Guides › Is company data safe in AI

Is It Safe to Put Company Data in ChatGPT, Claude or Copilot?

It depends on three things, and only three: which plan tier the data goes into, what kind of data it is, and which route it takes to get there. On a consumer plan, assume anything you type may be retained and, depending on the provider and your settings, used for training. On a business or enterprise plan, the provider's terms improve considerably and the risk moves to your side of the boundary: what your people and connectors send, and what your own permissions allow. This page gives a direct answer for each combination, explains what the provider actually receives, names the three things an enterprise plan does not change, and ends with a decision rule you can hand to a team.

The short answer, by plan tier

The tier decides the contract. Consumer plans, the free and individual paid tiers of ChatGPT, Claude and Gemini, are governed by consumer terms, and on some of them training on your conversations is the default or an opt-in that also extends retention. Business, Team and Enterprise plans from OpenAI, Anthropic, Microsoft and Google exclude customer content from training by default, define a retention window, give administrators controls and audit records, and in some cases offer a zero-data-retention option for qualifying workloads. API access with zero data retention narrows persistence further. A self-hosted or private-cloud model removes the provider from the picture for inference and leaves every other question in place.

The table puts verdicts on each tier. They assume the vendors' published terms as of October 2026, which change; the current contract is the authority, and the data sovereignty guide explains why terms alone are not the control.

What the provider actually receives

People picture the risk as the sentence they typed. The sentence is the smallest part. A provider receives the typed prompt; any file uploaded with it, in full, including the parts the user didn't read; whatever a connector or retrieval step pulled in as context, which on an enterprise plan with SharePoint or Drive connected can be entire documents the user never opened; tool and agent results; stored memory and prior conversation history; and metadata about the account, device and session. All of it is processed by the model and most of it is held for whatever retention window the tier specifies, which on business tiers commonly includes a short window for abuse monitoring even when conversation history is turned off. Zero data retention shortens persistence. The data still crosses, is still processed, and is still visible to the provider's systems at inference time.

The channel that surprises security teams is the connector. A user asking Copilot or ChatGPT to “summarize what we know about the Northfield account” doesn't paste anything. The assistant retrieves the contract, the emails and the CRM record itself, under that user's identity, and sends them to the model. The user's judgment about what to share never entered the picture. The third-party platforms guide tabulates every channel; the connection procedure covers how to govern the connector route.

Three things an enterprise plan does not change

What crosses

Enterprise terms govern what the provider does after data arrives: no training, a retention window, access limited to specified staff, audit logs. They don't change what arrives. A customer's name and account number sent as context under an enterprise plan is still a customer's name and account number held by a third party. Whether that is acceptable depends on the data category and your obligations, which is the subject of the decision table below.

What your own permissions allow

Every major assistant states that it respects existing permissions, and it does. Microsoft's documentation says Copilot can only summarize or reference content the user is authorized to access; OpenAI and Anthropic say the same of their connectors. In most organizations what people are technically authorized to open is far broader than what they were meant to see, because data silos and the friction of finding things did the real access control for years. The assistant removes the friction and inherits the permissions as they are. An enterprise plan does nothing about this, and it is where most of the actual exposure sits.

Personal accounts

The enterprise contract covers the enterprise workspace. An employee who pastes a document into a personal account on the same provider is under consumer terms, and no setting in the admin console reaches that account. Blocking the consumer domains at the network edge catches the office network and nothing else. The durable fix is a sanctioned assistant that is at least as useful as the personal one, plus the controls below.

A decision rule by data type

The table below is the rule most organizations end up with once they have worked through the tiers and channels. Columns are routes; rows are data categories. “Scoped and substituted” means the assistant reaches data through a layer that limits retrieval to what the asking user is entitled to see and replaces real identifiers with stand-ins before anything reaches the provider, with the real values restored only for an entitled reader. That route is what makes the regulated rows workable on a frontier model without self-hosting.

What to do before you say yes

Four things, in order. Move everyone onto a business or enterprise workspace and turn the consumer accounts into a policy violation with a sanctioned alternative, because the contract is the floor. Classify the sources the assistant will reach by the most sensitive category they contain, because the category decides the route. Audit the permissions on those sources under real user identities before any connector goes live, because the assistant's reach is whatever that audit finds. Then put a layer between the data and the model that scopes retrieval to the asker, substitutes identifiers before the boundary, and records every retrieval, and measure the leakage rate before widening the rollout. The eight-step procedure expands each of these.

Three pages carry the detail behind this one. The provider comparison sets out what OpenAI, Anthropic, Microsoft and Google each state about training, retention, zero data retention and residency. The DLP and shadow AI page explains why blocking the consumer tools fails and what the personal-account numbers look like. The acceptable use policy template turns the decision table above into something a team can adopt.

Where Hardshell sits

Hardshell is the layer in the last step. It connects to the systems where data already lives without migrating them, inherits their permissions, limits each retrieval to what the requesting user is entitled to see, substitutes stand-ins for real identifiers before content reaches ChatGPT, Claude, Copilot or any other provider, and records every retrieval under opaque IDs. Exposure testing gives a leakage number before rollout, with findings mapped to MITRE ATLAS technique IDs. It runs as a cloud service, in a private cloud, or as an offline bundle, so the regulated rows of the table above have a route that keeps frontier model capability.

Frequently asked questions

Does ChatGPT train on my company's data?

On Business, Enterprise and Edu workspaces, OpenAI states that workspace content, including data reached through connectors, is excluded from training by default. On consumer plans, training on conversations depends on the account setting and may be on by default. Anthropic states that it does not train on connector data and that business plans exclude customer content from training. Confirm the current terms in your contract rather than on a policy page, because both change.

Is Copilot safer because it runs inside Microsoft 365?

It is safer on the provider side, because interaction data stays within the Microsoft 365 service boundary under your tenant's existing compliance controls. It is not safer on the permissions side, and is arguably riskier, because it reaches every SharePoint site, mailbox and Teams channel the user's identity can open by default. Microsoft's own oversharing guidance, and the fact that it shipped a 100-site allow-list as a stopgap, describe the size of that problem.

Is it safe to paste customer data into ChatGPT or Claude?

On a consumer plan, no. On an enterprise plan, it is permitted by the contract and still sends the customer's identifiers to a third party, which for personal data, health or financial records may conflict with your obligations under GDPR, HIPAA, GLBA or state privacy law regardless of the provider's terms. Substitution before the boundary is the route that keeps the model and removes the identifiers.

What about source code?

Code is business-confidential and often contains embedded secrets, which are the one category that should never cross on any tier. Enterprise plans handle the confidentiality question contractually. Strip credentials, keys and connection strings before anything is pasted or connected, and treat a repository connector the same way as a document connector: audit what it can reach first.

Is self-hosting the only truly safe option?

Self-hosting an open-weight model is the cleanest answer to the provider question and leaves the permissions question exactly where it was: a self-hosted assistant over over-permissioned sources shows people documents they were never cleared to see. For organizations whose obligations require it, the sovereign AI deployment page compares on-prem, private cloud and disconnected options. For everyone else, scoped retrieval with substitution gets most of the way there on a frontier model.