Your customers are already using ChatGPT. 68% of employees use free-tier AI tools like ChatGPT via personal accounts at work, and 57% paste sensitive company data into them1. They're not doing this to cause problems. They're doing it because your product doesn't match their specific workflow, and ChatGPT is the fastest way to build a workaround.
That instinct is right. The execution is dangerous. ChatGPT produces code snippets and throwaway prototypes. It doesn't produce deployed, governed applications connected to your platform's real data. That gap between a ChatGPT artifact and a production microapp is where security risk, data leakage, and ungoverned shadow IT live.
Key Takeaways
- 68% of employees use free-tier ChatGPT at work; 57% paste sensitive data into it (Menlo Security, 2025)1
- ChatGPT generates code snippets and prototypes, not deployed, governed apps connected to real customer data
- An embedded app builder drove 90.8% user adoption and 89% day-30 retention at UpKeep, vs. the 39% SaaS industry average2
What Can ChatGPT Actually Build? #
ChatGPT generates code, answers programming questions, debugs errors, and produces prototype-level outputs through its Canvas feature. Even Figma's 2026 guide on AI app builders states directly: ChatGPT "can help by generating code snippets, debugging, or answering development questions but you'll still need to build and deploy the app using a proper app builder or IDE"3.
That's an honest assessment. ChatGPT is a thinking tool. It helps people reason through problems and produce starting points. But the output is an artifact, not an application.
What's missing between a ChatGPT output and something your customers can actually use every day?
- Deployment: ChatGPT outputs live in a chat window. They don't deploy anywhere.
- Security: No auth, no permissions, no row-level access control. Zero inheritance of your platform's security model.
- Data connection: ChatGPT doesn't know your APIs, your customer's data, or your data model. It generates generic code.
- Governance: No versioning, no audit trail, no visibility into what was built or who's using it.
- Distribution: No marketplace, no way for other users to discover or install what was built.
Why Are Your Customers Using ChatGPT for Workarounds? #
They're trying to close the gap between what your product does and what they need it to do. Every B2B SaaS product serves customers across different industries, personas, and skill levels. A CMMS platform serves hospitals, roofing companies, and fleet operators. A CRM serves sales teams, account managers, and support reps. One interface can't serve all of them the same way.
When the product doesn't fit their workflow, customers improvise. They build spreadsheets, copy data between tabs, and now, they paste company data into ChatGPT and ask it to generate solutions.
The numbers are striking. Menlo Security logged 155,005 copy attempts and 313,120 paste attempts into AI tools in a single month across their monitored organizations1. Reco's 2025 Shadow AI Report found that multiple popular AI tools received failing security grades for lacking basic access controls4.
Shadow AI isn't a behavior problem. It's a product signal. Your customers are telling you that your platform has workflow gaps, and they're filling those gaps with ungoverned tools.
How Do ChatGPT and an Embedded App Builder Compare? #
| Feature | Gigacatalyst | ChatGPT |
|---|---|---|
| Who uses it | Your customers + CS teams | Individual employees, unmanaged |
| What it produces | Deployed, governed microapps | Code snippets and prototypes |
| Security model | Inherits your platform's auth and permissions | None, data pasted into third-party tool |
| Data context | Knows your APIs, data model, per-customer constraints | Generic, no knowledge of your platform |
| Deployment | Auto-deployed into running marketplace | Copy-paste from chat window |
| Governance | Versioned, audited, permissioned | No audit trail, no version control |
| Distribution | Built-in app store for discovery | Manual sharing via links or docs |
| Scales to | Every customer, self-service | One person at a time |
The distinction isn't about capability. ChatGPT is genuinely powerful. The distinction is about architecture. ChatGPT operates in isolation. An embedded builder operates inside your product, with your data, under your security model.
What's the Difference Between an Artifact and an Application? #
An artifact is something you copy-paste from a chat window. An application is a deployed, governed microapp connected to real data with security, version control, and distribution built in5.
ChatGPT produces artifacts: code snippets, HTML previews, prototype UIs you can view in Canvas. They look impressive. They demonstrate what's possible. But they don't connect to your customer's actual work order data. They don't respect role-based permissions. They can't be shared through a marketplace where other team members discover and install them.
When we built this for UpKeep, 946 users generated 670+ microapps without filing a single engineering ticket. Each app connects to UpKeep's real APIs, inherits UpKeep's existing security model, and lives in a marketplace where maintenance teams browse and install what they need. That's not a collection of artifacts. That's a platform extension.
The difference matters because artifacts create work. Someone builds a ChatGPT prototype, then an engineer has to rebuild it properly, connect it to real data, add authentication, deploy it, and maintain it. Applications skip that entire rebuild cycle.
Does ChatGPT Handle Enterprise Security? #
It doesn't. ChatGPT operates outside your platform's security perimeter entirely. There's no SSO integration with your product. No row-level access control on the data your customers paste into it. No audit log of what was built or what data was exposed.
The security gap is real and measurable. 57% of employees input sensitive data into free-tier AI tools1. Reco's research found that several popular shadow AI applications received failing security grades because they lack basic controls like encryption at rest and SOC 2 compliance4.
An embedded app builder takes the opposite approach. It inherits your platform's existing security model. Authentication flows through your SSO. Every API call enforces the same permissions your product already uses. Every app change is audited. No new attack surface, because the apps use the same APIs with the same permissions your customers already have access to.
This isn't a theoretical difference. When your customer's maintenance technician builds a shift handoff checklist through an embedded builder, they can only see the work orders and assets their role allows. When they paste the same data into ChatGPT, that data now lives on OpenAI's servers with no connection to your access controls.
When Should You Use ChatGPT vs an Embedded Builder? #
Both tools have a clear place. The mistake is using one where the other belongs.
Choose ChatGPT when:
- Brainstorming solutions to workflow problems
- Learning how an API works or debugging code
- Generating one-off scripts for personal productivity
- Prototyping ideas before committing to a build
Choose an embedded app builder when:
- Customers need per-workflow, per-persona customization at scale
- Apps must connect to your platform's real data and respect its security model
- You want customers building on your platform instead of around it
- CS teams need to ship solutions without engineering involvement
Use both when:
- ChatGPT helps your team think through the problem; the embedded builder ships the production solution to your customers
In our experience building this for UpKeep, the combination works well. UpKeep's team calls the embedded builder "the missing 30% of UpKeep" because that's what it is: the per-customer, per-persona layer that a one-size-fits-all product can't provide. ChatGPT helped people imagine what was possible. The embedded builder made it real, governed, and scalable.
Can my customers use ChatGPT to build their own workflow apps?
They can generate code snippets and prototypes, but they can't deploy governed apps connected to your real data. ChatGPT doesn't know your APIs, doesn't inherit your security model, and doesn't have a deployment target. The output needs an engineer to rebuild it properly.
Is ChatGPT Enterprise secure enough for building customer-facing apps?
ChatGPT Enterprise improves data handling over the free tier, but it still operates outside your product's security perimeter. It doesn't inherit your platform's SSO, row-level permissions, or audit requirements. Apps built with it still need separate deployment and security review.
What's the difference between ChatGPT's Canvas and a real app builder?
Canvas lets you preview and iterate on code within ChatGPT's interface. But the output stays in ChatGPT. An embedded app builder generates apps that are auto-deployed into your product's marketplace, connected to real customer data, with permissions and version control built in.
Should I block ChatGPT at my company to prevent shadow AI?
Blocking rarely works. 68% of employees find workarounds. The better approach is to give customers and teams a governed channel for building what they need, so the same creative energy flows into your platform instead of around it.
See Gigacatalyst in Action
Watch how B2B SaaS companies generate customer-facing apps with AI, without engineering tickets.
Book a Demo →The Signal Behind the Shadow AI #
Your customers using ChatGPT to build workflow workarounds isn't a problem to solve with a firewall. It's a signal to act on.
They're telling you the product doesn't fit every workflow. They're telling you the roadmap can't move fast enough. They're telling you they want to build on your platform, not just use it.
The answer isn't to block ChatGPT. It's to give customers a governed way to build what they need, inside your product, connected to their real data, under your security model. That's the difference between shadow AI that creates risk and platform extension that creates value.
ChatGPT helps people think. An embedded app builder helps them ship.
Sources #
Footnotes #
-
Menlo Security. "2025 Report: How AI is Shaping the Modern Workspace." https://www.menlosecurity.com/resources/how-ai-is-shaping-the-modern-workspace-report 2025. ↩ ↩2 ↩3 ↩4
-
Pendo. "SaaS Churn and User Retention Rates: 2025 Global Benchmarks." https://www.pendo.io/pendo-blog/user-retention-rate-benchmarks/ 2025. ↩
-
Figma. "7 of the Best AI App Builders for 2026." https://www.figma.com/resource-library/ai-app-builders/ 2026. ↩
-
Reco. "2025 State of Shadow AI Report." https://www.reco.ai/state-of-shadow-ai-report 2025. ↩ ↩2
-
Anthropic. "Claude Code Overview." https://docs.anthropic.com/en/docs/claude-code 2026. ↩