Before you paste your security plan into a chatbot

By Sam Devine · October 27, 2026

AI chat tools are good at turning rough notes into clean paragraphs, and the Final Plan of Record has plenty of paragraphs to write. But some of what goes into it, especially your security plan, is information you do not want ending up anywhere you have not chosen.

Why your security plan is different

Your security plan describes your cameras, alarms, access control, who holds keys, and how cash and product are protected. Minnesota requires it to meet Minn. R. 9810.1500 and to be kept for three calendar years (Minn. R. 9810.1100, subp. 3(B)(1)). The state treats this kind of material carefully too. The Office of Cannabis Management's summary of the 2026 law says:

Personal accounts and business accounts are not the same

Many AI chat tools treat personal accounts and business accounts differently. OpenAI, for example, lets personal ChatGPT users opt out of having their conversations used to train its models, and says it does not use content from its business offerings, such as ChatGPT Team, ChatGPT Enterprise and its API, for training. Other tools have their own settings and terms. Read them before you paste anything sensitive.

Five questions to ask any AI tool

1. Is what I send used to train the company's models, and can I turn that off?
2. Who at the company can see what I send?
3. How long is it kept, and can I delete it?
4. Is my material ever mixed with another customer's?
5. Can I keep certain documents away from people who do not need them?

Never paste the secrets themselves

Alarm codes, safe combinations, passwords and door codes should never go into an AI tool. Describe how a control works without writing down the secret that opens it.

How Tofte handles it

Tofte drafts with Anthropic and searches with OpenAI, both through their business APIs, and under those agreements neither may use your data to train its models. Drafts are built only from your own workspace's documents. When you or your team drafts, restricted documents are sent to the model along with everything else, so if you do not want a document sent to an AI model at all, do not upload it. Drafting is optional: you can write every answer yourself. The details are on our Security page.

This guide is a plain-English summary of Minnesota rules as of October 27, 2026. It is not legal advice. Rules change, so check the current text at the links below.

Sources

• OpenAI Help Center, keeping history on but disabling model training
• Office of Cannabis Management, 2026 Legislative Changes to Chapter 342
• Minn. R. 9810.1100, General Operations
• Minn. R. 9810.1500, Security