What Your Employer Can See When You Use AI at Work

Someone on your team pastes a client contract into a chatbot to get a summary. Someone else asks an AI assistant to rewrite a resignation letter. A third person uses a browser extension to clean up a Slack DM about a colleague.

The question all three are quietly asking is the same one: can my employer see this?

The honest answer is that it depends on four separate things, and most people only think about one of them. They worry about the laptop, when the real visibility is usually in the work account: a Google Workspace or Microsoft 365 admin can search and export your mail and chats without installing anything on your Mac.

The four layers, and which one is actually watching

Your text can be visible at four different points. They are independent. A company can have all four, or none.

1. The device. Whether your Mac is enrolled in device management, and whether an endpoint agent is installed on it.

2. The account. Whether you are signed into a work Google, Microsoft, or Slack account, and what that admin console retains.

3. The network and browser. Whether the browser you are typing in is managed, and whether traffic passes through a corporate proxy.

4. The AI tool itself. Which company receives the text, and what their contract with your employer allows.

Most people worry about layer 1 and ignore layers 2 and 3, which is backwards. Layer 2 is where almost all real workplace visibility comes from.

Layer 1: what device management actually grants

Mobile Device Management on a Mac is a specific, bounded thing. An MDM server can:

• Install and remove configuration profiles, apps, and certificates.
• Enforce settings: FileVault, firewall, passcode rules, software update deferrals.
• Read an inventory: serial number, OS version, installed applications, storage, battery.
• Lock, erase, or, on a supervised device, restrict far more.

What MDM on its own does not do is read your keystrokes, your screen, your clipboard, or the contents of your documents. There is no MDM command for "show me what this person typed". That is a real boundary, and it is worth knowing.

The catch is that MDM is a delivery mechanism. It can install something that does read those things. Endpoint detection software, data loss prevention agents, and session recording tools all exist and all arrive this way. If one is installed, the visibility question is about that agent, not about MDM.

There is one detail specific to macOS that matters here and is rarely explained. Normally an app has to ask you for Accessibility permission, and you see the prompt. On a supervised Mac, an administrator can push a Privacy Preferences Policy Control profile that turns Accessibility on for a named app with no prompt. Since macOS 27, the Mac shows a notification for each app a profile configures this way, and you can switch the permission off. A profile cannot do the same for Screen Recording or Input Monitoring: for those it can only block access, or let a standard user approve it themselves. So on a managed Mac, "I never granted Accessibility" is not proof that it was not granted.

How to check your own Mac, in order:

1. Open System Settings, then General, then Device Management. If it lists nothing, no management profile is installed. An agent can still be installed without one, so continue with steps 3 and 4.
2. If profiles are listed, open each one. The payload names tell you what it does. A Privacy Preferences Policy Control payload naming an app is the one that can turn on that app's Accessibility permission without asking you.
3. Open System Settings, then Privacy & Security, and check Accessibility, Input Monitoring, Screen & System Audio Recording, and Full Disk Access. Every app that has asked is listed, including ones you turned down, so look for apps switched on that you never approved.
4. In Activity Monitor, sort by name and look for agents you do not recognise. Most endpoint tools do not hide.

Running profiles status -type enrollment in Terminal tells you whether the Mac is enrolled, and whether that happened through Apple's automated enrolment (Enrolled via DEP) or was user approved. Whether the Mac is supervised, which gives the administrator the wider set of controls, shows at the top of System Settings, then General, then Device Management.

Layer 2: the account, which is where the real visibility lives

This is the layer that catches people out, because it needs no software on your machine at all.

If you are signed into a work account, the administrator of that account has access to what the platform retains. Concretely:

• Google Workspace. An admin can reset your password and sign in as you. With Vault, they can search and export Gmail, Drive, and Chat content according to the retention rules they set. Audit logs record logins, file access, and sharing changes.
• Microsoft 365. eDiscovery covers Exchange, OneDrive, SharePoint, and Teams, including one to one Teams chats, which are stored in a hidden folder in each participant's mailbox. Audit logs cover the same ground.
• Slack. Public channel content is exportable on every plan, including Free. On Free and Pro, owners can apply to Slack to export private channels and direct messages, with legal process, member consent, or a legal requirement. Business+ and Enterprise plans have a self-serve export, and Enterprise also has the Discovery API, which is what DLP vendors plug into.

Two things follow from this that are worth internalising.

A direct message is not a private message. It is a message with a smaller audience and the same retention. Every DM platform used at work is discoverable by the organisation that owns the workspace.

Deleting does not mean deleted. Retention policies are set by the administrator and usually outrank the delete button. If the policy says three years, your deleted message is still in the export for three years.

None of this requires anything to be installed on your Mac, and none of it is unusual or sinister. The business tiers of these suites include these tools, an administrator sets the retention, and they exist because companies have legal obligations to produce records.

Layer 3: the managed browser, and the paste event

This is the newest layer and the least understood.

A browser can be managed by policy, entirely separately from the device. On a managed Chrome or Edge profile, the organisation can set extensions, block sites, and turn on reporting. Chrome Enterprise Premium goes further: it can inspect content at the moment of a paste, an upload, a download, or a print, and block or log it based on rules. That means a policy can specifically watch for "text matching a credit card pattern pasted into a domain not on the allowlist", and the AI chatbot in your other tab is exactly the kind of domain those rules name.

How to check: type chrome://management in Chrome or edge://management in Edge. It tells you whether the profile or the browser is managed, by whom, and often which reporting is on. In Safari, managed settings arrive as a configuration profile, so layer 1's check covers it.

The practical takeaway: if the browser profile is managed, assume that what you paste into a web AI tool can be seen, whatever the device or the tool promises.

Layer 4: the AI tool, and which account you are using

The final layer is the tool itself. The decisive question is almost never "is this product safe" and almost always "which account am I signed into".

The same product often has opposite defaults on different tiers. Consumer plans commonly allow content to be used for improving models unless you opt out. Business, enterprise, and API tiers commonly forbid it by contract. If your employer has signed a data processing agreement, it covers the account that agreement applies to. It does not cover the personal account you happen to be using on the work laptop, and it does not cover the extension you installed yourself.

That cuts both ways, and this is the part people get backwards:

• Using a work AI account means your employer's contract protects the data, and your employer's administrators can generally see the usage.
• Using a personal AI account on a work machine means your employer's contract does not protect the data at all, the vendor's consumer defaults apply, and if layer 1 or layer 3 is active your employer can often see it anyway.

The personal account feels more private and is usually less private.

For how to evaluate a specific tool's data handling, what your AI writing tool actually sends to the cloud covers the sub-processor list, the retention question, and how to separate a training promise from a storage promise.

What to actually do

Not "avoid AI at work". That advice is ignored, and ignoring it is how shadow usage starts. Five rules that survive contact with a real job:

Use the work account for work. It is the only configuration where a contract covers the data and where you are not personally responsible for the terms.

Assume every work DM is discoverable. Not because someone is reading it today, but because the export exists. Write the message you would be comfortable seeing quoted.

Keep genuinely personal matters off work systems. A resignation letter, a medical question, a dispute with a colleague. Use a personal device on a personal network. This is not paranoia; it is the only clean separation available.

Do not paste other people's data to solve your own problem. A client's contract, a colleague's performance notes, a customer's contact details. The exposure is not yours to accept.

Ask the one question that gets a straight answer. Not "are you monitoring me". Ask your IT team: "which approved AI tools can I use, and is there a DLP policy on paste?" Both answers are usually documented, and both are useful.

Where a local tool changes the shape of this

Not every AI writing tool sends your text to a chatbot in a browser tab. Where the work happens changes which layers apply.

BlinkWrite runs on your Mac and helps you write inside the app you are already in, so you do not paste anything into a chatbot tab. Two parts of layer 3 still apply: in a browser, a suggestion you accept is usually inserted as a paste, which a managed browser's paste rules can see, and BlinkWrite's requests can pass through a corporate proxy like any other traffic. The specifics of what leaves the machine:

• Personal and sensitive information is detected and masked on your Mac before anything is sent. Detected addresses, phone numbers, card numbers, and credentials are replaced with labelled placeholders locally, and the real values are restored on your machine afterwards. Masking is best-effort and does not remove other people's names.
• What is sent is the masked draft, the masked surrounding context, the type of help requested, the detected language, the app's name, any Custom instruction you typed (masked), and your display name. For a suggested reply, it also includes the message you are replying to. It passes through BlinkWrite to an external LLM provider to generate a suggestion.
• BlinkWrite's servers do not save your writing, and it is not used for training. Production API response storage is disabled, but provider abuse-monitoring retention applies. Your Mac keeps an encrypted cache of recent suggestions: 30 days for replies and 60 days for completions.

Privacy & security lists exactly what is sent and what stays local. If you are weighing up the macOS permission that lets any assistant read the field you are typing in, macOS Accessibility permission explained covers what it does and does not grant, and how to audit what you have already given away.

What none of this changes is layer 2. If you write a message in Slack, that message is in Slack, however it got written. No writing tool can or should alter that.

Common questions

Can my employer see what I type if my Mac is not managed?

Not through a management profile. If System Settings, then General, then Device Management is empty, and no unfamiliar app has Accessibility, Input Monitoring, Screen Recording, or Full Disk Access, nothing on the machine is likely to be reporting. Your work accounts are a separate question and are almost certainly retained.

Can my employer read my Slack DMs?

On every plan, in some form. Business+ and Enterprise plans have a self-serve export; on Free and Pro, owners have to apply to Slack with legal process, member consent, or a legal requirement. Whether anyone has used it is a different question from whether they can. Treat work DMs as discoverable records.

Does deleting a message remove it?

It removes it from the view. The organisation's retention policy decides how long the underlying record is kept, and that policy is set by an administrator, not by you.

Is using ChatGPT at work against the rules?

That depends entirely on your employer's policy, and most companies now have one. The question worth asking is which tools are approved rather than whether AI is allowed, because approved tools are covered by an agreement and personal accounts are not.

Can an employer see what I type on my personal Mac?

Only if you installed something that lets them, which normally means enrolling the device or installing a work agent. Check Device Management and the Accessibility, Input Monitoring, Screen & System Audio Recording, and Full Disk Access lists. If those are clean, the device is very likely yours. Anything you do in a work account on it is still visible to that account's administrators.