Uploading PDF, Word and Excel files to ChatGPT and other AI tools: what to check first

What happens when you upload a file

• The AI gets the whole file, not just the page you care about. According to OpenAI, ChatGPT can extract metadata such as the author or creation date, or count the rows in a spreadsheet.
• The content is stored. In ChatGPT, chats stay saved until you delete them, and content from an uploaded file can remain in the conversation. After deletion, OpenAI schedules permanent removal within 30 days, unless it must keep data longer for security or legal reasons. Files saved to the ChatGPT Library are not deleted when you delete the chat.
• People may read along. With a personal Gemini account, Google says a subset of chats is reviewed by human reviewers while the Keep Activity setting is on. Reviewed chats are kept for up to three years. Google itself advises against entering confidential information you would not want a reviewer to see.
• Your account type matters. OpenAI says it does not use content from business offerings such as the API or ChatGPT Enterprise to improve its models. For services for individuals, it depends on your data settings.

If the document contains personal data, data protection law applies too; see May employees enter customer data into ChatGPT?. This guide is not legal advice.

Where data hides in your files

Much of it is invisible when you read the document. The AI reads it anyway.

Text in images is not hidden either: according to Google, Gemini reads the text in images you upload.

Checklist before you upload

1. Only the part you need. If you want a summary of chapter 3, copy just chapter 3 into a new file or straight into the chat.
2. Never upload complete lists of people. To build a formula or an analysis, the AI needs three sample rows, not your whole customer list. Replace names and numbers with placeholders, as described in Anonymising data before using AI.
3. Use the Document Inspector. In Word and Excel, go to *File > Info > Check for Issues > Inspect Document*. Microsoft recommends inspecting a copy, because removed content cannot always be restored with Undo. Then inspect again.
4. Redact, don't cover. A black box often only hides the text. A US federal court warns that anyone can copy the box, paste it into a word processor and see the text underneath. Use a proper redaction tool. Adobe notes that redaction removes only visible text and graphics; metadata has to be sanitised separately.
5. Test the result. Select the redacted area in the PDF and paste it into a text editor. If text appears, the redaction has failed.
6. Crop screenshots. Sidebars, tabs and notifications often give away more than you think.

Hidden instructions in other people's documents

Third-party documents carry a different risk. OWASP describes "indirect prompt injection": a file contains instructions that the AI treats as commands. These instructions do not need to be visible to humans. One OWASP example is a CV with malicious instructions split across it.

So read answers about third-party documents critically, especially if they are oddly positive or ask you to take an action. Do not upload unknown files into a chat that has access to your email or file storage.

How AImori helps with uploads

The free extension for Chrome and Edge also checks files you upload, drop or paste on ChatGPT, Claude, Gemini, Microsoft Copilot, Microsoft 365 Copilot and Perplexity:

• TXT, CSV, MD, PDF, DOCX and XLSX are read locally in the browser, without network access. If nothing is found, the file goes to the site unchanged.
• If something is found, the bar stops the upload and shows the data type, count and line numbers – never the value itself. You choose "Upload cleaned version", "Cancel" or, if allowed, "Upload file anyway" with two clicks.
• Cleaned means matches are replaced with placeholders naming the data type; for DOCX, author details such as creator and company are cleared too. A PDF becomes a plain-text version without layout or images. The cleaned file is checked again; the original is never uploaded.
• Screenshots are read with local text recognition, and AImori can send a redacted copy. It also warns about signs of hidden instructions in text documents.

We are open about the limits: for XLSX and for DOCX with macros, the only option is "Cancel". Scans without text and encrypted files are reported as "Text could not be checked". The rules do not detect names, secrets in free text or images inside documents.

Frequently asked questions