AI tool register · AI assistant
Is ChatGPT safe for confidential information?
Whether ChatGPT is safe for confidential information depends on the plan. On Business and Enterprise, OpenAI does not use your content to train its models by default, and the firm gets admin controls. On Free, Go, Plus and Pro, training is on unless each person turns it off. For client information, use a business plan the firm controls.
PlanTrains on your content
- Free, Go, Plus, ProYes, unless you turn it off
- BusinessNo
- EnterpriseNo
Read October 5, 2026OpenAI
What ChatGPT does with your data, plan by plan
Free, Go, Plus, Pro
Yes, unless you turn it off
Content may be used to train models unless you turn off "Improve the model for everyone" in Settings > Data controls. Temporary chats are not used for training. Source (opens in a new tab)
- How long it is kept
- Chats stay until you delete them. Deleted chats are scheduled for permanent deletion within 30 days, with exceptions for security or legal obligations. Temporary chats may be kept up to 30 days.
- Admin controls
- None. These are individual accounts. The pricing page lists SAML SSO and the admin console as not included.
Business
No
Business data is not used for training by default. It may be used if the customer explicitly opts in, for example through feedback. Source (opens in a new tab)
- How long it is kept
- Workspace admins can control how long data is kept. Deleted or unsaved conversations are removed within 30 days unless law or protection of the service requires longer.
- Admin controls
- SAML SSO, admin console, admin roles, domain verification, and user analytics. The pricing page lists SCIM, role-based access controls, Compliance API logs, IP allowlisting, and data residency as not included.
Enterprise
No
Business data is not used for training by default. It may be used if the customer explicitly opts in, for example through feedback. Source (opens in a new tab)
- How long it is kept
- Workspace admins control how long data is kept. Deleted conversations are removed within 30 days unless OpenAI is legally required to keep them.
- Admin controls
- Adds SCIM, role-based access controls, Enterprise Key Management, Compliance API logs, IP allowlisting, and data residency to the Business controls. Admins can access an audit log of conversations through the Compliance API.
Where your data is stored
Data residency at rest is offered to eligible new Enterprise and Edu workspaces in 10 regions, including the US, Canada, Europe, and the UK. The pricing page lists it as not included in Business.
Source (opens in a new tab)Attestations
What the vendor has had audited
SOC 2 Type 2 for Business and Enterprise. The pricing page lists ISO 27001, 27017, 27018, and 27701 certification for Enterprise and marks it as not included for Business.
Source (opens in a new tab)Worth knowing
What to watch for
Personal plans (Free, Go, Plus, Pro) allow training on your content unless you opt out. Business and Enterprise are not used for training by default.
Source (opens in a new tab)Giving a thumbs up or thumbs down can send the entire conversation to model training, even after you have opted out.
Source (opens in a new tab)On Business, OpenAI says authorized employees and specialized third-party contractors can access stored conversations for engineering support, abuse review, and legal compliance.
Source (opens in a new tab)An app set to "Allow all actions" can act without asking again. OpenAI describes this option as carrying elevated risk.
Source (opens in a new tab)
Our take
For a firm of 15 to 200 people
Use Business or Enterprise for anything that involves client information. On the personal plans, training is on unless each person turns it off, and the firm has no way to see or manage what anyone has put in.
This is our reading of the facts above, not a rating. We have no product to sell and take no referral fee from any vendor.
Compare and decide
How this was checked
Every fact on this page is taken from OpenAI’s own documentation as it read on . Vendors change these terms often, sometimes monthly. Check the linked page before you rely on it.
- OpenAI enterprise privacy (training, retention, staff access, SOC 2) (opens in a new tab)
- How your data is used to improve model performance (consumer training, feedback) (opens in a new tab)
- Data controls in ChatGPT (opt-out setting, temporary chats) (opens in a new tab)
- Chat and file retention in ChatGPT (deletion within 30 days) (opens in a new tab)
- ChatGPT pricing comparison table (admin controls and certifications per plan) (opens in a new tab)
- Connected apps in ChatGPT (what apps see and do, training) (opens in a new tab)
- Admin controls, security, and compliance for plugins and apps (opens in a new tab)
- Administrator-managed apps with sync (indexing) (opens in a new tab)
- Developer mode and MCP apps (custom apps) (opens in a new tab)
- Data residency and inference residency for ChatGPT (opens in a new tab)
Your brief · 1 of 3
What brings you here?
See what we’d build first at a firm like yours.
A tool we haven’t covered?
Run the same questions on it yourself with the vendor risk assessment template.