Guides › Platform knowledge features
Using the Knowledge Features in ChatGPT, Claude, Copilot and Gemini Safely: Projects, Custom GPTs, Copilot Studio and Gems
Every major assistant now ships a way to hand it a pile of documents and keep them: ChatGPT Projects and custom GPTs, Claude Projects, Copilot Studio knowledge sources, Gemini Gems and Gemini Notebook. Each one is a knowledge base built in minutes by whoever had the files, and each one carries the questions a knowledge base always carries: who can reach what was uploaded, how long it is kept, what the provider does with it, and whether the source permissions survived the upload. This page answers those questions platform by platform from each vendor's own documentation as of October 2026, names the three gaps they share, and gives the rules for using them with sensitive data.
Why an uploaded file is a knowledge base
The moment a document is uploaded to a Project, a GPT, a Gem or a Copilot Studio agent, two things happen that the person uploading rarely thinks about. A second copy of the document now exists inside the platform, under the platform's retention rules rather than the source system's. And the permission model that governed the original, the SharePoint site membership or the drive's sharing list, did not travel with it. Whoever the feature is shared with can now reach the content, whether or not they could have opened the original. On paid plans with large uploads the platform typically switches to retrieval over the files, which makes the feature a RAG system in the sense the AI knowledge base security guide uses, with the same four failure modes and none of the controls a built knowledge base would carry.
None of this makes the features unsafe. It makes them a specific kind of thing, a small knowledge base with a sharing model and a retention clock, and the rules for sensitive data follow from that.
Platform by platform
The table summarizes what each vendor states about its own feature. Terms change and vary by plan; the sources at the end are the documents these rows were read from, and the contract is the authority.
ChatGPT Projects and custom GPTs
Project files are retained until the project or the file is deleted or a workspace retention policy removes them, and that applies to shared projects as well; after deletion, OpenAI schedules permanent deletion within 30 days subject to security and legal requirements. Custom GPT knowledge files are retained until the GPT is deleted, on the same 30-day schedule afterward. Enterprise, Edu and Healthcare workspaces apply their retention policy to Library files, and Library files are reachable through Compliance API endpoints while active. Business, Enterprise and Edu workspace content is excluded from training by default. The caveat specific to custom GPTs is old and still relevant: with the code interpreter enabled, users of a GPT have been able to ask it to hand over the files its creator uploaded, which is why OpenAI shows a warning on upload. Treat a GPT's knowledge files as readable by everyone the GPT is shared with.
Claude Projects
Project knowledge is the set of files, text and code uploaded to a project; on paid plans, when the knowledge approaches the context limit Claude switches to retrieval over it, expanding capacity by up to ten times, which is the point at which a project becomes a retrieval system. On Team and Enterprise plans a project can be private, shared with named members or groups, or shared organization-wide, with view and edit permission levels; Owners can turn off sharing and public projects, and Enterprise can turn sharing off for specific roles. On Enterprise plans data is retained indefinitely unless an Owner sets a custom retention period of at least 30 days, projects are retained indefinitely by default, and a project's retention governs the chats inside it. Anthropic's commercial terms exclude customer content from training.
Copilot Studio knowledge sources
Copilot Studio agents draw on five kinds of knowledge: public websites searched through Bing, uploaded documents stored in Dataverse, SharePoint, Dataverse tables, and enterprise data indexed by Microsoft Search through connectors. For SharePoint, Dataverse and connectors, Microsoft's documentation states that agent user authentication means the agent only surfaces content the specific user can access, which is the right model and requires that authentication actually be configured. Uploaded documents are the exception: the documentation lists their authentication as none, so a file uploaded to an agent is reachable by anyone who can use the agent. Two settings deserve attention. Allowing ungrounded responses lets the agent answer from general model knowledge, and Microsoft notes that turning it off does not guarantee general knowledge is never used. Marking a source as official tells users to skip the caution they would otherwise apply.
Gemini Gems and Gemini Notebook
For Gemini in Workspace, Google states that customer data is not used to train models without the customer's permission, that Gemini only retrieves Workspace content the user has access to, and that prompts and responses are retained for 90 days to indefinitely as administrators decide; the Gemini app retains for up to 36 months with an 18-month default. Gems get admin controls for sharing and little published detail on storage. Gemini Notebook, formerly NotebookLM and now a core Workspace service, is the one to read carefully: it copies Drive files into its own storage rather than leaving them in Drive, the organization's file sharing and data region settings do not apply to data inside it, it is not integrated with Workspace DLP, and Google lists it as outside its ISO, SOC, FedRAMP and HIPAA BAA coverage. Administrators can block Drive files from being uploaded to it with Information Rights Management.
Rules for using them with sensitive data
Six rules follow from the table and the gaps, and they fit in a policy. Treat every upload as a new copy with the feature's sharing scope as its permission model, and share only as widely as the most sensitive document in it allows. Upload nothing from a regulated category, meaning personal data, health or financial records, controlled unclassified information, export-controlled data or secrets, to a feature run by a third party unless the identifiers have been substituted first or the contract and residency specifically cover that category. Prefer connected sources that run as the user over uploaded files, because the connected source keeps the source's permissions and the upload does not. Set retention at the workspace level and treat the platform default, which on several of these is indefinite, as a decision someone has to make. Record which features are approved for which data classes in the acceptable use policy. And audit periodically what has been uploaded and shared organization-wide, because the features make that easy and nothing else does.
When a knowledge feature is enough, and when it isn't
The features are the right tool for a bounded, low-sensitivity corpus owned by one team: a product manual, a style guide, a set of public filings. They are the wrong tool when the corpus spans permission boundaries, when it holds regulated identifiers and the model is a third party's, when anyone needs to know afterward which documents were retrieved for whom, or when the corpus is large and changes, because a copy goes stale the day it is made. The second set of cases is what a governed knowledge base is for, and the build procedure and connection procedure cover the two ways to get one.
Where Hardshell sits
Hardshell is the layer that turns a connected source into a governed one. It connects to the systems where data already lives without copying them into a platform, inherits their permissions and limits each retrieval to what the requesting user is entitled to see, substitutes stand-ins for real identifiers before content reaches ChatGPT, Claude, Copilot or Gemini, and records every retrieval under opaque IDs. For teams that have outgrown uploads, it is the route that keeps the assistant and removes the copy, and it deploys as a cloud service, in a private cloud or as an offline bundle.
Frequently asked questions
Are files uploaded to ChatGPT Projects used for training?
On Business, Enterprise and Edu workspaces, OpenAI states that workspace content is excluded from training by default. On consumer plans the answer depends on the account's training setting. The files are retained until the project or file is deleted or a workspace retention policy removes them, and shared projects are covered by the same rule.
Can other employees see my Claude Project?
Only if it is shared. On Team and Enterprise, projects are private by default and can be shared with named members, groups, or the whole organization at view or edit level. Owners can disable sharing and public projects, and Enterprise can disable sharing for specific roles. A project shared organization-wide is readable by everyone in it regardless of whether they could open the original files.
Does Copilot Studio respect SharePoint permissions?
For SharePoint, Dataverse and connector sources, yes, when agent user authentication is configured: Microsoft states the agent only surfaces content the specific user can access. Uploaded documents are different; the documentation lists no authentication for them, so they are reachable by any user of the agent.
Is Gemini Notebook (NotebookLM) safe for confidential documents?
Google's own documentation says it copies Drive files into its own storage, that the organization's sharing and data region settings do not apply inside it, that it is not integrated with Workspace DLP, and that it sits outside Google's ISO, SOC, FedRAMP and HIPAA BAA coverage. For regulated or export-controlled content that combination is disqualifying; for public or low-sensitivity material it is fine. Administrators can block uploads with Information Rights Management.
Can users download the knowledge files in a custom GPT?
With the code interpreter enabled, users have been able to get a GPT to hand over its creator's uploaded files, and OpenAI shows a warning at upload for this reason. Treat GPT knowledge files as readable by everyone the GPT is shared with, and keep regulated content out of them.