An employee connected ChatGPT to Salesforce with their own login. What does ChatGPT see now?
Connecting an AI assistant to Salesforce now takes a few minutes and does not need an administrator. A user login and a consent screen are enough. That is convenient. And that is exactly why it needs putting in order.
What happens when you connect
The AI assistant (Claude, ChatGPT, Cursor, an in-house tool) connects to Salesforce through an MCP server or a Connected App. The user logs in with their own account and approves the access scope. From that moment the assistant can do in Salesforce whatever that user can: read the records they see and, depending on the scope, create and change them.
A sales rep sees their own opportunities, their own contacts and whatever their role shares with them. An assistant connected with their login sees exactly the same. If the rep has the head of sales role, the assistant sees all of sales. If an administrator connected it, the assistant sees everything.
Three questions worth asking
1. Where does the data go?
The assistant sends the content of records to the model vendor so that it can answer. On business plans and through the API, vendors state that they do not use that data for training. On free personal accounts it can be different. The employee who connected a personal ChatGPT account may have just sent customer data somewhere whose terms allow more than you would like.
2. What can the assistant write?
A “read” scope is safe. A “full access” scope means that a misunderstood instruction (“clear out the old leads”) ends with deleted records. Assistants are good at carrying out instructions and poor at asking “are you sure?”.
3. Who knows about it?
Usually nobody. Connecting does not require an administrator’s approval unless someone has switched that on. The Salesforce settings show the list of connected apps and tokens. In audits I regularly find several the administrator has never heard of.
How to do it properly
- A separate user for AI. Not an employee’s login. An account such as “sales-assistant” with its own permission set, built for the task.
- Read-only until there is a reason otherwise. Most uses (summarise, find, prepare me for the call) do not need write access.
- Sensitive fields switched off for that user: national ID numbers, bank account numbers, health data. The assistant will not see them, so it cannot repeat them.
- Administrator approval for new connected apps. One setting. An employee can still connect an assistant, but someone knows about it.
- A token review once a quarter. The list of apps with access, last used date, who connected it. Switch off what is unused.
- A business account with the AI vendor, not a personal one. With settings that switch off training on your data and switch on logging.
Does that mean do not connect?
Quite the opposite. An assistant that answers “what do we know about this company before the meeting” in 10 seconds instead of 10 minutes of clicking is worth having. The point is simply to connect it on an account that sees as much as it should. That is an hour of an administrator’s work. I did it for myself on my own MCP server and use it every day.
The list of connected apps and tokens is point nine of the free audit. I check it on a screen-sharing call, without access to your system.