Audience: Students, faculty, and staff
Why it matters
When you use a public AI tool or any cloud tool, your prompts and files are sent to the company that runs it. Depending on the tool and its terms, that data may be stored, reviewed by people, or used to train future models or even made public. Once it's there, you can't pull it back. At U of I, anything you upload to or download from AI, including prompts, is covered by the same data policy as any other University data (APM 30.11).
Use University-hosted AI when you can
- chat.uidaho.edu (Vandalchat) and Mindrouter are hosted by U of I Research Computing and Data Services (RCDS). Your conversations stay on University-controlled systems, which limits exposure of your data to third parties.
- If you need a different tool, use a University-supported one signed in with your U of I account rather than a personal account. See Guidance for Artificial Intelligence (AI) for the current list.
- Never use banned AI services, such as DeepSeek, for anything.
Know your data before you share it
The University classifies data as Low, Moderate, or High risk. As a rule of thumb:
- Low risk: public information, such as published web content, public course descriptions, or general questions. This is fine for most AI tools.
- Moderate risk: non-public University information, such as internal documents and unpublished work. Use only University-approved AI tools that are approved for moderate risk data.
- High risk: Social Security numbers, passport numbers, financial account numbers, health information, and controlled research data. Do not put high risk data into AI tools, with the exception of a locally hosted system with an approved System Security Plan.
Not sure which category your data falls into? See How to identify "High Risk" data.
Best practices
- Share only what the task needs. Remove names, ID numbers, and other identifying details before you paste anything in.
- Never enter passwords, credentials, or verification codes into any AI tool.
- Check the output. Treat AI responses as a non-expert opinion. Review them for accuracy before you use them, and test any code before running it.
- Label AI-assisted work when you can.
- Be careful with AI agents. Don't give AI tools your University login or let them act on University systems for you.
- Keep your files in approved storage. Save AI-generated work in approved locations like your University OneDrive, not in the AI tool's history or personal cloud accounts.
For students
Your @vandals.uidaho.edu account is not covered by the University's agreements with outside AI vendors, so treat those tools as public. Use chat.uidaho.edu when you can, keep personal information (SSN, financial aid documents, ID scans, health info) out of any AI tool, and follow your instructor's rules on AI use for coursework. Store all coursework in your @vandals.uidaho.edu OneDrive.
For employees
- AI tools: Use only AI services approved for your data's risk level, signed in with your @uidaho.edu account. Vandalchat and Mindrouter are recommended, and are approved for moderate risk data only from an OIT-managed device. Microsoft Copilot is approved for moderate risk data only when the green Enterprise data protection shield is showing. Unsupported (but not banned) AI tools may be used only for low risk data. Full details: Guidance for Artificial Intelligence (AI).
- Storage: Store University data only in approved locations: S: drive, encrypted OIT-managed drives, OneDrive, SharePoint/Teams, or RCDS storage. Google Drive (except in approved cases), Dropbox, Box, iCloud, Nextcloud, and personal OneDrive are not approved. Full details: Approved Storage Locations.
- Decisions about people: Don't use AI to make decisions that affect someone's admission, financial aid, grades, hiring, discipline, or similar outcomes without review and authorization.
Questions
For questions about AI tools, data classification, or storage, submit a request to the OIT Security Office or visit ai.uidaho.edu or the AI Intranet Site.