Is It Safe to Put Company Data Into ChatGPT?

Safety is not a question about ChatGPT, Claude, Copilot or Gemini. It is a question about which tier of that product your staff are logged into. Consumer tiers, the free apps anyone can sign up for with a personal email, default to training on your conversations and route a slice of them to human reviewers. Business and API tiers of the same vendors carry contract language that excludes your content from training. The product name on the login screen tells you almost nothing; the tier does.

Does OpenAI train on data sent through the API?

No, not by default, and this has been the position since 1 March 2023. OpenAI’s current API documentation states that data sent to the API is not used to train or improve its models unless you explicitly opt in. Abuse-monitoring logs are kept up to 30 days by default, and the standard chat and response endpoints run with no retention beyond that.

Here is the honest gap: openai.com and help.openai.com block automated retrieval, so the training and retention terms for ChatGPT Business, Enterprise and Edu could not be verified from a primary source for this article. Only the API position above is confirmed here. If your team uses ChatGPT Business or Enterprise, check the training toggle in your own admin console rather than trust a blog post, ours included.

Zero Data Retention is available to approved customers who qualify, though it does not extend to abuse-monitoring log content. OpenAI’s trust page lists SOC 2 Type 2, ISO/IEC 27001:2022 and ISO/IEC 42001:2023 across ChatGPT Business, Enterprise and the API, with the latest SOC 2 report covering 1 January to 30 June 2025.

Does Claude train on your conversations?

It depends on which Claude. Anthropic’s Commercial Terms of Service, effective 17 June 2025, state in Section B that Anthropic may not train models on Customer Content from its commercial Services. That is a flat contractual prohibition, not a toggle you have to remember to flip.

The consumer product runs the opposite default. Under Anthropic’s Consumer Terms of Service, effective 8 October 2025, Anthropic may use your chats to improve its services, including training, unless you opt out in account settings.

Anthropic’s Privacy Center article on model training, last updated 1 July 2026, adds a detail worth knowing before you opt in: if you allow chats to improve Claude, that data can be retained in de-identified form for up to five years inside the training pipeline. That scope is Free, Pro and Max only. Claude for Work and the Anthropic API are explicitly excluded from it.

Is Microsoft Copilot different from the underlying models?

Yes, and the difference matters more than the vendor name. Microsoft Learn’s page on Microsoft 365 Copilot privacy, updated 18 August 2026, states that Copilot prompts, responses and the Graph data Copilot reads are not used to train the underlying foundation models. Abuse monitoring with human review exists for Azure OpenAI, but Microsoft states Copilot services are opted out of it.

Copilot’s real exposure is not training. It is permissions. Copilot only surfaces documents and messages the requesting user already has view access to, so a file over-shared in SharePoint or Teams becomes a Copilot answer the moment someone asks the right question.

The counter-intuitive part for EU buyers: Copilot is covered by the EU Data Boundary, but Microsoft’s own documentation currently excludes Anthropic, used as a subprocessor, from that boundary. If your Copilot deployment touches Anthropic models, ask your Microsoft rep where that processing actually happens before you assume “EU Data Boundary” covers the whole stack.

What about raw Azure OpenAI and Azure AI Foundry?

Separately governed Microsoft Learn documentation on Foundry Models data privacy, updated 5 June 2026, states that prompts and completions are not available to the model provider and are not used to train foundation models without customer permission. The models are stateless: nothing from your prompt is stored inside the model itself.

Abuse-monitoring review is automated by default, with human review by authorised Microsoft employees as necessary, located in the EEA for EEA deployments. Approved customers can request modified abuse monitoring with no data storage and no human review, verifiable by a ContentLogging: false flag on the resource.

One more detail worth knowing before you pick a region: a “Global” deployment can process your prompts in any geography where that model runs, while a “DataZone” deployment confines processing to your chosen zone. Data at rest, in both cases, stays in the geography you designated. Throughput and latency, not privacy exposure, are usually the reason teams pick Global, so check which one your deployment actually uses.

Why does Google give two different answers?

Because Google runs two different products under the Gemini name, and their August 2026 privacy pages, updated four days apart, say opposite things. The Gemini Apps Privacy Hub, updated 10 August 2026, tells users plainly: “Please don’t enter confidential information that you wouldn’t want a reviewer to see.” A subset of consumer chats is reviewed by human reviewers, including Google’s trained service providers, and reviewed conversations are retained up to three years, disconnected from the account. Default activity retention is 18 months, adjustable to 3 or 36.

The Workspace privacy hub, updated 14 August 2026, states the reverse: “Your content is not human reviewed or otherwise used for Generative AI model training outside your domain without permission.” Retention for Gemini in Workspace runs 90 days to indefinite, admin-set at 3 months, 18 months or 3 years. Same vendor, same week, opposite defaults, because one page describes the free app and the other describes the paid tenancy.

Consumer tier vs business tier, side by side

Tier	Trains on your content by default	Human review	Retention
OpenAI API (chat/responses)	No, since 1 Mar 2023	Abuse logs only, up to 30 days	No retention beyond abuse logs by default
ChatGPT Business/Enterprise	Not verifiable from primary source; confirm in your admin console	Not verifiable from primary source	Not verifiable from primary source
Claude Free/Pro/Max	Yes, opt-out in settings	Feedback and safety-flagged chats, even after opt-out	Up to 5 years de-identified if opted in
Claude for Work / API	No, flat prohibition (Section B)	Not covered by training clause	Governed by commercial contract
Microsoft 365 Copilot	No	Opted out of Azure OpenAI abuse review	Governed by tenant retention policy
Azure AI Foundry Models	No, without permission	Automated, human review as needed (EEA staff for EEA data)	Stateless model; ContentLogging: false available
Gemini Apps (consumer)	Yes, activity-based	Yes, subset, incl. service providers	18 months default, 3 years for reviewed chats
Gemini in Workspace	No, not without permission	No	90 days to indefinite, admin-set

What must never go in, on any tier

A contractual promise not to train on your data is not the same as a promise the data was safe to send. Credentials, API keys, unpublished financials, and anything covered by a client NDA belong nowhere near a chat window, business tier or not, because a leaked prompt log or a misconfigured integration can expose it regardless of what the training clause says.

This is the same reasoning behind the AI usage policy worth writing down before the first person pastes a contract into a chat window: name the forbidden data classes, don’t just ban a category of feeling.

The stakes for getting this wrong are rising, not flat. IBM’s 29 July 2026 study on AI-enabled breaches, based on breaches at 602 organisations between March 2025 and February 2026, found one in four malicious breaches were AI-enabled, up 56% year on year, at an average cost of USD 6 million against a USD 4.99 million global average. Most of that increase traces to deepfake impersonation and AI-enabled malware, not chatbot leaks directly, but it is the same governance failure: nobody drew the line before the tool was live.

What to check in your own tenancy this week

Four things, in order. First, open your admin console and find the training toggle for your actual plan, not the marketing page. Second, ask whether your organisation qualifies for Zero Data Retention or a ContentLogging: false equivalent, and whether abuse-monitoring log content is carved out of that promise. Third, check your data residency setting: Global versus DataZone on Azure, or the EU Data Boundary’s subprocessor list if you route through Microsoft. Fourth, confirm who in your business can answer these four questions without opening a ticket.

If the answer is nobody, that gap is itself the finding, and it belongs in the same document as your forbidden-data list; the sequence of checks we run before any agent gets production access is covered in the AI security review to run before deployment.

We run this same discipline on our own operations before we sell it to anyone. What that governance looks like in practice, registered agents, logged runs, a human gate before anything ships, is laid out on our agent fleet page. Proof over promises: we would rather show you the log than tell you to trust the brand name on the login screen.

If you want a ranked list of what to fix first in your own AI tenancy, an AI operations audit delivers an automation map, a ranked build list and a 90-day roadmap in 10 working days, entirely in writing. Start async: describe your setup at /start and get a written reply within one business day. No meetings, no discovery call, just a plan on paper.