← Back to Blog Research

Does ChatGPT Read My Files? AI Uploads and Post Quantum Cryptography Risk

8 min read

The Question

When you drag a PDF into ChatGPT, Claude, Gemini, or another AI service, where does it go? And under Harvest Now Decrypt Later, what are the quantum implications?

What Happens to Uploaded Data

  1. In transit: encrypted with TLS 1.3. Modern endpoints (OpenAI, Anthropic, Google) support hybrid ML-KEM to varying degrees.
  2. At rest: stored in the provider's infrastructure. Encryption keys managed by the provider.
  3. For training: depends on the terms and the product tier. Enterprise/API tiers typically do not train on your data. Free consumer tiers historically have.
  4. Retention: varies. OpenAI typically retains for 30 days unless enterprise agreement; other providers similar.

The HNDL Angle

If the provider's infrastructure is compromised (cloud breach, insider, supply chain, or nation-state SIGINT), your uploads sit in an archive. The provider's at-rest encryption protects against casual access. Classical key wrapping on those at-rest keys means a future quantum computer can unwrap them.

Net: data you upload to an AI service today might be decrypted by an adversary with 2035-era quantum computing and 2024-era archive access.

What to Do

  1. Do not upload sensitive data to consumer-tier AI services. Enterprise agreements with explicit PQC commitments are safer.
  2. Redact before uploading. Remove identifying data, personal names, account numbers, and proprietary algorithms before sending to a cloud AI.
  3. Prefer self-hosted or edge AI models for sensitive workloads. Meta Llama, Mistral, and others can run on-premise.
  4. Ask your AI vendor about PQC. When will they deploy hybrid ML-KEM internally? For at-rest? For backups?

PQC at the Major AI Providers

Most AI providers host on major cloud providers (AWS, Azure, GCP), so their PQC story is inherited from those. Expect progressive improvement through 2026-2028.

Frequently Asked Questions

Is ChatGPT quantum-safe?

ChatGPT TLS (if using modern browsers or API clients with hybrid ML-KEM) is protected in transit. At-rest encryption depends on OpenAI's infrastructure and is not publicly detailed. Assume classical at-rest until proven otherwise.

Should I upload medical records to AI?

Not to consumer AI. HIPAA-compliant enterprise AI services with BAAs and PQC commitments are required for regulated data.

Does Claude or Gemini handle this differently?

All major AI providers have similar at-rest and in-transit characteristics. Anthropic and Google have published some detail on infrastructure security. Specific PQC commitments vary by product tier.

Is training a separate risk?

Yes. If your data is used for training, it may be embedded in model weights. Many enterprise agreements explicitly exclude training use. Always read the terms.

Sources

  1. OpenAI Enterprise Privacy

Related Articles

Protect Your Data Before Q-Day Arrives

QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.

Try QNSQY

Originally published at quantumsequrity.com/blog/chatgpt-data-quantum-risk.