Contents
Whether you can paste client code into ChatGPT under an NDA comes down to two separate questions. First, disclosure: does your contract let you share the client’s code with a third party at all? Second, retention: if it does, what does the AI provider keep, for how long, and does it train on it? A private provider can answer the second question. Only your contract answers the first.
This isn’t legal advice. If the contract is unclear and the code matters, ask the client or a lawyer.
Question 1: what your contract allows
An NDA usually limits who you may disclose confidential information to. Sending code to an AI tool is sending it to a company. Whether that counts as disclosure depends on the wording, and many contracts written before AI tools don’t say.
Read for these:
- Who counts as a permitted recipient. Employees and subcontractors? “Service providers” bound by confidentiality? Nobody else?
- Any clause on AI or third-party tools. Some newer contracts name AI tools directly, either banning them or allowing approved ones.
- Where the data may go. Some contracts restrict processing to a country or region.
- Who owns the output. Code an AI tool wrote for the client still falls under your deliverables clause.
If the contract says nothing, ask. A one-line email (“I use an AI coding assistant that doesn’t keep code; is that fine for this project?”) turns a guess into a written answer.
Question 2: what the provider keeps
“We don’t train on your data” is one answer out of several. A provider can skip training and still keep your prompts for 30 days, or keep flagged conversations for years. Policies also differ between a company’s consumer app and its API.
Two examples, from the providers’ own pages, as of November 1, 2026:
- OpenAI API. Its data controls guide says “data sent to the OpenAI API is not used to train or improve OpenAI models,” but abuse monitoring logs are “retained for up to 30 days.” Zero retention exists, “subject to prior approval by OpenAI and acceptance of additional requirements.”
- Claude. For consumer plans, Anthropic’s training article ties training to a “Model Improvement” setting. With it on, Anthropic “may retain your data in a de-identified format for up to 5 years” (retention article); deleted chats are “Deleted from our back-end storage systems within 30 days.” For commercial products, Anthropic says “we will not use your inputs or outputs from our commercial products” for training (commercial article).
So the same company can keep very different things depending on which plan you’re on and which settings you’ve touched. Check your own account’s training setting before you paste anything, and check which plan your client would expect you to use.
What makes an LLM API private? lists the seven questions to ask any provider.
The checklist
Before you paste client code into any AI tool:
- Read the confidentiality clause. Find who you may disclose to, and whether AI tools are mentioned.
- Get a yes in writing if it’s unclear. One email, kept with the contract.
- Strip secrets first. API keys, passwords, connection strings, tokens,
.envcontents, customer data in fixtures and logs. Replace them with placeholders. - Send less. Paste the function you need help with, not the repository. Rename the client’s product and internal hostnames.
- Know your plan and settings. Consumer, team or API; training on or off; how long chats are kept.
- Check what the provider keeps. Logs, retention period, human review, the model host. The seven questions cover it.
- Write down what you used. Tool, plan, date. If the client asks later, you have the answer.
Strip secrets first, every time
A secret in a prompt is a secret you’ve shared, whatever the provider’s policy. Rotating a leaked key costs the client time and trust. Before pasting, search the snippet for key, secret, token, password and ://, and replace what you find. A secret scanner in your editor or pre-commit hook catches most of the rest.
Local or hosted
A model on your own machine sends nothing anywhere. If your contract forbids any third-party processing, local is the only option that fits it. The trade-off is hardware: the models that fit on a laptop are smaller than hosted ones, and slower on long files.
A hosted provider is a third party, however little it keeps. If disclosure to service providers is allowed, a hosted model with zero retention is the next-closest thing to local: the code is processed and not stored.
Where SolCard Inference fits, and where it doesn’t
SolCard Inference answers the retention question. Prompts and responses are never logged or stored, on every model, and the model host isn’t told who you are. Chat history stays in your browser unless you turn on end-to-end encrypted sync, which our servers can’t read. We keep a billing line per request: time, key, model, tokens, cost. Keeps nothing traces one message all the way through.
It doesn’t answer the disclosure question. We’re a third party too. If your NDA bars sending code to any outside service, zero retention doesn’t change that.
Other limits worth knowing:
- Text only. No image, audio or file input on the API; files in the chat app are read on your device and sent as text.
- Three open models, not the closed models your client may have approved. Fast, Large or Base compares them.
- It works in your editor. The API speaks OpenAI and Anthropic formats, so Claude Code, Codex and other coding agents can use it. The setup guide takes one sentence.
FAQ
Is pasting code into ChatGPT a breach of my NDA?
It depends on the NDA. If it limits disclosure to named parties and doesn’t allow service providers, sending code to any AI company may breach it. If it allows confidential service providers, the provider’s retention terms matter next.
Does a zero-retention AI tool make it safe?
It makes it safer: nothing you send is kept, so there’s nothing to leak later. It doesn’t make it permitted. That’s still your contract’s call.
Should I tell clients I use AI tools?
If the contract is silent, asking is cheaper than explaining later. Say which tool, what it keeps, and that you strip secrets first.