Using AI on a Shared or Work Computer:
What Your IT Department Can See

Published August 9, 2026

This article is general information, not legal advice. For advice about your own situation, consult a qualified lawyer.

You did everything the privacy guides told you to. Training turned off. Temporary chat on. Maybe you went further and chose a tool built for anonymity. Then you typed the question into a laptop with your employer's asset tag on the bottom.

Here is the uncomfortable principle that governs this entire subject, and it is worth reading twice: the privacy of an AI conversation can never be better than the privacy of the machine you type it on. Every promise a chatbot makes — no training, no history, no identity attached — describes what happens after your words leave the device. None of it reaches backwards to cover the keyboard, the screen, the clipboard, or the disk. On a computer someone else administers, that is where the exposure lives.

This article is an inventory of what is actually visible, in the order the layers sit between your fingers and the model. Not worst-case speculation — capabilities named in the vendors' own administrator documentation.

First: What "Managed" Actually Means

A work laptop is usually enrolled. Somewhere in its setup, the device was joined to a management system — Microsoft Intune, Jamf, Workspace ONE or similar — which grants an administrator the standing ability to push configuration, install software silently, apply browser policy, and require security agents that you cannot uninstall and generally cannot see.

This is not surveillance creep or a rogue admin. It is the intended design of a corporate fleet, and most of it exists for defensible reasons: patching, malware, lost devices, regulatory obligations. But the same channel that pushes a security patch can push a monitoring policy, and the difference between the two is a checkbox in a console you have no access to. The honest posture is therefore not "my company would never" — it is "my company can, and I have no way to check."

The Five Layers of Visibility

Layer 1 — The network: where you went, and how much you said

Even with no software on your machine at all, traffic leaving a corporate network passes through equipment the company controls. At minimum that yields the destination, the timing, the frequency and the volume: that this device contacted an AI service at 11:40, again at 11:52, and pushed a few hundred kilobytes upstream. Encryption does not hide any of that. A large upload to an AI domain is a visible event even when its contents are not.

Contents are a separate question, and the common assumption is wrong. "It's HTTPS, so they can't read it" is true against a stranger on the café Wi-Fi. It is not reliably true on a managed device, because HTTPS depends on your machine only trusting certificates from recognised authorities — and an administrator can install the company's own certificate authority into the device's trust store. Traffic is then decrypted at the corporate gateway, inspected, and re-encrypted onward. Your browser shows a padlock throughout, because from its point of view nothing is wrong: it was told to trust that certificate. This is a mainstream product category, not an exotic attack — Microsoft's own AI-governance documentation describes detecting "sensitive information shared with AI apps in browsers, applications, APIs, add-ins, and more" through a Secure Access Service Edge (SASE) or Security Service Edge (SSE) integration.

Layer 2 — The browser: managed, and reporting

Here precision matters, because this layer is routinely overstated. An enterprise-managed Chrome profile reports a defined set of things to the admin console: per Google's documentation, installed extensions and their permissions, applied policies, device identifiers such as the machine name and BIOS serial, the OS and user account, and — for profile reporting — the signed-in user's email. Full browsing history is not part of that baseline feed.

What that baseline does establish is identity and posture: which human, on which machine, running which extensions. URL-level and content-level visibility is a separate, purchasable tier — enterprise reporting connectors that forward security events, and premium data-protection features that scan transfers for sensitive data. The practical takeaway is not "the browser sees nothing." It is that the browser is a managed component reporting to your employer by design, and how deep that reporting runs is a licensing and policy decision made above you.

One consequence people miss: an administrator can require the browser itself, force-install extensions into it, and block the alternatives. If a monitoring extension is mandated, choosing a different browser is not the escape hatch it appears to be.

Layer 3 — The endpoint: the layer that reads the prompt

This is the one that changes the conversation, and it is worth being exact rather than dramatic. Microsoft Purview's AI-governance documentation describes ready-made policies an organisation can switch on. Among them:

• A policy that "discovers sensitive content pasted or uploaded in Microsoft Edge, Chrome, and Firefox to AI sites" — covering, in Microsoft's phrasing, all users in the organisation in audit mode.
• An insider-risk policy that detects when users visit AI sites at all.
• Endpoint data-loss-prevention rules that can warn or block a user mid-action, with Microsoft's own illustration being a user pasting credit card numbers into ChatGPT.

And then the activity log itself. Purview's activity explorer records an event type called AI interaction, described in the documentation as: "User interacted with a generative AI site. Details include the prompts and responses." There is a separate, lighter event called AI website visit for the mere fact of browsing to one.

Read that again, because it is the sentence the rest of this article exists to deliver: on a properly configured corporate endpoint, the prompt itself is a logged, searchable record — not inferred from network volume, not reconstructed from a URL, but captured as text.

Two honest qualifications, because capability is not the same as deployment. This requires the organisation to have licensed it, onboarded the device, and in several configurations deployed a browser extension to Windows users — and the richest capture paths are configured per policy rather than being on by default. Many employers have none of it. The point is not that every company is doing this; it is that this is a product your employer can buy and enable without telling you anything you have not already agreed to, and you cannot tell from your side of the screen whether they have.

Layer 4 — The account: the admin console above your AI tool

If you use AI through a company account, the tenancy has an administrator, and the administrator has a console. The same Microsoft documentation lists a policy to "capture prompts and responses for regulatory compliance from enterprise AI apps, such as Chat GPT Enterprise" so they can be managed in compliance tooling including eDiscovery — the machinery used to produce documents in litigation and investigations.

There is a legal corollary that surprises people. On business and enterprise tiers the AI vendor is typically acting as a processor for your employer, who is the controller. Practically, that means a request to delete your conversations goes to your employer, not to the AI company — the vendor's job is to follow the customer's instructions, and in this arrangement you are not the customer. The privacy dial you are used to seeing in a consumer account is, in a corporate tenancy, someone else's dial.

Layer 5 — The disk: what stays behind on the machine

Finally, the least technical and most frequently forgotten layer: traces sitting locally. Browser history and cache. Downloaded files, and the copies that survive in a temp folder after you delete the original. Anything synced into a corporate profile or picked up by a backup agent.

We should be straightforward about a wrinkle here that touches our own design. Privacy-focused AI tools — Secret Chat AI included — often keep your chat history in the browser's own storage rather than on a server. On your device that is a genuine privacy win: the archive is yours, not ours. On a machine you do not control, the same design puts the transcript on a disk your employer administers and may image, back up, or examine when the laptop is returned. The architecture did not change; the ownership of the hardware did. Match the tool to whose computer it is running on.

Nobody Is Watching Live — and That Is Not Reassuring

The mental image of an IT technician reading your screen in real time is almost always wrong, and it is the wrong thing to worry about. Monitoring at this scale is automatic: policies match, events land in logs, dashboards aggregate, alerts fire on thresholds. No human is reading your afternoon.

The risk is not live observation. It is that a durable, searchable record exists, and that records get searched when circumstances change — a workplace investigation, a security incident review, a departure, a dispute, or litigation in which your employer's systems fall within scope. The question worth asking about anything you type is not "is someone reading this now?" but "how would this read, out of context, to a stranger with a reason to look?" Ordinary AI chats have already surfaced in employment and family-court disputes, and a corporate log is a far tidier source than a personal account.

Two Workarounds That Do Not Work

Incognito or private browsing. Private mode is a setting about local storage on your own computer — it stops the browser writing history and cookies to disk. It does nothing to a security agent running with system privileges, nothing to a corporate proxy, and nothing to a managed browser policy, all of which sit outside the browsing session entirely. We covered the full extent of what it does and does not do in Incognito mode won't protect your AI chats.

A VPN on the work laptop. A VPN changes which network your traffic crosses. It does not remove the endpoint agent, which observes the text before it is ever encrypted, and it does not remove the corporate root certificate from the device's trust store. It may also be blocked by policy, and attempting to install one can itself be a logged event. See what a VPN actually protects for where it genuinely helps — which is a different threat entirely.

The pattern behind both: you cannot solve an endpoint problem from inside the endpoint. Every tool you install to hide activity runs at a lower privilege level than the management stack watching it.

The Shared Computer Is a Different Problem

A family desktop, a hot desk, a hotel business centre, a library terminal, a shared workshop machine — here the adversary is not a compliance dashboard. It is the next person to sit down, and the tools they need are already open.

What tends to leak, in rough order of likelihood: a still-signed-in session, because closing a tab is not signing out; autofill and saved passwords; browser history and the address bar's suggestions, which will happily complete a search you would rather not re-demonstrate; downloaded files sitting in a shared Downloads folder; and any chat history the AI tool has stored in that browser profile, which persists across sessions precisely because it is meant to. On a shared machine, "I logged out" and "there is nothing left" are very different statements.

Practical countermeasures, cheapest first: use a separate operating-system account rather than just a separate browser profile — profiles are a convenience feature, not a security boundary; sign out deliberately and clear site data for the tool when you finish; keep downloads out of shared folders; and enable full-disk encryption so a powered-off machine is not simply readable. And accept the limit: on a computer other people administer or physically hold, treat everything you type as potentially discoverable by them.

Is Any of This Legal? Mostly Yes — and That Is the Point

In the United States, employers generally have broad latitude to monitor their own equipment and networks, and several states layer a notice requirement on top rather than a prohibition:

• New York requires prior written notice on hiring to employees subject to electronic monitoring of telephone, email or internet usage, acknowledged by the employee, plus a conspicuously posted notice — Civil Rights Law § 52-c, in force since 7 May 2022, enforced by the Attorney General with penalties of $500, $1,000 and $3,000 for successive offences.
• Connecticut (Gen. Stat. § 31-48d) requires prior written notice of the types of monitoring that may occur, plus a posted notice, with civil penalties up to $3,000 and enforcement through the Labor Commissioner rather than private lawsuits.
• Delaware (19 Del. C. § 705) requires either a daily electronic notice or a one-time notice before monitoring email or internet usage, at $100 per violation.

Notice the shape of these laws: they mostly require that you be told. Which means that in many workplaces the monitoring is not secret at all — the disclosure is in the handbook you clicked through on your first day, or posted on a wall you have walked past for years.

In the EU and UK the analysis is stricter but lands in a similar practical place: an employer is a controller, needs a lawful basis, and must satisfy necessity and proportionality. The Article 29 Working Party's Opinion 2/2017 on data processing at work (adopted 8 June 2017) is the standing reference, and its central point is one employees rarely realise cuts against them: consent is almost never a valid basis at work, because the imbalance of power means an employee cannot freely refuse. Employers therefore rely on other bases such as legitimate interests — which requires proportionality, not your agreement. "I never consented" is, in most cases, simply not the argument it sounds like.

So the useful question is never "are they allowed to?" It is "what is the record, and who can read it later?"

What a Privacy-Focused Gateway Can and Cannot Do Here

We build one of these tools, so let us be precise about where it stops.

Secret Chat AI removes you from your queries — it does not remove the data from your messages. What it changes is the relationship with the model provider: we build no profile of you, no chat is ever associated with you, your queries reach the top models anonymously under our gateway's credentials rather than your name or IP, and they are never used for training. Your conversations live in your own browser rather than in a server-side archive; a prompt exists on our side only for as long as it takes to fetch your answer.

None of that touches the five layers above. We can make the model provider see a stranger. We cannot make your employer's laptop stop being your employer's laptop. An endpoint agent reads the text before it reaches us; a corporate proxy sits on the path regardless of who we route to; and browser-side history is stored on a disk we do not administer. Any AI vendor claiming their product makes you invisible on a managed device is describing something that is not architecturally possible.

Two further honest limits worth stating plainly. "Anonymously" describes the link, not the words — no account identifier travels with your prompt, but writing your own name or a client's case number into a message leaves it sitting in the message. And anonymity is not privilege, not a legal exemption, and not a way to keep anything from a court entitled to it; redacting identifying details before sending remains yours to do, and pasting someone else's personal data makes you responsible for that disclosure.

The Playbook

1. Move personal matters to a personal device on cellular data. This is not a compromise, it is the whole answer, and it is the single highest-value action on this list. A phone you own, on a mobile network, running your own account, touches none of the five layers — no management profile, no corporate certificate, no endpoint agent, no company network. Health questions, legal worries, family conflicts, therapy-adjacent conversations, and above all job hunting belong there. Drafting your resignation letter on the machine your employer administers is the classic mistake, and it is entirely avoidable.

2. Ask for the monitoring policy in writing. This is less confrontational than it sounds — in several jurisdictions you were entitled to it anyway, and asking is normal. Knowing whether your employer runs endpoint DLP changes how you work far more than any browser setting. If you want help finding a tone that reads as diligent rather than suspicious:

3. For work content, use the sanctioned tool — deliberately. If your employer provides an AI service, using it is usually the right call for company data: it is contracted for, and pasting customer records into an unapproved consumer tool creates a processing relationship your organisation never agreed to, which is the real shape of "shadow AI" risk. Just hold both facts at once: sanctioned means governed, and governed means logged. Our guide for business owners covers the organisational side, and the difference between consumer and business tiers is unpacked in consumer ChatGPT vs API access.

4. Redact by reflex, on every machine. The one control that survives every layer is limiting what you type. Names, account numbers, addresses and case references you keep out cannot be logged by anyone — employer or provider. If you are using AI to pressure-test a difficult work message, our walkthrough on checking a risky work message before sending it shows the de-identified version of that workflow.

5. On shared machines, separate accounts and clean up on the way out. Separate OS accounts, deliberate sign-out, cleared site data, encrypted disk. And remember that files carry their own metadata — a document uploaded from a work machine may name its author and origin regardless of what the text says.

The Bottom Line

Everything a privacy-focused AI tool offers begins at the moment your words leave the device. On a managed computer, that is one step too late: the network sees the destination and can be built to see the contents, the browser is a component your employer configures and can extend, the endpoint can be licensed to log the prompt itself as searchable text, the admin console above a corporate AI account can route conversations into eDiscovery, and the disk keeps whatever is left over. None of it requires anyone to be watching you, and in most places none of it is unlawful — you were probably notified in a document you accepted years ago.

So the rule is simple, and it is about hardware rather than software: match the machine to the matter. Work things on the work computer, where being observed is the expected condition and usually not a problem. Personal things on a device you own, on a network you chose — and, if you want the model provider kept at arm's length there too, through a gateway like Secret Chat AI that unlinks the query from you. What that combination gives you is the one arrangement where the privacy of the tool and the privacy of the machine finally point the same way.

Frequently Asked Questions

1. Can my employer really see what I type into ChatGPT or another AI chatbot?

   On a managed work computer it is possible, and it is a documented product capability rather than a theory. Microsoft Purview's administrator documentation describes an activity event named "AI interaction" whose details include the prompts and responses, alongside policies that discover sensitive content pasted or uploaded to AI sites in Edge, Chrome and Firefox. It requires the organisation to have licensed, configured and onboarded devices for it, so many employers have nothing of the kind running — but you cannot tell from your side of the screen which is true where you work.

2. Doesn't HTTPS stop my company reading my AI conversations?

   Against outsiders, yes. On a device your employer administers, not reliably: an administrator can install the company's own certificate authority into the machine's trust store, which lets a corporate gateway decrypt, inspect and re-encrypt the traffic while your browser still shows a padlock. The lock indicates the browser trusts the certificate it was given — and on a managed device it was told to trust that one.

3. Does Incognito mode or a VPN hide AI use on a work laptop?

   Neither solves it. Private browsing only controls what the browser writes to local disk; it has no effect on a security agent, a corporate proxy or a managed browser policy. A VPN changes the network path but does not remove an endpoint agent that reads text before encryption, nor the corporate root certificate on the device — and installing one may itself violate policy and be logged. You cannot fix an endpoint problem from inside the endpoint.

4. Is workplace monitoring of AI use legal?

   In the United States employers generally have wide latitude over their own equipment, and several states add a notice requirement rather than a ban — New York's Civil Rights Law § 52-c since 7 May 2022, Connecticut's § 31-48d and Delaware's 19 Del. C. § 705. In the EU and UK an employer needs a lawful basis and must meet necessity and proportionality; notably, the Article 29 Working Party's Opinion 2/2017 concluded consent is almost never valid at work because employees cannot freely refuse, so employers rely on other bases instead. This is general information, not legal advice.

5. What is the safest way to use AI for something personal during the workday?

   Use your own phone or laptop on cellular data or your own network, signed into your own account. That single change bypasses device management, the corporate certificate, endpoint agents and the company network at once — no browser setting on a work machine comes close. Keep anything medical, legal, financial, family-related or job-search-related off employer hardware entirely, and redact identifying details wherever you are typing.