Field note
ChatGPT Connectors and Oversharing: Audit Guide
Connector security starts in the source system. ChatGPT cannot make a broadly shared folder private after it is connected.
Connector security starts in the source system. ChatGPT cannot make a broadly shared folder private after it is connected.
Why the source system decides
A ChatGPT connector to SharePoint, OneDrive, Google Drive or a similar store works on behalf of the person who connected it. If that person can open a file, ChatGPT can read it for them. If they cannot, it cannot. That is the right design, and it is also why most connector incidents are not ChatGPT faults at all. They are old sharing decisions surfacing through a new interface.
Before AI, an over-shared folder was protected by nobody looking. A salary spreadsheet with a link set to "anyone in the organisation" sat unread because finding it meant knowing it existed. A connector removes that protection. The user asks a natural question, and the file is retrieved because it is relevant and they are allowed to see it.
Synced connectors make this sharper. Where a connector indexes content in advance rather than searching on demand, the index reflects permissions at sync time and refreshes on the vendor's schedule. Check the current behaviour for each connector on OpenAI's pages before relying on a permission change taking effect immediately.
A realistic example
A 15-person consultancy on Microsoft 365 connects SharePoint to ChatGPT for its Team workspace. In 2023 the previous office manager saved "Team salaries and reviews.xlsx" to the Finance site and shared it with a company-wide link so the directors could all open it. Nobody removed the link when she left. A new starter, asked to prepare a budget, types "what does each consultant cost per month" and gets the answer with names. No policy was broken by ChatGPT. The sharing link did the damage two years earlier.
The same pattern appears in Google Workspace with "anyone in the organisation with the link" and in Teams sites created from a template with an open members list.
Audit in five steps
- List what is connected and by whom. In a Team or Enterprise workspace the admin can see which connectors are enabled. Ask each connecting user which account they used. A personal Google account connected to a work ChatGPT account is a finding in itself.
- Find the over-sharing at source. In Microsoft 365 use the SharePoint admin centre's sharing reports and data access governance reports to list sites with company-wide sharing links and "Everyone except external users" permissions. In Google Workspace review Drive sharing settings for the organisation and use the Drive audit log to find files shared with the whole domain. Our SharePoint and OneDrive external sharing cleanup covers the Microsoft side in detail.
- Fix it where it lives. Remove organisation-wide links on HR, finance, legal and customer folders. Restrict site membership. Apply sensitivity labels where you have them, and use restricted access controls on the sites that hold the most sensitive data. Do not try to fix this with a ChatGPT setting; there is no such setting.
- Decide the connector scope. Where the connector lets you choose sites, drives or folders, connect the approved ones only. If it can only connect a whole account, decide whether that account should have access to the sensitive sites at all.
- Retest as a low-privilege user. Sign in as a test user with ordinary staff permissions, connect the same source, and ask the awkward questions: salaries, redundancies, client complaints, the directors' folder. Keep the answers as evidence with the date.
Repeat step 2 quarterly. Sharing drifts.
Memory, chat history and sharing
Retrieved content does not stay in the source. Once a file's contents are in a conversation they can be remembered by the model's memory feature where it is enabled, shared by link, exported, or pasted elsewhere. Decide whether memory is on for the workspace, whether chat sharing outside the workspace is allowed, and how long conversations are retained. The ICO's data security guidance expects you to know where personal data goes, and "into the chat" is a location.
The equivalent problem in Microsoft's own assistant is well documented, and the fixes are the same because the source is the same. See Copilot semantic index and oversharing.
Connectors that can write
Some connectors and apps can create or change files, send messages or update records, not only read them. Treat those as a separate review with their own approval, because a read-only over-share leaks data and a write over-share changes it. The rule of thumb: no write-capable connector reaches a system whose read permissions have not yet been audited.
What to write into policy
"Connectors may be added to ChatGPT only for sources whose sharing has been reviewed within the last three months. HR, finance and legal libraries are excluded until their sharing links have been removed and a test user has confirmed they cannot be retrieved. Connecting personal cloud accounts to company ChatGPT workspaces is not permitted." Name the person who runs the quarterly sharing report.