Buying an AI Tool
Is it safe to put company data in ChatGPT?
Quick answer: it depends on the plan, not the tool. On ChatGPT Free, Go, Plus and Pro, what you type can be used to train OpenAI's models unless each person turns that off in their own settings. On ChatGPT Business and Enterprise, your inputs are excluded from training by default for everyone in the workspace, and an admin controls the settings. So a company using individual accounts has a hope; a company on a Business workspace has a policy. Before any client file goes in, there are four more things to check: retention, deletion, where the data is stored, and whether you could explain to the client what the tool did with their file. Those four come from the trust criterion in the free method, at practicalmethods.ca/blog/ai-tool-data-privacy-checklist.
The plan decides the answer
| Plan | Trains on what you type | Who controls it |
|---|---|---|
| Free | Yes, unless the person opts out | Each person, in their own settings |
| Go | Yes, unless the person opts out | Each person |
| Plus | Yes, unless the person opts out | Each person |
| Pro | Yes, unless the person opts out | Each person |
| Business | No, by default | The workspace admin |
| Enterprise | No, by default | The workspace admin |
The line to notice is who controls it. On individual plans, five people means five settings, none of which the firm can see. On Business, one setting covers everyone and the admin can prove it. That is the entire difference for a company, and it costs the same USD 20 a seat as a Plus account.
"We'll just tell people to turn it off" is not a policy
The opt-out on individual plans is real. It is also a personal setting, buried in each person's account, that resets to nothing the firm can check. New hires start with it on. Someone who reinstalls the app may start with it on. Nobody in the firm can audit it.
That is why the trust criterion in the method scores this question specifically: is training on your inputs off by default, or a setting buried under a menu? Off by default is a five. Off only if each person remembers is a one. The plan you buy decides which score you get before you have typed anything.
The four questions before a client file goes in
Training is the headline. It is not the whole answer. These are the four data questions from the trust criterion, applied to ChatGPT.
Conversations stay in the workspace until someone deletes them. Deleted conversations are removed from OpenAI's systems on a stated schedule, typically within thirty days, unless retained for legal reasons. Temporary chats are not saved to history. Confirm the current retention period in the data processing terms, not the marketing page.
Test it during the trial. Delete a conversation, a file and a user, and check what remains visible to the admin and what the terms say happens next. If the terms and the behaviour disagree, the terms win, and that is a finding.
By default, in OpenAI's infrastructure in the United States. Data residency in a chosen region is an Enterprise feature, not a Business one. For most firms this does not matter. For a firm whose client contracts or professional body require Canadian or European residency, it is not a criterion. It is a gate, and Business fails it.
If a client asked exactly what happened to their file after you pasted it in, could you answer in two sentences from the terms? If not, the honest score is low regardless of the plan.
What to do in the meantime
Three things a firm can do before the decision is made.
Replace names, figures and identifiers in a copy of the real file and run that. The tool does the job on the copy nearly as well, and nothing you would regret has left the building.
They are linked from the footer of the pricing page under data processing, privacy or trust. It takes twenty minutes. Nobody does it, which is why it is worth doing.
The trial is where you test deletion and retention. Testing them on an individual account tells you nothing about the plan you would buy.
Where this fits in the decision
Data is one of six gates in the method, checked before anything is scored: no training on your inputs or an admin can switch it off, retention stated, region stated. A tool that fails the gate is out. ChatGPT Business passes for most firms. Individual plans fail it for any firm, because nobody can switch training off for everyone.
Trust is then one of four weighted criteria, alongside the job, the adoption and the deal, and it covers more than data: accuracy on ten real outputs, whether cited sources exist, what the vendor did the last time it changed its terms. The full twelve questions are in the trust article, and the whole method is free at practicalmethods.ca/guides/buying-an-ai-tool.
Frequently asked questions
Does ChatGPT use my data to train its models?
On Free, Go, Plus and Pro, yes, unless each person turns off the setting in their own account. On Business and Enterprise, no, by default, and the workspace admin controls it.
Is ChatGPT Business safe for confidential information?
It excludes your inputs from training by default, stores data in the United States, and lets an admin manage users and settings. Whether that is safe enough depends on your clients and any regulator. Read the data processing terms and run the four questions in the trust article before deciding.
Can I turn off training on ChatGPT Plus?
Yes, in each person's own settings. The firm cannot see or enforce it, which is why Business is the tier for a team even though the seat price is the same.
How long does ChatGPT keep my conversations?
Until someone deletes them. Deleted conversations are removed on a stated schedule, typically within thirty days, unless legal retention applies. Temporary chats are not saved. Confirm the current period in the terms.
Where does ChatGPT store company data?
In OpenAI's infrastructure in the United States by default. Storage in a chosen region is available on Enterprise, not Business.
Should I put client files into ChatGPT?
Only on a Business or Enterprise workspace, only after the data processing terms have been read, and only if you could explain to the client what happened to the file. If any of those is a no, use an anonymised copy or do not use the tool for that job.
Is Copilot or Gemini safer than ChatGPT for company data?
The business tiers of all three state they do not train on your inputs by default. The differences are in retention, storage region, admin controls and how each inherits your existing file permissions. Run the same four questions on whichever one you are considering.
What is the trust criterion?
One of four weighted criteria in the free method for choosing an AI tool. Twelve questions covering accuracy on real outputs, whether sources are real, what the vendor does with your data, and whether you could explain it to a client. It is at practicalmethods.ca/blog/ai-tool-data-privacy-checklist.
Criteria: Buying an AI Tool
Five articles. Narrowing, the job, the adoption, the trust, the deal.
Read the free methodThe list is not the decision. It is how you find the one or two things that are.
Not a review, not rankings, not software advice. A method.
