Answer
What actually leaves your firm when someone pastes a client document into a chatbot?
The whole document leaves, exactly as pasted, including every name, number and identifier in it. Where it goes next is governed by whatever terms that account is on. Your firm keeps no record of what was sent, by whom, or whether anyone checked the answer before it was used.
The part people picture
Most people think of the risk as the provider doing something with the content. That is the part the terms of service are about, and a business account usually says something reassuring about it.
It is a fair thing to check. It is also the part you have least control over and the part that is most likely to improve on its own over time.
The part that is easier to change
The whole document was sent because taking things out of it by hand is tedious, and the person was busy. That step is the first thing dropped when someone is at the end of a long day, and no policy document changes that.
Nobody wrote down that the job happened. There is no record of which document was used, which tool it went to, who reviewed the result, or whether anyone did. If you were asked next quarter, the honest answer would be that you would have to go and ask.
What a defined workflow changes about it
A defined workflow does the taking-out step automatically, every time, because it is part of the task rather than something a person remembers. It routes the protected version to whichever provider the firm has approved. Where the workflow declares a review step, a named person sees the result before it is used. And it writes a record of the run.
That record is metadata: what kind of run it was, when, under which policy, with what outcome. Never the content. It is enforced in the code rather than promised in a policy.
What it does not change
It does not mean nothing leaves. It means less leaves than a paste, and that what does leave is the same every time rather than dependent on who was doing it.
It is not legal, privacy or compliance advice, and it does not make a firm compliant with anything. Your firm remains responsible for its own obligations.
FlowClave is a software workflow. This is not legal, privacy or compliance advice, and it does not make a firm compliant with anything. Your firm remains responsible for its own obligations.