Every prompt is a disclosure to a third party. That is true even where a provider promises not to train on it, because a promise about training says nothing about logs, or about what a subpoena reaches.
The operating rules are short. No credentials in a prompt, ever. No client personal data unless the engagement specifically requires it and the client has agreed the processor. No unreleased assets in a system without a contractual position on retention.
The commercial version of the argument is the one that sells internally: an unreleased campaign pasted into a general-purpose tool is a leak risk with a date on it.
Is it safe to paste client material into a model if the provider says it does not train on inputs?
A commitment about training says nothing about logging, about retention, or about what happens when there is an incident. Treat every prompt as a disclosure to a third party and decide accordingly.
What should never go in a prompt?
Credentials and keys, personal data the engagement has not accounted for, and unreleased assets where there is no contractual position on retention.