Automation & AI · Data safety
It can be, on the right plan with the right settings and clear rules for staff. Here is what happens to your data and what to change.
Where your prompts actually go
Settings to change today
A one-page staff rulebook
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time now. Or call 954-539-5678.
ChatGPT can be safe for business use, but not by default and not on every plan. On free and personal plans, OpenAI may use conversations to improve its models unless the user turns that off, and the company has no control over the account. On ChatGPT Business and Enterprise, OpenAI states that business data is not used for training by default, and admins get controls such as single sign-on and user management.
Most real risk does not come from the AI company. It comes from staff pasting client data into personal accounts, trusting wrong answers, and accounts with weak passwords. Fix those three and ChatGPT becomes a reasonable business tool.
When someone types a prompt or uploads a file, it is sent to OpenAI’s servers, processed, and the conversation is stored in the account’s history. What happens next depends on the plan and settings.
Conversations may be used to train models unless the user switches off the model-improvement setting in Data Controls. History is kept until the user deletes it. Temporary chats are not used for training and are removed after a short retention period, according to OpenAI.
OpenAI says it does not train on business inputs or outputs by default. The company owns and manages accounts, can require single sign-on, and Enterprise adds admin-set retention and more audit options.
Software that calls OpenAI’s API, or AI built into other products, follows the vendor’s own terms. Read them: the tool you buy decides where your data goes, not the AI model underneath.
Two things are true on every plan: the provider stores the conversation for some period, and anyone who gets into the account can read the history. Treat a ChatGPT login like an email login.
If your company runs Microsoft 365, compare this with Copilot Chat. Microsoft states that when staff sign in with a work account, prompts and responses get enterprise data protection and are not used to train its foundation models. For many offices that is the simplest approved option because it sits inside an account you already manage.
A quick self-check. If any of these are true, AI use in your company is happening without guardrails:
None of these need an expensive fix. They need an owner, an approved tool and a short rule set.
Do you know which AI accounts your staff use with company data? Shadow AI is one of the most common gaps we find. Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, automation and AI opportunities, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.
Policies fail when they are long. Give staff a single page with three tiers they can remember.
Public information, generic writing help, brainstorming, rewriting your own text without names or numbers, learning how to do something in Excel.
Internal documents, customer names, pricing, draft contracts, code, meeting notes. Only on the company’s business plan or Microsoft or Google AI signed in with a work account.
Passwords, card numbers, bank details, Social Security numbers, health records, anything under a client confidentiality agreement unless a specific approved tool covers it.
Add four habits:
For a business that handles health, legal or financial data, have counsel review the policy. HIPAA, bar rules and financial privacy rules add requirements this general guidance does not cover.
Not on consumer plans. OpenAI does not offer a business associate agreement for free, Plus or Pro accounts. It has said it can sign BAAs for some enterprise and API customers, but that is a contract you negotiate, not a setting you switch on. Without a BAA, keep protected health information out entirely. Our guide to HIPAA IT requirements for small practices covers the wider obligations.
A safe setup for a 25 to 100 person business usually looks like this: one approved AI tool on a business plan or inside Microsoft 365 or Google Workspace, single sign-on and multi-factor authentication, a one-page rulebook, offboarding that removes AI accounts with everything else, and a quarterly look at what people actually use. Our automation and practical AI and cybersecurity teams set this up as part of normal IT, not as a separate project.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
On personal plans, conversations may be used unless the user turns off model improvement in Data Controls. OpenAI states that ChatGPT Business, Enterprise and API data is not used for training by default.
Not in a legal sense. Conversations are stored by OpenAI for a period and can be read by anyone with access to the account. Keep regulated and confidential client data out unless an approved business tool and contract cover it.
Bans tend to push use onto personal phones where you have no control. Approving one business-grade tool, with clear rules, usually reduces risk more than a ban.
Passwords, payment card and bank details, Social Security numbers, health records and anything under a client confidentiality obligation, unless a specific approved tool covers that data.
Neither is safe or unsafe on its own. Microsoft states that Copilot Chat used with a work account has enterprise data protection, which makes it a convenient approved option for Microsoft 365 offices. ChatGPT Business offers similar no-training defaults.
