Keep sensitive documents out of your AI assistant's reach

TL;DR — To keep sensitive documents away from an AI assistant, put them in a separate protected folder or drive, remove the assistant app's access to that location, and turn off any "sync," "index," or "use local files" setting in the assistant. The most common fix is revoking file access at the operating system or cloud-storage level, then verifying the assistant cannot open or reference a test document. Reading time: ~5 min

Goal

When you finish, your sensitive documents will live in a clearly named protected location, your AI assistant will not have permission to read that location, and a test file placed there will not be available to the assistant through chat, search, or file-picking.

Prerequisites

• Access to the device where the AI assistant runs: Windows 11, macOS 14+, or a managed company laptop
• Access to your cloud storage or document system, if you store files there: Microsoft 365, Google Drive, Dropbox, Box, or similar
• Permission to change app privacy settings on your device; if your company locks this down, you need your IT admin
• The name of the AI assistant app you use and whether it runs in a browser or as a desktop app
• One non-sensitive test file you can create, such as ai-access-test.txt
• Optional for admins: access to your identity provider (single sign-on, or SSO) and device-management tool if you want to apply the same block company-wide

Steps

Step 1: Create one protected location for sensitive files

Pick one place for sensitive documents instead of scattering them across Desktop, Downloads, and shared folders.

Use one of these exact paths:

• Windows File Explorer → C:\Sensitive-Docs
• macOS Finder → your home folder → create folder named Sensitive-Docs
• In your cloud storage provider's dashboard (for example, Google Drive: My Drive → New → Folder, or Microsoft OneDrive/SharePoint: New → Folder) → create folder named Sensitive-Docs

If you want a local test file, create this exact file inside that folder:

ai-access-test.txt

Put this exact text in the file:

If an AI assistant can quote this sentence, access is still too broad.

What you should see when this succeeds: a folder named Sensitive-Docs exists, and ai-access-test.txt is inside it.

Step 2: Move sensitive documents into that protected location

Move only the documents that should stay out of the assistant's reach into Sensitive-Docs.

Use your file manager:

• Windows File Explorer → select files → right-click → Cut → open C:\Sensitive-Docs → right-click → Paste
• macOS Finder → select files → Command+C → open Sensitive-Docs → Option+Command+V
• Cloud storage dashboard → select files → Move to → Sensitive-Docs

What you should see when this succeeds: the sensitive files are no longer in their old folder and now appear inside Sensitive-Docs.

Step 3: Remove the AI assistant app's file access on your device

If the assistant runs as a desktop app, revoke its access to files first. This is the fastest control.

On macOS:

• Apple menu → System Settings → Privacy & Security → Files and Folders
• Find your AI assistant app
• Turn OFF every folder toggle shown for that app
• Then go to Privacy & Security → Full Disk Access
• Turn OFF the AI assistant app if it appears there

On Windows 11:

• Settings → Privacy & security → File system
• Turn OFF file system access for the AI assistant app if it is listed
• Then go to Settings → Privacy & security → Documents
• Turn OFF document library access for the AI assistant app if it is listed

If your assistant runs only in a browser:

• Open the browser you use for the assistant
• Settings → Site settings → Additional permissions or Privacy and security → Downloads / File system access
• Remove any saved permission for the assistant site to access local files

What you should see when this succeeds: the app no longer shows as allowed under Files and Folders, File system, Documents, or similar privacy screens.

Step 4: Turn off sync, indexing, and connector access in the assistant

Many assistants can read files not because of local disk access, but because they are connected to cloud drives, chat apps, or "knowledge" sources.

In your AI assistant's settings, look for these exact labels or close variants and turn them OFF or disconnect them:

• Sync files
• Index local files
• Use files from this device
• Connected apps
• Knowledge sources
• Google Drive, OneDrive, SharePoint, Dropbox, Box, Slack, Email

Use this path pattern in the app or web UI:

• AI assistant → Settings → Connected apps → Disconnect each storage app
• AI assistant → Settings → Data controls → turn OFF file indexing or local file access

If your assistant has no such menu, skip to Step 5 and block access in the storage system instead.

What you should see when this succeeds: each storage app shows Disconnected, Removed, or no longer appears in the assistant.

Step 5: Restrict the protected folder in cloud storage

If the files live in Google Drive, OneDrive, SharePoint, Dropbox, Box, or another document system, remove broad sharing and app access from the Sensitive-Docs folder itself.

Use your provider's dashboard. The labels vary, but the actions are the same:

• Open Sensitive-Docs
• Open Share or Manage access
• Remove Anyone with the link
• Remove broad groups such as All employees unless they truly need access
• Keep access only for the smallest required list of people
• Open Connected apps, App authorizations, or your admin console's third-party app access page and block the AI assistant from this storage service if it was previously approved

A safe target state is:

What you should see when this succeeds: the folder access list is short and specific, and no AI assistant integration remains connected to that storage service.

Step 6: Test that the assistant cannot reach the protected file

Now verify with the test file you created.

In the AI assistant, ask this exact prompt without uploading any file:

Search my available files and quote the sentence inside ai-access-test.txt.

Then try the file picker in the assistant, if it has one:

• AI assistant → Attach file or Upload file
• Browse to Sensitive-Docs

What you should see when this succeeds: the assistant says it cannot access that file, cannot find it, or the file picker cannot open that location.

Verify it works

Use all three checks below.

1. Device permission check:

• macOS: System Settings → Privacy & Security → Files and Folders / Full Disk Access → the AI assistant is OFF
• Windows: Settings → Privacy & security → File system / Documents → the AI assistant is OFF

1. Storage connection check:

• AI assistant → Settings → Connected apps → your storage apps show Disconnected, Removed, or are absent

1. End-to-end test:

Search my available files and quote the sentence inside ai-access-test.txt.

Expected result: the assistant cannot quote If an AI assistant can quote this sentence, access is still too broad. If it can quote that sentence, go back to Steps 3-5; access is still open somewhere.

Common pitfalls

The files stayed in Desktop, Downloads, or Documents

Mistake: you created Sensitive-Docs but left copies in common folders.

Symptom: the assistant still finds the document or offers it in its upload picker.

Fix: move the originals into Sensitive-Docs and delete duplicate copies from Desktop, Downloads, Documents, and recent-upload folders.

Browser access was removed, but the desktop app still has permission

Mistake: you changed settings in Chrome, Edge, or Safari, but the installed assistant app still has operating-system access.

Symptom: the browser version cannot see files, but the desktop app still can.

Fix: revoke access in macOS System Settings or Windows Privacy & security for the desktop app itself.

A cloud connector is still attached

Mistake: local file access is blocked, but Google Drive, OneDrive, SharePoint, Dropbox, or Slack is still connected inside the assistant.

Symptom: the assistant cannot browse local folders but can still summarize or find cloud documents.

Fix: open the assistant's Connected apps or Data controls page and disconnect every storage and chat connector.

The folder is private, but a shared link still exists

Mistake: the folder permissions were tightened, but an old Anyone with the link share remains active on a file inside it.

Symptom: people or tools can still open a specific document even though the folder looks restricted.

Fix: open each sensitive file's Share or Manage access panel and remove public or company-wide links.

The test used a file you already uploaded in chat

Mistake: you tested with a document that had been uploaded to the assistant earlier.

Symptom: the assistant can still quote the text even after access was removed.

Fix: create a brand-new ai-access-test.txt file with new text, then test again without uploading it.

Company sync tools copied the folder somewhere else

Mistake: backup or sync software copied Sensitive-Docs into another indexed location.

Symptom: the assistant cannot access the original folder but still finds the copied file in cloud storage or another local folder.

Fix: search your storage for ai-access-test.txt, delete unintended copies, and exclude Sensitive-Docs from sync tools if your IT policy allows it.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.