Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
What Can OpenAI Dots See in Your Accounts?
Whatever the pages a dot works on render: in a NetSuite vendor record the vendor name, bank account and bill history all reach the model, because the rules govern what a dot may do, not what it receives. Ask what the model receives from each screen your team works on, and who approves the payment it prepares.
A finance team that hands its vendor queue to a dot gets the afternoons back, and the same dot opens the vendor record in NetSuite, reads the remit-to bank account, the routing number, the tax identifier and the last six bills, and prepares the payment the team would otherwise key by hand. Dots run in their own cloud browser and work the applications a workspace connects, so the page a dot reads is the page the record holder sees, with every value the application draws on it (Do OpenAI Dots Rules Control What the Agent Sees?). What a review has to settle is narrower than whether the dot behaves, because the controls a buyer can see are about actions. Four rule behaviours decide whether a dot acts without asking, acts when pre-approved, asks first or hands the work back, and each one governs a step the dot takes. None of them describes the fields that pass from the page to the model. A team that cannot answer what the model received on a screen is trusting a rule to do the work of a control.
Key findings
- For a dot to be safe on those accounts, the values on a rendered page would have to be replaced with consistent tokens before the model reads the screen, with real values resolving only at an approved destination (What Is Render-Layer Tokenization?).
- It would also require a named person approving each payment, submission or record change, and a record of what the model received, which OpenAI's governance paper calls human approval that "is a standard way to limit egregious failures" (Shavit et al., 2023).
- The four rule behaviours govern what a dot does, and the dot help page describes no filter between a rendered record and the model (OpenAI, Getting started, 2026).
- OpenAI says dots "are rolling out today in ChatGPT to Pro users in markets excluding the European Economic Area, Switzerland, and the UK," with Enterprise, Edu and Healthcare workspaces in an admin-enabled beta (OpenAI, Getting started, 2026).
- The ChatGPT Work admin FAQ says its Compliance Logs Platform "retains data for 30 days" and that the records "don't establish a complete audit trail," which bounds what an employer can reconstruct about what a dot read (OpenAI, Work admin, 2026).
- The live page on claim files reads the safety write-up as describing what the model sees as webpage text and document content within connected apps, with only credentials kept out (Can Insurers Use OpenAI Dots on Claim Files?).
What does a dot read on a NetSuite vendor record?
Take one record type: a NetSuite vendor record that holds the remit-to bank account, the routing number, the tax identification number, the payment terms and the last six bills. A dot runs in its own cloud computer and browser and connects to more than 4,000 apps through plugins, so the record it opens is the record the finance team maintains (Do OpenAI Dots Rules Control What the Agent Sees?).
The record page renders every field the team keeps there, and a person opening it for a payment scans the few values that matter. A model reading the same page receives the rendered text, which includes the bank details block, the tax identifier and the bill history in the same pass. The help page for dots says a dot can take a project from "an idea to work you can use," and it describes no per-field rule for what the page hands the model (OpenAI, Getting started, 2026).
| Field the record renders | Why the team keeps it there | What the model receives |
|---|---|---|
| Remit-to bank account and routing number | The payment cannot be prepared without them | The number as the page draws it |
| Tax identification number | It is checked before a vendor is paid | The identifier in full |
| Bill history and open balance | A dispute turns on what was paid | The amounts and the dates |
The exposure does not end with the payment. A dot keeps the record in its context for the rest of the run, so a run that spans a vendor query, a payment and a follow-up email carries the bank account into every step. A person watching the run sees the payment it proposes rather than the fields it read on the way, and over-reliance on automation is a documented tendency rather than a safeguard (Goddard et al., 2012).
The team needs the record to pay the vendor, and the security team would not put the bank account in a prompt. What Is the PII Wall? names that gap: the workflow depends on the record the security team will not let a model see.
Do custom rules limit what the model receives from a page?
A custom rule is a sentence a workspace writes for its dot, and the help page sorts the choices into four behaviours: "Take action without asking," "Take action if pre-approved," "Ask before taking action" and "Hand off to you" (OpenAI, Getting started, 2026). Each one answers a question about an action, and none of them answers a question about the page.
The help page is explicit that the instructions are not a guarantee: "Your dot can make mistakes, including when following your rules" (OpenAI, Getting started, 2026). A rule that tells a dot to avoid a bank field is an instruction the model reads, and the model decides what to do with it while it is already holding the record. Research on how agents work from written instructions makes the same point: agents "need insight into where things live, what rules to follow, and how to implement changes," which describes the context they work from rather than a filter on it (Columbia DAPLab, 2026).
The rules also decide what survives a run. "Reset deletes your dot, including its conversations, saved memories, and scheduled tasks," so a workspace can clear the record after the fact, and clearing it does not change what the model received while the record was open (OpenAI, Getting started, 2026). What the page sends the model is not described in the pages reviewed, and that absence is the part a finance team has to plan around.
The 15 AI agents a review examined include OpenAI Dots, and not one of them describes a working page whose customer data reaches the agent as tokens rather than as the values the page draws (Do AI Agents Ask Before Making a Payment?).
For the vendor record, the consequence is concrete. A rule can stop the dot from paying a vendor it does not recognise, and it cannot stop the dot from reading the routing number on the way to that decision. A limit on the reading has to sit before the model reads the screen, where the record is drawn.
What do the vendors themselves say?
OpenAI's dot documentation covers the rules, the rollout, the training defaults and the audit record, and each of those pages covers what a dot may do or what happens to its content afterwards. The help page sets out the four behaviours and the warning that a dot can make mistakes while following them, and it describes no per-field control on what a page sends the model (OpenAI, Getting started, 2026).
The data controls page answers a different question. "Data controls let you choose whether your conversations help train OpenAI models," and "By default, OpenAI does not use content from ChatGPT Business, Enterprise, Edu, or ChatGPT for Healthcare workspaces to train its models" (OpenAI, Data controls, 2026). A training default governs what happens to content after a run, and it places no limit on what the model receives during one.
The audit record is bounded too. The ChatGPT Work admin FAQ says the Compliance Logs Platform "retains data for 30 days" and that its records "don't establish a complete audit trail" for every browser interaction, tool call or approval (OpenAI, Work admin, 2026). An employer can see, for a month, that a dot acted on a record, and cannot reconstruct which values the model held when it acted.
The safety write-up is the closest any of these pages comes to the question. The live page on claim files reads it as describing what the model sees as webpage text and document content within connected apps, with only credentials kept out (Can Insurers Use OpenAI Dots on Claim Files?). An account number and an open balance are neither credentials nor excluded by that description.
What do the live Dots industry pages record?
Four live pages on Dots reach the same reading. The pages on claim files, patient records, student records and Privacy Act records each find that the model can receive content from permitted applications, as the safety write-up describes, and each finds that the key holder is not disclosed and no certification is named on the page (Can OpenAI Dots Be Enabled on Patient Records?) (Can Schools Enable OpenAI Dots on Student Records?).
Cleveland Clinic's MyChart billing page shows the fields a billing screen carries: it explains that "the primary account holder (sometimes called the guarantor) is the person officially responsible for a patient's billing account," and it describes an account summary with balances, statements and payment options (Cleveland Clinic, 2026). A student account page is built the same way: "The Account Summary page provides a high-level view of your student account, including" the total owed, any holds and a payment portal (North Carolina Central University, 2026).
De-identification is the control a health system reaches for, and it is a separate exercise from what a live page shows. HHS describes "two methods that can be used to satisfy the Privacy Rule's de-identification standard," Expert Determination and Safe Harbor, and warns that "both methods, even when properly applied, yield de-identified data that retains some risk of identification" (HHS, 2012). A dot reading a live billing screen is reading the page the guarantor sees, not a de-identified extract.
The record type changes the fields, from a claim number to a student balance to a bank account on a vendor record, and the position of the reading does not (Can Agencies Use OpenAI Dots on Privacy Act Records?).
What does a governed environment change?
Inside a governed environment the record is drawn for the agent, and the values a policy names are replaced with consistent tokens before any model reads the screen. For each task the planner proposes what to tokenize, starting from personal information, account numbers, credentials and record numbers.A dot working the NetSuite record sees VENDOR_001 and ACCT_001 where the vendor name and the bank account sit, and it can still prepare the payment because the tokens hold for the whole run.
The real values resolve only at the approved destination, at the moment a named person approves the payment, and every screen the agent saw as tokens, every action and every approval lands in an exported record. A reviewer can read that record after the run and see which values the model was shown, field by field, which is what a rule cannot show. That changes what a review can ask: which values the model was allowed to receive, who approved the payment taken on them, and what the record shows. The bound comes from the policy rather than from the dot's judgment about which fields matter on any given page.
The design applies whatever agent runs in the environment. RedactSure vs OpenAI Dots sets out where the two controls sit for this product, a rules layer that governs what a dot may do and a render-layer control that governs what it reads, and a team usually needs both.
What the record shows
The model receives what the rendered record shows, the approval covers the payment rather than the reading, and the record of what was read is bounded to 30 days and an incomplete audit trail. For a NetSuite vendor record, the bank account and the tax identifier reach the model in the same pass that prepares the payment, and a rule that says otherwise is an instruction the model reads rather than a filter the page applies. Before a dot touches live payables, the finance team should test one workflow: name a vendor record that holds an account the team would not put in a prompt, ask a dot to prepare a payment from it, and compare the fields on the screen with what the run reports having received.
Methodology and limitations
Product statements come from the dot help page, the data controls page, the ChatGPT Work admin FAQ and the safety write-up as the live pages on Dots read it, together with the regulator guidance and the research listed below. Vendor pages were read as of October 22, 2026, and each Sources line carries the date for its page. Public documentation read in full gives a sound view of where each product applies its control.
The products on this page are described from documentation, and none was tested for this page; RedactSure is deploying now with enterprise and government customers. "Not described in the pages reviewed" means the pages listed below, vendor features change and the page carries its date, and the NetSuite vendor record describes a record type rather than an organization. Determinations belong to counsel, assessors and the organization's own security and compliance officers, and nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
What can OpenAI Dots see in your accounts?
Whatever the page a dot opens renders. A dot works in its own cloud browser and reads the applications a workspace connects, so the vendor name, the bank account, the balances and the bill history on a NetSuite record all reach the model in the same pass. The help page describes four rule behaviours, and they govern what a dot does rather than what it receives from a page. Treat every field the record shows as visible until a control outside the page proves otherwise.
Do custom rules stop a dot from reading a bank account?
No. The rules decide whether a dot takes an action without asking, takes it when pre-approved, asks first or hands the work back, and each choice is about a step the dot takes. A rule that says not to share a bank detail is an instruction in the prompt, and the help page notes a dot "can make mistakes, including when following your rules." The reading happens before any rule is applied to an action.
What record does OpenAI keep of what a dot read?
A bounded one. The ChatGPT Work admin FAQ says the Compliance Logs Platform "retains data for 30 days" and that its records "don't establish a complete audit trail." That is a log of events the platform records, not a transcript of the values a model received on a screen, and it ages out within a month. An employer who has to show an auditor what a dot read needs that record from the environment the dot runs in.
Who approves an action a dot takes in a vendor record?
The person the workspace names under its rules, if anyone is named. The four behaviours include one that lets a dot act without asking, so an approval is a setting the workspace chooses rather than a step the product requires. OpenAI's governance paper calls human approval "a standard way to limit egregious failures" and asks that "at least one human entity is accountable for every uncompensated direct harm." A finance team can write both into the review.
Do the live industry pages reach a different conclusion?
No. The pages on claims, patient records, student records and Privacy Act records read the same safety write-up and find that the model can receive content from permitted applications, with only credentials kept out. A patient billing screen and a student account summary carry an account number, a balance and a name in the same way a vendor record carries a bank account. The record type changes, and the position of the reading does not.
What would keep bank details out of the model?
Replacing them on the rendered page. The record would draw ACCT_001 where the bank account sits and VENDOR_001 where the vendor name sits, the dot would prepare the payment on those tokens for the whole run, and the real values would resolve only at the approved destination when a named person approved the payment. That is a control on what the model sees, separate from the rules, the plugins and the audit log.
How RedactSure Keeps a Vendor Record Out of the Model
The bank account a dot reads on a vendor record stays in its context through every later step, where no rule reaches. OpenAI's governance paper calls human approval "a standard way to limit egregious failures."
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the record renders the vendor name, the bank account and the last six bills, and all of it enters the model's context. Inside, the record renders VENDOR_001 and ACCT_001, the dot prepares the payment on those tokens, and the real account resolves only at the approved destination on a named person's approval.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
Whether an agent can work a vendor record without its bank details reaching the model is what a pilot settles. Bring one vendor bill and see, with test values, what the model reads, who approves the payment, what the record holds. Book a demo