Do you know what company information your people are pasting into a chat?
No one needs to download an entire database.
It is enough to copy the fragment needed to solve something.
A query.
Part of a contract.
Code containing business rules.
An error accompanied by real data.
It gets pasted because the tool helps. Because it responds quickly. Because no one explained where the boundary was.
From that point on, the company may no longer know where that information ended up, how it will be used, or who may see it later.
This is not solved simply by blocking tools.
First, understand what people are doing and why.
Then define three concrete things:
Which information must never leave.
Which tools are authorized.
And which uses require review.
Security begins before the technical control.
It begins by making the real work visible.