# Is It Safe to Put Company Data in ChatGPT? Source: https://cplt.tech/blog/is-it-safe-to-put-company-data-in-chatgpt Author: Stéphane Lepain Published: 2026-11-06T22:33:44Z Tags: chatgpt, data-privacy, small-business --- **It can be, if your team works on a business plan and you agree beforehand what goes in. On a free or personal account, treat every conversation as something OpenAI may use to train its models, unless that person has switched training off.** The account your people log in with changes the answer more than the tool does. ## Is it safe to put company data in ChatGPT? On the plans for individuals (Free, Plus and Pro), OpenAI says it may use your content to train its models. Each person can turn this off under Settings, Data controls, by switching off "Improve the model for everyone". It is a personal setting. In a team of twenty, you are counting on twenty people to have found it. On ChatGPT Business, Enterprise and Edu, and on the API, OpenAI says it does not use inputs or outputs to train its models by default. For Enterprise and Edu, its trust portal lists a SOC 2 Type 2 report and ISO 27001 certification. For ordinary office work, that is a reasonable base. Training is one question. Where the data is kept, for how long, and who can read it are separate ones. For the API, OpenAI's documentation says abuse monitoring logs, which can contain prompts and answers, are kept for up to 30 days by default. And when a client contract or a regulation sets rules for some of your data, those rules decide. The provider's terms are only part of the picture. My short answer to a business owner: a business plan, used for the right kind of material, is fine. Staff putting client files into personal accounts is the thing I would fix this week. ## What should I never share with ChatGPT? I would keep four kinds of material out of any chat assistant your company does not run itself, whatever the plan: - Passwords, API keys and access codes. A key that went into a chat has been seen by someone else; change it. - Personal data about customers or staff that you have no clear basis to share, such as health details, ID numbers, salaries or bank details. Under GDPR you need a lawful reason to share it, and a written contract with any service that processes it for you. I wrote about that contract in [the OpenAI DPA and GDPR Article 28](https://cplt.tech/blog/gdpr-article-28-openai-dpa-self-hosted-ai). - Anything a contract asks you to keep confidential: a client's files under NDA, tender documents, a partner's prices. - The material that is your business: unreleased plans, source code, the numbers of a deal you are negotiating. Most daily work sits outside those four: drafting an email, tidying up a public text, summarising your own notes once the names are out, asking how a spreadsheet formula works. A simple test before pasting: if this text landed in someone else's inbox tomorrow, would it cause trouble? If yes, it goes into a tool your company controls, or it stays where it is. ## Should I be careful what I tell ChatGPT? Yes, and mostly because of habits. Someone pastes a whole email thread to get a reply drafted, and the thread carries a customer's address, a phone number and an invoice total. The fix is small. Paste only the part the answer needs, and swap names for roles: "the client", "supplier A". The thumbs up and down buttons matter more than they look. On Free, Plus and Pro, OpenAI says that if you send feedback with one of them, the whole conversation behind it may be used for training, even after you opted out. On Business, Enterprise and Edu, feedback alone gives no such permission. ## Simple rules for a team of 10 to 50 people This is what I would put on one page: 1. Company work happens in company accounts. Choose a business plan and ask people to keep company material out of their personal accounts. 2. Write three lists: fine to paste, paste once names are removed, keep out. Give two real examples from your own business for each. 3. Name the person who answers "can I paste this?" so the answer is always the same. 4. Look at the data settings every quarter. Plan names and options change. Writing that page takes about an hour. Keeping it current is the real job, so give it to one person. ## When the data has to stay inside the company Some documents need more than a provider's promise: a client contract forbids sending them out, or they are simply too sensitive. For those, the only approach that guarantees the data stays with you is an open-weight model running on your own server. Open-weight means the model files are published, so you can download them and run them on your own machine with tools such as [Ollama](https://ollama.com/), [llama.cpp](https://github.com/ggml-org/llama.cpp) or [vLLM](https://docs.vllm.ai/). Your team gets a chat assistant that feels familiar, and the conversations stay on hardware you own. I explain the parts of such a setup in [what a private AI stack is](https://cplt.tech/blog/what-is-a-private-ai-stack). It asks for more effort than a subscription, and in my experience the best cloud models still do better on the hardest work. Plenty of businesses mix both: the cloud plan for everyday writing, the local model for the sensitive files. My own setup works that way. The [private AI page](https://cplt.tech/services/private-ai-hosting) shows what I build for that case. If you want to sort out which of your documents go where, [book a free call](https://cplt.tech/contact). We go through your real cases together. ## Frequently asked questions ### Does Temporary Chat keep a conversation out of training? OpenAI says temporary chats are not used to improve its models while they stay temporary, and they stay out of your chat history. If you save one, it becomes a regular chat and follows your account settings. ### Is ChatGPT Business enough for client documents? For a lot of everyday documents it is a sensible choice, since OpenAI says it does not train on Business data by default. Read your client contracts first: some say where their data may go, and that settles it. ### What if someone already pasted something sensitive? Change any password or key that went in, straight away. For personal data, tell whoever looks after data protection in your company, so they can decide what has to happen next.