Are your company files leaving Monaco without you knowing?

It is 6 p.m. A salesperson is finishing a proposal. She opens an assistant in the browser, pastes the client’s contract and the margin sheet, and asks for a summary. The answer comes straight away. The text has already left.

Management never sees it. The account is often personal, opened with a private email address. Nobody has a list of what was pasted: contracts, client details, margins, methods. The memory of the work walks out, one paste at a time.

Where the text goes depends on the tool and the account

ChatGPT is OpenAI’s service. Outside the European Economic Area, the United Kingdom and Switzerland, its policy of 10 September 2026 names OpenAI OpCo, LLC, in San Francisco, as the controller: the company that decides how the data is used. That data is processed on servers that include the United States. On a personal account (Free, Plus or Pro), the help centre says content sharing is on by default, so the models can learn from the text they receive. It can be switched off under Settings, Data controls, “Improve the model for everyone”. While it stays on, the pasted contract can be used for that learning.

Claude is Anthropic’s service. The company is established in San Francisco. Its policy says personal data goes to its servers in the United States, or to other countries. On a personal account, prompts and replies may be used to improve the models, unless the person opts out in the settings. Even after that opt-out, a safety review can still use them, and so can the whole exchange if someone leaves feedback, a thumbs-up for example: the privacy centre says that feedback keeps the conversation for up to five years. On Claude for Work, those texts are not used for training by default, unless you send explicit feedback or choose to take part, and a page dated 15 June 2026 says they are stored in the United States.

Gemini is Google’s service. If Keep Activity is on, Google uses the chats to develop its services, including to train its models, and human reviewers read a subset. Google then warns against putting confidential information there. Reviewed chats are kept for up to three years. With the setting off, future chats are not used for training, unless you send Google feedback, but they stay linked to the account for 72 hours. In Google Workspace, the offer for organisations, training on customer data requires permission, and an administrator places the processing in the United States, in Europe, or in both.

DeepSeek, published by Hangzhou DeepSeek Artificial Intelligence Co., Ltd., a company established in China, says in its policy of 10 February 2026 that it collects, processes and stores personal data in the People’s Republic of China.

Monaco’s law does not cover the whole margin sheet

Law No. 1.565 of 3 December 2024, published in the Journal de Monaco on 13 December, covers personal data handled by a controller established in Monaco, whether or not the servers are in the Principality. Only private life is set aside. Preparing a proposal with a client’s contract remains company business. Article 2 covers information about an identified or identifiable person: a name, an email, a number. The client’s name in the pasted contract is personal data. A margin grid with no identifiable person is not. It still leaves the company.

The authority describes a transfer as any flow out of the Principality, including remote access. Article 97 allows it with no prior formality when the country has an adequate level of protection, as recognised by the Principality. The list is Ministerial Order No. 2026-548 of 30 September 2026, in the Journal de Monaco of 16 October 2026. Neither the United States nor China is on it. France, Switzerland and the countries of the European Union are on it, or are deemed adequate. Failing that, article 98 asks for a safeguard, for example standard clauses approved by the authority, and article 99 opens a few exceptions, including the explicit consent of the person once told the risks. A staff member’s personal account is not that framework. Before the client file leaves: who decides, under which contract, and towards which country.

Three questions for this week

1. 01Which assistants are open, and on which account: a personal address, or a company account whose settings you can see?
2. 02Which papers must never be pasted: contracts, client files, margins, methods?
3. 03Where can the text stay on a machine you hold?

Three ways to take the file back

First, a short written rule the team actually knows: what may be pasted, and what may not. A draft with no name does not weigh the same as a signed contract. Test it by asking, this week, which accounts are really open.

Next, a company account, configured. On ChatGPT Business and Enterprise, the administrator can view, export or delete the conversations, and training is off by default. Claude for Work and Gemini in Workspace also give the company someone in charge. The file still leaves the Principality. Management gains a contract and settings it can read, provided the personal account on the side goes away. If the text is processed in the United States, that country is not on the adequate list: the contract with the publisher does not replace the path the law provides.

Last, a tool on your servers. The file is not sent to those publishers. Access, logs and backups are yours. Keep that level for contracts, client files, margins and methods.

The team already uses the tool. The useful decision is to name what is allowed to leave. If you want to make that inventory, let’s talk.