Sending sensitive information to OpenAI

[kristopher-smith]

I have been looking through how the new CALM implements "intent-less" policies.

Reading through the prompts to LLM's it appears we would be relying heavily on the generative model to steer and trigger other policies and function calls.

Unless we are housing our own LLM in house, would we not be sending potentially private information to a third party?

For example: https://github.com/RasaHQ/rasa-calm-demo/blob/main/data/prompts/gpt_3-5_turbo_cmd_gen_prompt.jinja2

If we ask a user for personally identifiable information to fill slots, are those not being fed to OpenAI as well as the entire context of what type of info it is for?
If we try to anonymize the data to send in the prompt to OpenAI but the users are sharing information outside of what is caught in the prompt, isn't this also being shared as well?

Is there a way aside from housing an LLM on our internal servers to be sure we are not sharing sensitive information?