ChatGPT Enterprise
OpenAI
Safe
OpenAI says it does not train on ChatGPT Enterprise inputs or outputs by default, and workspace admins control how long data is kept. Deleted conversations are removed within 30 days unless the law requires longer. That is a reasonable setup for ordinary business data. Health information is a separate question: a BAA covers Enterprise only when the agreement lists it, including a regulated workspace, and several features are called out as not for PHI.
Last checked 2026-11-10
Data-safety checklist
Trains on your data by default
No
The Enterprise privacy page says OpenAI does not use business data, including ChatGPT Enterprise, to train models by default unless the customer explicitly opts in, for example through a feedback mechanism.How to opt out
Steps
Training is off unless the organization opts in. Admins control response feedback from workspace settings.Data retention
What they keep
Workspace admins control how long data is retained. OpenAI says any deleted conversations are removed from its systems within 30 days, unless it is legally required to retain them.BAA / HIPAA
Enterprise only
OpenAI offers a BAA for listed products, including ChatGPT Enterprise with Regulated Workspace and ChatGPT for Healthcare. The HIPAA guide says a BAA must expressly include Enterprise or Edu before PHI is allowed, and it tells customers to disable features that have not been evaluated, including Codex.Certifications
6 listed
- SOC 2 Type 2
- ISO/IEC 27001:2022
- ISO/IEC 27017:2015
- ISO/IEC 27018:2019
- ISO/IEC 27701:2019
- ISO/IEC 42001:2023
Enterprise and admin controls
Controls
Admins control retention and which internal sources are connected. The HIPAA guide also points at workspace permissions for apps and connectors. You own inputs and outputs where the law allows.Sources
5 pages