ChatGPT Enterprise is generally safe for workplace use on a corporate plan. Our verdict for a typical 50–500 person company handling client or regulated data, assessed 29 July 2026: Approved. OpenAI states business data is excluded from training by default, and IT gets an admin console, SSO, and retention control — the controls a written policy can actually be enforced with. The right answer for teams that want ChatGPT: move the demand onto a corporate plan instead of pretending the demand does not exist.
This verdict reflects OpenAI’s published terms as we read them on 29 July 2026. A vendor can change its terms the day after; the primary sources below are how you check.
| Vendor | OpenAI |
|---|---|
| Category | General assistant |
| Our tier verdict | Approved (assessed 29 July 2026) — OpenAI states business data is excluded from training by default, and IT gets an admin console, SSO, and retention control — the controls a written policy can actually be enforced with. source |
| Trains on your data? | No (per vendor terms) No. OpenAI states that by default it does not train on any inputs or outputs from its products for business users, including ChatGPT Business, ChatGPT Enterprise and the API. source |
| Data retention | OpenAI states that customers control how long data is retained on ChatGPT Enterprise, ChatGPT Edu and ChatGPT for Healthcare. source |
| Admin controls | Admin console, SAML SSO, fine-grained access and feature control, and organisation-level data controls. |
| Compliance certifications | SOC 2 Type 2 (stated on OpenAI’s Enterprise privacy page for ChatGPT Enterprise, Edu and Healthcare) source |
| HIPAA / BAA | Enterprise- or plan-dependent — Available, but scope matters. OpenAI states it can sign BAAs in support of HIPAA compliance for its API Platform, and it offers a ChatGPT for Healthcare workspace designed to support HIPAA compliance. Coverage of your specific ChatGPT Enterprise deployment must be confirmed with OpenAI in writing. source |
No. OpenAI states that by default it does not train on any inputs or outputs from its products for business users, including ChatGPT Business, ChatGPT Enterprise and the API.
Retention: OpenAI states that customers control how long data is retained on ChatGPT Enterprise, ChatGPT Edu and ChatGPT for Healthcare.
Available, but scope matters. OpenAI states it can sign BAAs in support of HIPAA compliance for its API Platform, and it offers a ChatGPT for Healthcare workspace designed to support HIPAA compliance. Coverage of your specific ChatGPT Enterprise deployment must be confirmed with OpenAI in writing. As a rule: no signed Business Associate Agreement means no protected health information (PHI) — a BAA is the gate, not the security posture. A vendor can hold every certification on the market and still be the wrong place for PHI, because what makes PHI processing lawful for a covered entity is the contract, not the encryption.
Comparing vendors on this specifically? See BAA status for all 26 tools →
SOC 2 Type 2 (stated on OpenAI’s Enterprise privacy page for ChatGPT Enterprise, Edu and Healthcare). Treat that as the vendor’s own statement and ask for the current report under NDA — a SOC 2 report has a defined scope and a fixed audit window, and neither is visible from a badge on a trust page. A certification is also not a contract: it describes how ChatGPT Enterprise runs its controls, not what your agreement with them permits.
HIPAA is the gate: Available, but scope matters. OpenAI states it can sign BAAs in support of HIPAA compliance for its API Platform, and it offers a ChatGPT for Healthcare workspace designed to support HIPAA compliance. Coverage of your specific ChatGPT Enterprise deployment must be confirmed with OpenAI in writing. Until a BAA is confirmed in writing, treat ChatGPT Enterprise as off-limits for anything containing PHI — patient names, appointment details, clinical notes, even "anonymized" summaries that could be re-identified.
For SEC/FINRA-regulated firms the questions are recordkeeping and confidentiality: can communications through ChatGPT Enterprise be captured for books-and-records requirements, and do the data terms hold up in vendor due diligence? Admin console, SAML SSO, fine-grained access and feature control, and organisation-level data controls.
The privilege question comes first: entering client-confidential facts into any third-party AI service must be evaluated as a potential disclosure. ChatGPT Enterprise’s no-training terms on corporate plans help, but confidentiality duties still require client-consent and matter-sensitivity judgment.
Every vendor claim above traces to a document the vendor publishes, and every document below is one we actually opened and read — each carries the date we read it. All of them were read on 29 July 2026. The verdict date on this page is not a build stamp and is not "today": it is the oldest of those dates, because a verdict is only as current as the stalest document under it. Rebuilding the site does not move it.
Where a fact is not in one of these documents, the page says so rather than filling the gap. That is why some rows read "not publicly documented" or "not established from a primary source" instead of naming a certification or rounding an open question to a convenient answer.
Why the tier verdict is "generic": Approved is the right starting classification for most 50–500 person companies — but a healthcare company, a law firm, and a SaaS startup should not have identical tool lists. The $79 policy kit classifies ChatGPT Enterprise and 25 other tools specifically for your industry, company size, and the data your team handles.
And a verdict has a shelf life: vendor data policies change quietly — a terms update can move a tool between tiers overnight. This page states what we read on 29 July 2026. The $149/mo Monitor plan exists precisely because that date keeps receding.
ChatGPT Enterprise is generally safe for workplace use on a corporate plan. Our verdict for a typical 50–500 person company handling client or regulated data, assessed 29 July 2026: Approved. OpenAI states business data is excluded from training by default, and IT gets an admin console, SSO, and retention control — the controls a written policy can actually be enforced with. The right answer for teams that want ChatGPT: move the demand onto a corporate plan instead of pretending the demand does not exist.
No. OpenAI states that by default it does not train on any inputs or outputs from its products for business users, including ChatGPT Business, ChatGPT Enterprise and the API.
Available, but scope matters. OpenAI states it can sign BAAs in support of HIPAA compliance for its API Platform, and it offers a ChatGPT for Healthcare workspace designed to support HIPAA compliance. Coverage of your specific ChatGPT Enterprise deployment must be confirmed with OpenAI in writing. As a rule: no signed Business Associate Agreement means no protected health information (PHI) — a BAA is the gate, not the security posture. A vendor can hold every certification on the market and still be the wrong place for PHI, because what makes PHI processing lawful for a covered entity is the contract, not the encryption.
SOC 2 Type 2 (stated on OpenAI’s Enterprise privacy page for ChatGPT Enterprise, Edu and Healthcare). Treat that as the vendor’s own statement and ask for the current report under NDA — a SOC 2 report has a defined scope and a fixed audit window, and neither is visible from a badge on a trust page. A certification is also not a contract: it describes how ChatGPT Enterprise runs its controls, not what your agreement with them permits.
We classify ChatGPT Enterprise as Approved for a typical 50–500 person company, assessed 29 July 2026. OpenAI states business data is excluded from training by default, and IT gets an admin console, SSO, and retention control — the controls a written policy can actually be enforced with. Your own classification should reflect your industry, data types, and which plan or account type your company actually uses.
New to the topic? Start with what shadow AI is — definition, examples and risks, then measure your own exposure with the shadow AI scorer.
Your team is using ChatGPT Enterprise. Does your AI policy cover it?
Most policies name a handful of tools and go stale the month after they are written. Two ways to find out where yours stands: check an existing policy for gaps in 30 seconds, or generate a policy that classifies ChatGPT Enterprise by name — free preview, no account. Starting from scratch? The free 14-section AI acceptable use policy template is the document itself, ungated.
A 4-document AI policy kit — acceptable use policy, tool tier list, acknowledgment form, manager FAQ — that classifies ChatGPT Enterprise and 25 other tools for your company, industry, and data. Generated in about 10 minutes.
Generate my policy kit →We re-check vendor terms monthly and alert you when ChatGPT Enterprise’s data policy changes — plus regenerate your whole kit so it never goes stale. This directory is a snapshot — Monitor is the live feed.
See Monitor plan →Already have an AI policy? Check it for gaps in 30 seconds →