Vendor Privacy Scorecard · OpenAI
ChatGPT: is it safe for client information?
The most common AI assistant in small offices. The privacy picture changes completely between the personal plans and the business plans.
Bottom line
Safe for client work on ChatGPT Business (Team) or Enterprise with an approved-use policy. Personal Free and Plus accounts should not touch client or patient information.
Does it train on your data? By plan
Free and Plus (personal): Trains by default
Conversations can be used to improve models unless the user turns it off in Data Controls.
Business / Team: No training
Business data is not used for training by default.
Enterprise and Edu: No training
Not used for training. Admins control retention.
API platform: No training
Not used for training by default. Zero data retention is available to eligible customers.
What an auditor will ask
- Trains AI on your data? Depends on plan
- Personal plans train by default. Business, Enterprise and API do not.
- Retention you can control? Depends on plan
- Enterprise admins set retention. Zero data retention is available on the API for approved use cases.
- Signs a HIPAA BAA? Depends on plan
- OpenAI signs a BAA for Enterprise, Edu and eligible API customers through sales. Not available on Free, Plus or Team.
- Staff may read your content? Depends on plan
- Business content is reviewed only for abuse investigations under OpenAI's enterprise privacy terms.
Security certifications
- SOC 2 Type II
- ISO/IEC 27001
- ISO/IEC 27017
- ISO/IEC 27018
- ISO/IEC 27701
Set it up the safe way
- Buy ChatGPT Business or Enterprise for everyone who handles client information.
- Ban personal ChatGPT accounts for work in your Staff AI Acceptable Use Policy.
- If you handle health information, sign OpenAI's BAA before any patient data goes in.
- Save a copy of the business terms and the date you reviewed them.
OpenAI trust centerBusiness privacy terms
Summarized from OpenAI's published terms, last checked 10/1/2026. Vendors change terms. Confirm every point against the agreement you actually signed. This is not legal advice.
Using ChatGPT at work? An unvetted tool can cost you your license.
When an employee pastes client information or confidential files into ChatGPT without the correct safeguards, licensing boards and regulatory bodies hold you responsible. AI Governance Rule Watch™ documents your approved tool roster, vendor reviews, and staff guidelines in permanent diligence records ready for any audit.
Founding member rate. Cancel anytime. Plus applicable taxes. Renews until canceled. Not legal advice and not a compliance certification.