notice before monitoring email or internet usage, at $100 per violation.

Notice the shape of these laws: they mostly require that you be told. Which means that in many workplaces the monitoring isn't secret at all: the disclosure is in the handbook you clicked through on your first day, or posted on a wall you have walked past for years.

In the EU and UK the analysis is stricter but lands in a similar practical place: an employer is a controller, needs a lawful basis, and must satisfy necessity and proportionality. The Article 29 Working Party's Opinion 2/2017 on data processing at work (adopted 8 June 2017) remains the standing reference, now read alongside later EDPB and ICO employment-monitoring guidance, and its central point is one employees rarely realise cuts against them: consent is almost never a valid basis at work, because the imbalance of power means an employee can't freely refuse. Employers therefore rely on other bases such as legitimate interests, which requires proportionality, not your agreement. "I never consented" is, in most cases, simply not the argument it sounds like.

So the useful question is never "are they allowed to?" It's "what is the record, and who can read it later?"

What a Privacy-Focused Gateway Can and Cannot Do Here

We build one of these tools, so let us be precise about where it stops.

Secret Chat AI removes you from your queries — it does not remove the data from your messages. What it changes is the relationship with the model provider: we build no profile of you, no chat is ever associated with you, your queries reach the top models anonymously under our gateway's credentials rather than your name or IP, and they're never used for training. Your conversations live in your own browser rather than in a server-side archive; a prompt exists on our side only for as long as it takes to fetch your answer.

None of that touches the five layers above. We can make the model provider see a stranger. We can't make your employer's laptop stop being your employer's laptop. An endpoint agent reads the text before it reaches us; a corporate proxy sits on the path regardless of who we route to; and browser-side history is stored on a disk we don't administer. Any AI vendor claiming their product makes you invisible on a managed device is describing something that isn't architecturally possible.

What it does add, on the other side of that line, is the AI Council: one question sent to several models from different companies at once, each answer shown as that model finishes, and a referee then extracting the factual claims into a table of who asserted what, who contradicted it and who never mentioned it, with a short synthesis and a list to verify before acting. It saves time rather than spending it, because the panel runs in parallel: the wait is roughly that of the slowest single model rather than the sum of them. It changes nothing about the five layers: a keystroke logged by an endpoint agent is logged before it reaches any model, and a panel of four doesn't alter that. It also widens where your words go once they leave the device, reaching every model on the panel plus the referee, so the redaction reflex below matters more, not less; and agreement across the panel is evidence rather than proof, since models share training data and can be wrong together.

Two further honest limits worth stating plainly. "Anonymously" describes the link, not the words; no account identifier travels with your prompt, but writing your own name or a client's case number into a message leaves it sitting in the message. And anonymity isn't privilege, not a legal exemption, and not a way to keep anything from a court entitled to it; redacting identifying details before sending remains yours to do, and pasting someone else's personal data makes you responsible for that disclosure.

The Playbook

1. Move personal matters to a personal device on cellular data. This isn't a compromise, it's the whole answer, and it's the single highest-value action on this list. A phone you own, on a mobile network, running your own account, touches none of the five layers; no management profile, no corporate certificate, no endpoint agent, no company network. Health questions, legal worries, family conflicts, therapy-adjacent conversations, and above all job hunting belong there. Drafting your resignation letter on the machine your employer administers is the classic mistake, and it's entirely avoidable.

2. Ask for the monitoring policy in writing. This is less confrontational than it sounds, in several jurisdictions you were entitled to it anyway, and asking is normal. Knowing whether your employer runs endpoint DLP changes how you work far more than any browser setting. If you want help finding a tone that reads as diligent rather than suspicious:

3. For work content, use the sanctioned tool — deliberately. If your employer provides an AI service, using it's usually the right call for company data: it's contracted for, and pasting customer records into an unapproved consumer tool creates a processing relationship your organisation never agreed to, which is the real shape of "shadow AI" risk. Just hold both facts at once: sanctioned means governed, and governed means logged. Our guide for business owners covers the organisational side, and the difference between consumer and business tiers is unpacked in consumer ChatGPT vs API access.

4. Redact by reflex, on every machine. The one control that survives every layer is limiting what you type. Names, account numbers, addresses and case references you keep out can't be logged by anyone — employer or provider. If you're using AI to pressure-test a difficult work message, our walkthrough on checking a risky work message before sending it shows the de-identified version of that workflow.

5. On shared machines, separate accounts and clean up on the way out. Separate OS accounts, deliberate sign-out, cleared site data, encrypted disk. And remember that files carry their own metadata, a document uploaded from a work machine may name its author and origin regardless of what the text says.

The Bottom Line

Everything a privacy-focused AI tool offers begins at the moment your words leave the device. On a managed computer, that's one step too late: the network sees the destination and can be built to see the contents, the browser is a component your employer configures and can extend, the endpoint can be licensed to log the prompt itself as searchable text, the admin console above a corporate AI account can route conversations into eDiscovery, and the disk keeps whatever is left over. None of it requires anyone to be watching you, and in most places none of it's unlawful; you were probably notified in a document you accepted years ago.

So the rule is simple, and it's about hardware rather than software: match the machine to the matter. Work things on the work computer, where being observed is the expected condition and usually not a problem. Personal things on a device you own, on a network you chose, and, if you want the model provider kept at arm's length there too, through a gateway like Secret Chat AI that unlinks the query from you. What that combination gives you is the one arrangement where the privacy of the tool and the privacy of the machine finally point the same way.

Frequently Asked Questions

1. Can my employer really see what I type into ChatGPT or another AI chatbot?

   On a managed work computer it's possible, and it's a documented product capability rather than a theory. Microsoft Purview's administrator documentation describes an activity event named "AI interaction" whose details include the prompts and responses — conditional on the organisation licensing it, onboarding the device and switching on content capture, rather than automatic — alongside policies that discover sensitive content pasted or uploaded to AI sites in Edge, Chrome and Firefox. It requires the organisation to have licensed, configured and onboarded devices for it, so many employers have nothing of the kind running, but you can't tell from your side of the screen which is true where you work.

2. Doesn't HTTPS stop my company reading my AI conversations?

   Against outsiders, yes. On a device your employer administers, not reliably: an administrator can install the company's own certificate authority into the machine's trust store, which lets a corporate gateway decrypt, inspect and re-encrypt the traffic while your browser still shows a padlock. The lock indicates the browser trusts the certificate it was given, and on a managed device it was told to trust that one.

3. Does Incognito mode or a VPN hide AI use on a work laptop?

   Neither solves it. Private browsing only controls what the browser writes to local disk; it has no effect on a security agent, a corporate proxy or a managed browser policy. A VPN changes the network path but doesn't remove an endpoint agent that reads text before encryption, nor the corporate root certificate on the device, and installing one may itself violate policy and be logged. You can't fix an endpoint problem from inside the endpoint.

4. Is workplace monitoring of AI use legal?

   In the United States employers generally have wide latitude over their own equipment, and several states add a notice requirement rather than a ban — New York's Civil Rights Law § 52-c since 7 May 2022, Connecticut's § 31-48d and Delaware's 19 Del. C. § 705. In the EU and UK an employer needs a lawful basis and must meet necessity and proportionality; notably, the Article 29 Working Party's Opinion 2/2017 concluded consent is almost never valid at work because employees can't freely refuse, so employers rely on other bases instead. This is general information, not legal advice.

5. Does asking several AI models at once change what my employer can see?

   No. Every layer described here sits between you and the internet, so an endpoint agent reads what you type before it goes anywhere and a managed browser or corporate proxy sees the traffic whichever models answer it. Secret Chat AI's AI Council — one question put to several models from different companies in parallel, with a referee comparing their answers claim by claim — is useful because it saves the time of asking each model in turn and hands you a ready comparison instead of four long replies, not because it hides anything on a managed device. Off the device it widens where the text travels rather than narrowing it, since the question reaches every model on the panel plus the referee. For anything personal, the answer is still a device you own on a network you chose.

6. What is the safest way to use AI for something personal during the workday?

   Use your own phone or laptop on cellular data or your own network, signed into your own account. That single change bypasses device management, the corporate certificate, endpoint agents and the company network at once; no browser setting on a work machine comes close. Keep anything medical, legal, financial, family-related or job-search-related off employer hardware entirely, and redact identifying details wherever you're typing.