Does ChatGPT train on your data?
ChatGPT by OpenAIAI assistantsVendor's pages read on
It depends on the plan.
The vendor states that inputs are used for training by default on Free, Go, Plus and Pro (personal accounts). The vendor states that an opt-out is available. The vendor states that inputs are not used for training unless the customer opts in on ChatGPT Business (formerly Team) and ChatGPT Enterprise and Edu. Read on 12 Nov 2026. The plan your company actually holds, and any negotiated terms, decide what applies to you.
A summary of what the vendor publishes, not legal advice, not an assessment of the vendor and not an endorsement. How this page was made.
What the vendor states, plan by plan
| Plan | Trains on your data | Default retention | Human review of inputs | Single sign-on |
|---|---|---|---|---|
| Free, Go, Plus and Pro (personal accounts)Consumer / free | Yes by default; opt-out available | Kept until the user deletes it; removed within 30 days of deletion | Unknown | Unknown |
| ChatGPT Business (formerly Team)Team / business | Only if the customer opts in | Set by workspace admins; deleted or unsaved conversations removed within 30 days | Abuse monitoring only | Yes |
| ChatGPT Enterprise and EduEnterprise | Only if the customer opts in | Set by workspace admins; deleted conversations removed within 30 days | Limited (support, incidents or legal) | Yes |
“Unknown” means the vendor's page that would answer this was not read, or could not be opened. It does not mean “no”.
Free, Go, Plus and Pro (personal accounts)
On Free, Go, Plus and Pro (personal accounts), the vendor states that inputs are used for training by default and that an opt-out is available. Retention: kept until the user deletes it; removed within 30 days of deletion. Not verified: human review of inputs.
- Trains on customer data
- Yes by default; opt-out available
The policy links to instructions for opting out. Temporary Chats are not used to improve models.
“we may use Content you provide us to improve our Services, for example to train the models that power ChatGPT”
The vendor states this on openai.com, read on 12 Nov 2026
- Default retention
- Kept until the user deletes it; removed within 30 days of deletion
The policy lists exceptions, for example where retention is required for safety or legal reasons.
“Once you choose to delete Personal Data, we will remove it from our systems within 30 days”
The vendor states this on openai.com, read on 12 Nov 2026
- Zero-retention option
- Not stated
Temporary Chats are stated to be deleted automatically within 30 days.
Source: openai.com, read on 12 Nov 2026
- Deletion on request
- Yes
“You can delete or archive chats in ChatGPT, or delete your account entirely.”
The vendor states this on openai.com, read on 12 Nov 2026
Unknown for this plan: Human review of inputs; Single sign-on (SSO); SCIM provisioning; Audit logs; Admin console; Data residency options; Customer-managed keys.
ChatGPT Business (formerly Team)
On ChatGPT Business (formerly Team), the vendor states that inputs are not used for training unless the customer opts in. Retention: set by workspace admins; deleted or unsaved conversations removed within 30 days. The vendor states that people review inputs only to investigate abuse. Stated as available: SSO and an admin console.
- Trains on customer data
- Only if the customer opts in
Data is used for training only where the customer explicitly opts in, for example through feedback.
“By default, we do not use your business data for training our models.”
The vendor states this on openai.com, read on 12 Nov 2026
- Default retention
- Set by workspace admins; deleted or unsaved conversations removed within 30 days
“Any deleted or unsaved conversations are removed from our systems within 30 days, unless longer retention is required by law”
The vendor states this on openai.com, read on 12 Nov 2026
- Deletion on request
- Yes
“Workspace admins have control over workspaces and can view, access, export, and delete end user conversations in the workspace.”
The vendor states this on openai.com, read on 12 Nov 2026
- Human review of inputs
- Abuse monitoring only
Authorized employees may also access stored data for engineering support, abuse investigation and legal compliance.
“specialized third-party contractors who are bound by confidentiality and security obligations, solely to review for abuse and misuse”
The vendor states this on openai.com, read on 12 Nov 2026
- Single sign-on (SSO)
- Yes
“Enterprise-level authentication through SAML SSO”
The vendor states this on openai.com, read on 12 Nov 2026
- Admin console
- Yes
“Workspace admins have control over workspaces and can view, access, export, and delete end user conversations in the workspace.”
The vendor states this on openai.com, read on 12 Nov 2026
Unknown for this plan: Zero-retention option; SCIM provisioning; Audit logs; Data residency options; Customer-managed keys.
ChatGPT Enterprise and Edu
On ChatGPT Enterprise and Edu, the vendor states that inputs are not used for training unless the customer opts in. Retention: set by workspace admins; deleted conversations removed within 30 days. The vendor states that staff access to inputs is limited to listed cases such as support, incidents or legal requirements. Stated as available: SSO, SCIM, audit logs and an admin console.
- Trains on customer data
- Only if the customer opts in
Data is used for training only where the customer explicitly opts in, for example through feedback.
“By default, we do not use your business data for training our models.”
The vendor states this on openai.com, read on 12 Nov 2026
- Default retention
- Set by workspace admins; deleted conversations removed within 30 days
“Any deleted conversations are removed from our systems within 30 days, unless we are legally required to retain them.”
The vendor states this on openai.com, read on 12 Nov 2026
- Deletion on request
- Yes
“Any deleted conversations are removed from our systems within 30 days, unless we are legally required to retain them.”
The vendor states this on openai.com, read on 12 Nov 2026
- Human review of inputs
- Limited (support, incidents or legal)
The page also lists access where required by applicable law.
“Authorized OpenAI employees will only ever access your conversations for the purposes of resolving incidents, recovering end user conversations with your explicit permission”
The vendor states this on openai.com, read on 12 Nov 2026
- Single sign-on (SSO)
- Yes
“Enterprise-level authentication through SAML SSO”
The vendor states this on openai.com, read on 12 Nov 2026
- SCIM provisioning
- Yes
“Admin features such as domain verification, SSO, SCIM, and usage insights.”
The vendor states this on help.openai.com, read on 12 Nov 2026
- Audit logs
- Yes
“workspace admins can access an audit log of conversations and GPTs through the Enterprise Compliance API”
The vendor states this on openai.com, read on 12 Nov 2026
- Admin console
- Yes
“Fine-grained control over access and available features”
The vendor states this on openai.com, read on 12 Nov 2026
Unknown for this plan: Zero-retention option; Data residency options; Customer-managed keys.
Attestations and company facts the vendor states
- SOC 2 Type II
- Yes
“ChatGPT Business successfully completed a SOC 2 Type 2 audit.”
The vendor states this on openai.com, read on 12 Nov 2026
- ISO/IEC 27001
- Yes
Stated scope: the OpenAI API, ChatGPT Enterprise and ChatGPT Edu.
“OpenAI maintains ISO/IEC 27001:2022 and ISO/IEC 27701:2019 certifications”
The vendor states this on openai.com, read on 12 Nov 2026
- ISO/IEC 42001
- Yes
“OpenAI maintains an ISO/IEC 42001:2023 AI Management System covering OpenAI's consumer and business AI products and models”
The vendor states this on openai.com, read on 12 Nov 2026
- HIPAA BAA available
- Yes
Stated for the API Platform; ChatGPT for Healthcare is described separately.
“We are able to sign Business Associate Agreements (BAA) in support of customers' compliance with the Health Insurance Portability and Accountability Act (HIPAA).”
The vendor states this on openai.com, read on 12 Nov 2026
- GDPR DPA available
- Yes
“we are able to execute a Data Processing Addendum (DPA) with customers for their use of ChatGPT Business, ChatGPT Enterprise, and the API”
The vendor states this on openai.com, read on 12 Nov 2026
- Data processing location
- Servers in various jurisdictions (see source)
“on servers located in various jurisdictions”
The vendor states this on openai.com, read on 12 Nov 2026
“Yes” means the vendor's page says so, with the page linked. GhostAudit has not audited the vendor. Scope by product is on the vendor's page.
What remains unknown
- Human review of inputs
- Single sign-on (SSO)
- SCIM provisioning
- Audit logs
- Admin console
- Data residency options
- Customer-managed keys
- Zero-retention option
- FedRAMP
- Company headquarters
- Model providers used
None of these was guessed, inferred from another vendor or filled from memory. Ask the vendor, using the list below.
- Trains by default on the consumer plan. Applies to: Free, Go, Plus and Pro (personal accounts). Employees using personal accounts are on these terms.
How to check ChatGPT in your own company
- 01Find out which plan each account is on. The vendor's terms differ between Free, Go, Plus and Pro (personal accounts), ChatGPT Business (formerly Team) and ChatGPT Enterprise and Edu. People who signed up with a personal address are on the personal terms, whatever the company bought.
- 02Open the account or administrator settings and look for the data-controls or model-training setting the vendor's page describes. Note what it is set to today and who is able to change it.
- 03Read the vendor's own page, linked under each fact below, and check that the sentence quoted here is still there. Pages change; the date shows when this one was read.
- 04Compare with your contract or order form. Where a data processing agreement or negotiated terms exist, they take precedence over the public pages.
- 05Record the plan, the setting and the date in your AI inventory, so that the answer exists the next time a customer or auditor asks.
What to ask the vendor
Neutral questions for the points the vendor's public pages left open. Ask for the answer in writing.
- 01Is a zero-retention option available on our plan, and what does it exclude (for example abuse monitoring logs)?
- 02Can your staff or contractors read our inputs? In which cases, and is that access logged?
- 03Is single sign-on available on our plan, and can sign-in with personal accounts be blocked for our domain?
- 04Is SCIM provisioning available, so that leavers lose access automatically?
- 05Are audit logs available to administrators, and can they be exported to our security tooling?
- 06Is there an administrator console where data controls can be set for every account in our organisation?
- 07Where is our data processed and stored, and can a region be chosen?
- 08Can we hold the encryption keys for our data?
- 09Which third-party model providers process our inputs, and under what retention and training terms?
- 10Do the statements on your public pages apply to our contract as written, or do negotiated terms override them?
Questions about ChatGPT
- Does ChatGPT train on your data?
- It depends on the plan. The vendor states that inputs are used for training by default on Free, Go, Plus and Pro (personal accounts). The vendor states that an opt-out is available. The vendor states that inputs are not used for training unless the customer opts in on ChatGPT Business (formerly Team) and ChatGPT Enterprise and Edu. Read on 12 Nov 2026. The plan your company actually holds, and any negotiated terms, decide what applies to you.
- Is ChatGPT safe to use at work?
- GhostAudit does not rate tools. Whether ChatGPT is acceptable for your company depends on the plan you hold, the data people put into it and your own policy. This page records what the vendor states, with the wording and the source, so that decision can be made on facts: Free, Go, Plus and Pro (personal accounts): yes by default; opt-out available, ChatGPT Business (formerly Team): only if the customer opts in and ChatGPT Enterprise and Edu: only if the customer opts in (training on customer data).
- How long does ChatGPT keep data?
- The vendor states: Kept until the user deletes it; removed within 30 days of deletion. This is the default the vendor's page describes for one plan; other plans may differ, and the table on this page shows each.
- Which attestations does the vendor of ChatGPT state?
- The vendor's pages state: SOC 2 Type II, ISO/IEC 27001, ISO/IEC 42001, HIPAA BAA available and GDPR DPA available. This is the vendor's statement, with the page linked; GhostAudit has not audited the vendor, and the scope by product is on the vendor's page.
- When were these facts checked, and how do I report an error?
- The vendor's pages were read on 12 Nov 2026. Every quotation was checked against the stored text of its source page on that date. To report an inaccuracy, email [email protected] with the page that shows the current wording.
How this page was made, and how to correct it
Every fact above is a statement found on a page OpenAI itself publishes. The page was fetched and reduced to text, the statement was recorded with its exact wording, and the quotation was checked against the stored text of the page. Quotations are at most 25 words. Search results, blogs and third-party summaries were not used.
These are summaries of statements the vendor publishes, as read on the date shown. They are not legal advice, not an assessment of the vendor and not an endorsement. Vendors change their terms: open the linked source and check your own contract before you rely on a statement.
Found an error, or are you the vendor? Report an inaccuracy with the page that shows the current wording. The page is re-read; the fact, its quotation and its date are corrected, or the fact is set to unknown if the page cannot be opened. The full method.
The vendor's official pages
- Privacy policyopenai.com
- Termsopenai.com
- Data processing agreementopenai.com
- Subprocessorsopenai.com
- Trust centretrust.openai.com · not readable automatically
ChatGPT is a product of OpenAI. GhostAudit is not affiliated with, endorsed by or sponsored by OpenAI.
Is ChatGPT in use at your company, and on which plan?
GhostAudit shows which AI tools your people use, from Google Workspace or Microsoft 365 and from the browser, and sets each one beside the terms on this page. It records tool names and time, never prompts.