Keep company work on Business, Enterprise, or Edu, where OpenAI does not train on content by default. Personal plans train on new conversations unless people turn the setting off. Business and Enterprise then differ on who can read conversations and on audit records: Business admins can view and export members' conversations, while Enterprise admins reach them through the Compliance API audit log. Both let workspace admins control retention.
When you need this
- Security or legal review asks where prompts, files, and outputs are stored, and who can read them.
- Employees use personal ChatGPT accounts for work and you need a policy.
- Connected apps such as Gmail, Google Drive, or SharePoint are being enabled.
Evaluation criteria
Training defaults
Which accounts can train OpenAI's models?
Look forTurn off Improve the model for everyone on Free, Go, Plus, and Pro accounts to exclude new conversations from training. OpenAI excludes temporary chats and keeps them for up to 30 days for safety. OpenAI also excludes Business, Enterprise, and Edu content by default, including record mode transcripts.
Retention
Who sets how long conversations are kept?
Look forSet retention through your Business, Enterprise, or Edu admin controls. OpenAI removes deleted conversations within 30 days unless the law requires retention. Shorter retention can degrade history-dependent features such as conversation history.
Admin visibility
Who inside the company can read a member's conversations?
Look forTell employees who can read their conversations before they use corporate seats for personal work. Business admins can read member conversations and export or delete them. Enterprise admins access conversation and GPT audit logs through the Compliance API. One commenter avoids their employer's seat because of admin access.
Audit records
How long do compliance records stay available?
Look forExport Compliance Logs Platform records continuously if you need them beyond 30 days. Choose a destination such as your SIEM or data lake, or an eDiscovery system.
Residency and key management
Where must data rest, and who holds the keys?
Look forChoose Enterprise for Enterprise Key Management or data residency in the US, EU, UK, Japan, Canada, South Korea, Singapore, India, Australia, or the UAE. Work Cloud's local computer access does not provide strict zero data retention.
Connected apps
Which apps can reach company data, and with whose permissions?
Look forReview enabled plugins and apps. They start off on Enterprise and Edu, and on for Business. Shared connections inherit the connected account's permissions. Disconnecting an app leaves copies saved in conversations.
Questions to ask vendors
- Do we need zero data retention or a BAA, and does that require an Enterprise agreement?
- Which connected apps should be off until security review?
- Where will exported Compliance API records live, and for how long?
Red flags
- Staff using personal Plus or Pro accounts for client data with training left on.
- Assuming a deleted chat also deletes saved memories, Library files, and app copies.
- Plugins left on by default in a Business workspace without review.
- Relying on the 30-day Compliance Logs Platform window as the retention record.
Products in this piece
Sources
- Official documentation
- 8
- Public source
- 2
- OpenAI: Enterprise privacy at OpenAI
- OpenAI Help Center: Data controls in ChatGPT
- OpenAI Help Center: ChatGPT Record
- ChatGPT admin docs: ChatGPT Work cloud security
- ChatGPT admin docs: ChatGPT Work overview
- ChatGPT admin docs: Compliance API
- OpenAI Help Center: ChatGPT Business overview
- ChatGPT pricing
- Hacker News comment on corporate ChatGPT seats and HR visibility (Aug 31, 2026)
- OpenAI Community: Request for native WebDAV support in ChatGPT knowledge (Dec 30, 2025)