Guides › ChatGPT Enterprise review

ChatGPT Enterprise Security Review Checklist: What to Confirm Before Approving It for Company Data

Hunter Moore, Founder and CTO · Updated October 18, 2026

A ChatGPT Enterprise security review settles seven things: that workspace content is excluded from training, how long chats and files are retained and who sets it, where data is stored and inferred, how identity and roles are enforced, which connectors and apps are enabled and under whose permissions, how custom GPTs and projects can be shared, and what compliance logging the workspace exports. OpenAI publishes an answer to each of these, several of them gated by eligibility or configuration, and the review's job is to confirm which answers apply to your contract and to turn them into settings before anyone pastes a customer record. This checklist lists the questions, what a good answer looks like as of October 2026, where to confirm it, and the three exposures no workspace setting closes.

The review in four lines

Contractual floor. Training exclusion is the default on Enterprise; retention, residency and the compliance platform depend on eligibility and configuration. Get the ones you rely on in writing.
Identity first. SSO enforced, SCIM for provisioning, automatic account creation off for verified domains, a default role that is not Owner.
Connectors and GPTs are the data path. Decide which apps are enabled on day one, who can share GPTs with whom, and treat every synced source as a second copy of your data.
What settings don't fix. Over-permissioned sources behind the connectors, identifiers that cross in every prompt, and employees on personal accounts.

Scope the review to the tier you are buying

OpenAI's commitments differ by tier, and most review failures start by reading the wrong page. Consumer ChatGPT is governed by consumer terms, under which training on conversations depends on the account setting; nothing below applies to it, which is the first thing to write in the review, because employees already have those accounts. ChatGPT Business, Enterprise, Edu and Healthcare and the API platform run under commercial terms and a data processing addendum. Within those tiers several commitments are described as available to “eligible” or “qualifying” customers: data residency, the Compliance Platform, Enterprise Key Management and healthcare BAAs among them. The policy page describes what exists; the order form describes what you have. The provider policy comparison sets ChatGPT beside Claude, Copilot and Gemini on the same questions if the review covers more than one platform.

The checklist

Each row is a question the review should answer in writing, the answer OpenAI's documentation supports as of October 2026, and where to confirm it. Rows marked configuration are settings an Owner has to make; rows marked contract need to appear in the agreement.

Area	Question	What OpenAI's documentation supports (October 2026)	Confirm in
Training	Is workspace content used to train models?	Excluded by default on Business, Enterprise, Edu, Healthcare and the API; opt-in via the API dashboard.	Contract (as a term, not a setting)
Retention	How long are chats and files kept, and who sets it?	Deleted chats purged within 30 days; temporary chats up to 30 days; project, GPT and Library files until deleted or a workspace retention policy removes them. Qualifying organizations configure the period.	Configuration and contract
Residency	Where is data stored, and where is it inferred?	At rest in U.S., Europe, UK, Japan, Canada, South Korea, Singapore, Australia, India or UAE for eligible customers; in-region inference in the U.S. and Europe. Separate commitments.	Contract
Identity	How do users sign in and get provisioned?	SSO via the identity provider, optionally mandatory; tenant-wide SCIM for users and groups; domain verification with automatic account creation off when SCIM is used.	Configuration
Roles	What can a default member do?	A default workspace role plus role-based access control for targeted feature access; Owners decide which capabilities are available on day one.	Configuration
Apps and connectors	Which sources can the assistant reach, under whose permissions?	Source permissions apply through connectors; Microsoft sources need Graph consent from an Entra admin; synced sources keep a separate index; custom apps and MCP connectors are not verified by OpenAI. New Enterprise workspaces start with a selected set of apps enabled.	Configuration, plus your oversharing audit
GPTs and projects	Who can share what with whom?	Groups control access to shared GPTs; GPT knowledge files are readable by everyone the GPT is shared with; project files follow workspace retention.	Configuration and policy
Compliance logging	What can security and legal export?	Compliance Logs Platform and Stateful Compliance API for audit, SIEM, eDiscovery and DLP; IP allowlisting for the API. Eligible Enterprise and Edu workspaces.	Contract and configuration
Encryption and keys	Can we hold the keys?	Enterprise Key Management for customer-managed encryption where available.	Contract
Certifications and healthcare	What attestations and agreements exist?	SOC 2 Type 2, ISO/IEC 27001, 27017, 27018, 27701, CSA STAR; BAA for ChatGPT for Healthcare and API healthcare customers.	Trust portal and contract
Network	Can access be restricted to corporate networks?	IP allowlisting for the workspace and the Compliance API.	Configuration

Configuration before go-live

OpenAI's admin quickstart lays out the workspace controls in roughly the order they should be set, and the sequence below follows it with the security decisions made explicit. Each step is a setting in the admin console or an item on the order form; none requires custom work.

Verify the domain and enforce SSO.Make SSO mandatory for eligible users and turn off automatic account creation if SCIM will manage access.
Provision with SCIM and set the default role.Sync groups, assign them to the workspace, and choose a default role with the narrowest feature access the pilot needs.
Set retention at the workspace.Choose the period, confirm it covers project, GPT and Library files, and record the deletion schedule.
Decide the day-one app and connector list.Start narrow. For each connector, require the oversharing audit result for its source before enabling it.
Allow-list OAuth and GPT action domains.Review enabled apps, write or open-world actions and allowed domains on a schedule, as the quickstart recommends.
Write the GPT and project sharing policy.Which groups may share, which data classes may be uploaded, and who audits organization-wide shares.
Connect the Compliance API.Route logs to the SIEM or eDiscovery tool, restrict the API by IP, and name who reviews them.
Run the refusal test.Under sample identities, ask the assistant for things it should not have, count what it returns, and keep the number with the approval.

Custom GPTs, projects and connectors deserve their own section

These three features are where company data actually moves, and the review tends to spend its time on retention clauses instead. A custom GPT's knowledge files are readable by everyone the GPT is shared with, and with the code interpreter enabled users have been able to get a GPT to hand over its creator's uploaded files, which is why OpenAI warns at upload. Group-based sharing controls limit who can reach a shared GPT; they do not change what the GPT holds. Project files follow the same rule as GPT files: retained until deleted or removed by a workspace retention policy, and shared projects are readable by every member whether or not they could open the originals. The platform knowledge features page covers what each feature keeps and who can reach it.

Connectors are the larger surface. OpenAI states that source permissions still apply through connectors, which is true and describes your tenant rather than the product: a SharePoint connector reaches whatever the user's identity can open, which in most tenants is far more than intended. Synced sources maintain a separate index of administrator-selected content, which is a second copy with its own permission snapshot and retention clock. Custom apps and MCP connectors are not verified by OpenAI. The review should therefore require an oversharing audit of each source before its connector is enabled, a named owner for each synced index, and an allow-list of OAuth and GPT action domains, all of which the quickstart recommends auditing on a schedule. The connection procedure gives the eight-step version.

Evidence to keep

An approval that cannot be reconstructed later is a liability. Keep the order form clauses on training, retention, residency and the compliance platform; a screenshot or export of the workspace settings for SSO, SCIM, default role, retention and enabled apps with the date; the connector inventory with the oversharing finding and owner for each source; the GPT sharing policy; the Compliance API integration record showing where logs land and who reads them; and the refusal-test result from the leakage self-test for any connected source. Map each item to the framework you report against using the crosswalk.

What the review cannot settle

Three exposures survive a perfectly configured workspace. The permissions behind every connector are yours, and the connector inherits all of them; only an audit and remediation of the sources changes that. The identifiers in every prompt, upload and retrieved chunk cross to OpenAI as written, under training exclusion and the retention window you negotiated but across the boundary nonetheless, which is the question a regulator asks first. And the commercial terms attach to the workspace, so an employee on a personal account is covered by none of them. The keep-sensitive-data guide covers the controls that address all three, and the Claude Enterprise and Microsoft 365 Copilot checklists apply the same structure to the other two platforms most reviews cover.

Where Hardshell sits

Hardshell governs the data path the workspace settings do not. It connects enterprise data to ChatGPT without migrating it, enforces each user's existing permissions at query time so over-permissioned sources do not become answers, substitutes stand-ins for real identifiers before content reaches OpenAI, and records every retrieval under opaque IDs. Before rollout it tests what the assistant can be made to disclose and maps each finding to MITRE ATLAS technique IDs. It deploys as a cloud service, in a private cloud, or as an offline bundle.

Frequently asked questions

Does ChatGPT Enterprise use our data for training?

OpenAI states that Business, Enterprise, Edu, Healthcare and API data is excluded from training by default, with an opt-in available through the API dashboard. Consumer accounts are governed separately and depend on the account's setting.

How long does ChatGPT Enterprise keep our chats and files?

Deleted chats are scheduled for permanent deletion within 30 days, temporary chats may be kept up to 30 days for safety, and project, GPT and Library files persist until deleted or removed by a workspace retention policy. Qualifying organizations configure the retention period; set it, because the file default is until deleted.

Can we keep ChatGPT Enterprise data in a specific region?

OpenAI offers storage at rest in ten regions for eligible Enterprise, Edu, Healthcare and API customers, with in-region inference available in the United States and Europe. Storage and inference residency are separate commitments; confirm both for your region and have them written into the agreement.

What compliance logging does ChatGPT Enterprise provide?

The Compliance Logs Platform and a Stateful Compliance API expose conversation and app-activity records for audit, SIEM, eDiscovery and DLP workflows, for eligible Enterprise and Edu workspaces. IP allowlisting can restrict access to the Compliance API. The logs record what users did in the workspace; they do not compare retrievals against what the user was entitled to see.

Is it safe to enable the SharePoint or Google Drive connector in ChatGPT Enterprise?

The connector runs under the user's existing permissions, so it is as safe as those permissions are accurate. Audit each source for oversharing under sample identities before enabling it, treat any synced source as a second copy with its own owner, and keep regulated identifiers out unless substitution is in place.

Who can see the files in a custom GPT?

Everyone the GPT is shared with, and with the code interpreter enabled users have been able to extract the uploaded knowledge files. Use groups to limit sharing, keep regulated content out of GPT knowledge, and record which GPTs are approved for which data classes in the acceptable use policy.

Sources (accessed October 2026)

OpenAI Help Center, ChatGPT Enterprise admin quickstart; Chat and file retention in ChatGPT; Admin controls, security, and compliance in connectors. OpenAI, Business data privacy, security, and compliance; New compliance and administrative tools for ChatGPT Enterprise. The Decoder, report on custom GPT knowledge file downloads, November 2023.