AI account identity: personal versus company AI accounts

Overview

Employees sometimes do company work in AI tools signed in to a personal account (Claude Max or Pro, ChatGPT Plus or Pro, Cursor Pro, a personal GitHub Copilot) instead of the company’s Team or Enterprise account. That work happens outside the company’s contract, data-retention terms, admin console and audit logs. A Team or Enterprise seat in another organisation’s account, such as a client’s or an agency’s, carries the same risk.

The endpoint collector reads which account each AI tool on a computer is signed in to. Shield360 then sorts every reading into one of four kinds:

Kind	Meaning
Company	A Team or Enterprise seat in an organisation, workspace or team you approved, or one signed in with a company email domain; a GitHub login holding a company Copilot seat; a company API key.
Personal	A personal plan tier (claude_max, claude_pro, ChatGPT free, plus, pro, Cursor free, pro), whatever email is on it; a Copilot login with no company seat; an API key your vendors do not list.
Other organisation	A Team or Enterprise plan whose organisation, workspace or team you have not approved, signed in with an email that is not on a company domain.
Unknown	Not enough to decide, or the tool’s file could not be read.

A personal plan always counts as personal, even when it was bought with a work email address.

Plan tiers

Tool	Personal	Organisation
Claude Code	claude_max, claude_pro, claude_free	claude_team, claude_enterprise
Codex (ChatGPT)	free, go, plus, pro, prolite	team, business, edu, enterprise
Cursor	free, free_trial, hobby, pro, pro_plus, ultra	business, team, enterprise
GitHub Copilot	free, pro, pro_plus	business, enterprise

These mappings are maintained as vendors add tiers. A tier on neither list counts as unknown, unless its organisation, workspace or team is approved or it is signed in with a company email domain.

For Codex, the plan comes from the latest session’s rate_limits.plan_type when there is one, and from the sign-in’s chatgpt_plan_type otherwise.

Find the results in Discover → AI usage → AI accounts (/visibility/ai-accounts), which lists the people and computers with personal or other-organisation accounts. Each person’s and computer’s page also shows badges for them, and the Shadow AI section on the Costs page has a Personal plans only filter.

Note

The page sits under Visibility next to People and Computers, rather than under Govern, because each row is a discovery about one person on one computer and links to their pages. The governance side (alerts, the risk register, ISO/IEC 42001 evidence and the evidence package) reads the same data.

What the collector reads

The collector reads one file per tool, once per hourly report. It reads identity and billing fields only. It never reads prompts, and it never reads or sends tokens, refresh tokens or API keys: none of its data types has a field that could hold one.

Tool	File	Fields read
Claude Code	~/.claude.json (all platforms)	oauthAccount.emailAddress, organizationUuid, organizationName, organizationType (the plan, such as claude_max or claude_team) and billingType. For API keys a person approved, a keyed fingerprint of the key’s last four characters.
Codex	~/.codex/auth.json, and the plan tier the latest session states	auth_mode. For a ChatGPT sign-in, the id_token payload is decoded on the computer, without checking its signature and without any network call, to read email, chatgpt_plan_type and chatgpt_account_id (the workspace). The token itself is never sent. For an API key, only a keyed fingerprint, the same one key attribution uses.
Cursor	state.vscdb in Cursor’s global storage: ~/Library/Application Support/Cursor/… (macOS), %APPDATA%\Cursor\… (Windows), ~/.config/Cursor/… (Linux)	Four ItemTable keys only: cursorAuth/cachedEmail, cursorAuth/stripeMembershipType (free, pro, business, enterprise), cursorAuth/cachedTeam (team id and name) and adminSettings.cachedTeamId. The database is opened read-only and immutable (mode=ro&immutable=1), so Cursor is not disturbed and no lock or journal file is created. The access and refresh token rows in the same table are never selected.
GitHub Copilot	~/.config/github-copilot/apps.json or hosts.json (%LOCALAPPDATA%\github-copilot on Windows), falling back to the GitHub CLI’s hosts.yml	The signed-in GitHub login (user) only. A GitHub CLI login on its own is not reported as Copilot use.

The collector handles a missing file by reporting nothing for that tool. A file that exists but cannot be parsed is reported as unknown. Every reading carries a reader version, so the platform can tell readings from older and newer collectors apart. To see what a computer would report, without the emails, run shield360 collector run --dry-run.

What Shield360 stores

Readings never reach ClickHouse or any log as the computer reported them. The collector ingest route takes them out of the batch and classifies them first. It then stores, per environment, person, computer and tool:

• the plan tier, the account kind and the reason for it;
• the Anthropic organisation, ChatGPT workspace or Cursor team id;
• the vendor’s organisation name, for company accounts only. A personal Claude organisation is named after its owner’s email, so that name is dropped;
• keyed fingerprints of any API key;
• when the reading was first and last seen;
• the email or GitHub login, as the email setting allows.

Readings not seen for 365 days are deleted. Readings are part of a person’s data export and erasure and of the organisation export (masked forms only), and they are listed in the privacy data inventory.

Email capture and masking

Go to Settings → AI account settings (/settings/ai-accounts) to manage Capture AI account emails. It is on by default.

	Company-domain email	Any other email
Capture on (default)	Kept in full. It is a work identity.	Kept masked (j•••@gmail.com), together with a keyed hash (HMAC-SHA256 under a per-organisation secret that never leaves Shield360). The same personal account is recognised across computers without storing it.
Capture on, “Keep personal emails in full” on	Kept in full.	Kept in full, encrypted at rest. It is still shown masked; see Revealing a full email.
Capture off	Not sent. The computer sends only the domain and a keyed hash.	Not sent. The computer sends only the domain and a keyed hash.

GitHub logins are treated the same way: kept in full when the login holds a company Copilot seat, masked otherwise.

With capture off, computers do not send the email or GitHub login at all. The setting reaches them through the device policy they fetch on every report. They send the email’s domain, the plan tier and the vendor IDs, which is enough to classify the account, and a keyed hash of the identifier under the environment’s fingerprint key, so the same account is recognised on other computers. Copilot logins are then matched to the company’s seats through the same hash. A collector that has not yet fetched the new policy, or cannot reach it, also sends only the domain and hash.

Keeping personal emails in full requires the plan that includes revealing sensitive values.

Revealing a full email

Where a personal email is kept in full, people with the Reveal personal AI account emails permission see a Reveal button. Administrators and Compliance officers have this permission by default; Auditors, Analysts, Members and Viewers do not. Every reveal is recorded in the audit log as Revealed a personal AI account email, with the reading’s id but never the email. The audit record is written whether the reveal succeeds or not.

Emails never appear in alerts. The evidence package carries masked forms only.

Employee notice

Caution

Tell employees before you rely on this feature. The notice should say that Shield360 reads which account their AI coding tools are signed in to (tool, plan, organisation and email), what is kept (company emails in full, other emails masked with a hash, unless you opt in to keeping them), how long it is kept, and who can reveal a full personal email. Your employment contract, works council or local law may require more. Turning on Keep personal emails in full is a change worth a fresh notice.

Tell Shield360 which accounts are the company’s

In Settings → AI account settings, enter one value per line:

• Anthropic organisation IDs (Claude Team and Enterprise). An organisation admin finds the organisation UUID in Claude under Settings → Organization (Enterprise: Settings → Account, or Organization settings → Organization, at the bottom). It is also shown on every Other organisation Claude Code row on the AI accounts page, ready to copy.
• ChatGPT workspace IDs (Team, Business and Enterprise). These are shown in the workspace’s admin settings. They are the chatgpt_account_id a Codex sign-in carries, and are shown on Codex rows.
• Cursor team IDs (Business and Enterprise). A number, shown on Cursor rows (from the team Cursor caches on a signed-in computer).
• Company email domains. A Team or Enterprise account signed in with one of these domains counts as the company’s. If you leave this empty, Shield360 uses the domains of your organisation’s Shield360 members, never public mail providers.

Some matching needs no setup:

• GitHub Copilot. A login holding a seat in the GitHub Copilot connector is company; a login without one is personal. The connector keeps a seat’s email when GitHub shares one. If it lists no logins, Copilot readings stay unknown.
• API keys. A key whose fingerprint matches one of your keys from the Anthropic or OpenAI spend connectors is company.

Changes take effect immediately: every screen re-classifies the stored readings against the current settings.

Enforce company accounts

Detection alone tells you who uses a personal account. To stop it, set Govern → Policies & rules → AI tools → Company AI accounts only to Warn or Block. The approved organisations, workspaces and domains above are what counts as the company’s.

• Browser extension. On ChatGPT and Claude the extension reads the plan the page shows next to the account. It acts only on a plan name it recognises exactly (Free, Plus, Pro, Max, Go), so a person named Max is never read as Claude Max. Consumer Microsoft Copilot (copilot.microsoft.com) only takes personal Microsoft accounts and counts as personal. Gemini and the other sites do not show which account is signed in reliably, so nothing is enforced there. The page cannot tell this company’s Team workspace from another organisation’s, so under Block the extension also adds each vendor’s tenant restriction header for your approved organisations and workspaces, and the vendor refuses any other account.
• AI proxy. Under Block it adds Anthropic’s anthropic-allowed-org-ids header to every request it forwards to Anthropic, so an API key from an organisation you have not approved is refused by Anthropic with 403 tenant_restriction_violation.
• Claude Code and Codex. When a prompt is submitted, the hook reads the same file the collector does and classifies the account with the rules on this page. Under Block it stops the prompt with a message to sign in with a company account. Under Warn it shows a notice once per session. The email is used on the computer for its domain only; nothing new is sent. Cursor and Copilot are not enforced: Cursor’s account is read from a database that is too slow to open on every prompt, and Copilot’s hooks cannot stop a prompt.

Anything that cannot be identified is allowed: an API key in a coding agent (its owner is matched on the platform only), a page that does not show its plan, a missing or unreadable account file. Every warn and block is recorded as a violation with the kind of account, never the email.

The vendors’ headers are documented in Enforce network-level access control with tenant restrictions (Anthropic) and Corporate network controls in ChatGPT Enterprise (OpenAI). See Company AI accounts only for the setting and what each client does.

Alerts, risks and evidence

• Alert: Personal AI account in use (ai_accounts.personal_in_use) fires once per person, computer, tool and account when a personal or other-organisation account is first seen. It names only the tool and the plan tier, never the person, the computer or the email. Route it from Alerts → Rules like any event alert.
• Risk register: the risk scan opens one risk per tool, such as Claude Code used with personal accounts. Its likelihood follows how many people are involved and its evidence is counts only.
• ISO/IEC 42001: the evidence check AI tools are used through the company’s accounts (accounts.company_only) supports A.9.2 (responsible use) and A.10.3 (suppliers). It is met when every account seen is the company’s, a gap while any is personal or another organisation’s, and not applicable before any reading arrives.
• Evidence package: ai-accounts.json and ai-accounts.csv carry the counts and one row per reading (tool, plan, kind, reason, masked identifier, first and last seen), without names of people or computers.

Permissions

Action	Permission
See AI accounts and badges	View computers and people (collector.read)
Change the approved organisations and email settings	Manage AI account identity (ai_accounts.manage): Administrators and Compliance officers
Reveal a full personal email	Reveal personal AI account emails (ai_accounts.reveal): Administrators and Compliance officers, always audited

The demo organisation is read-only. Its AI accounts include personal Claude Max, ChatGPT Plus and Cursor Pro accounts alongside the company’s Team and Business accounts, and one contractor on an agency’s Claude Team.

Shadow AI

AI in use without a company seat, by tool, plan and person

Data retention

What telemetry content Shield360 stores, and for how long