ChatGPT Business is secure enough for most company work once it is configured, and not safe by assumption. The defaults OpenAI provides are good: workspace data is not used to train its models by default, data is encrypted at rest with AES-256 and in transit with TLS 1.2 or later, the plan has completed a SOC 2 Type 2 audit, and a Data Processing Addendum is available. What the defaults leave to you is the rest of this checklist: who owns the workspace, whether sign-in goes through your identity provider, what connected apps can reach, how shared projects and custom GPTs are shared, whether memory is on, and how long data is kept. Enterprise-only controls such as SCIM, the Compliance Platform, IP allowlisting and (per OpenAI's pricing table) data residency are not on Business, so do not plan around them.
This page covers the concrete controls in a ChatGPT Business workspace (formerly ChatGPT Team). For the general questions about AI tools and company data, read our AI data privacy FAQ for small business; for the people side of the problem, shadow AI and employee ChatGPT use.
Is ChatGPT Business secure by default?
What OpenAI provides on the plan, as of October 2026:
- No training on your data by default. OpenAI's enterprise privacy page states that data from ChatGPT Business is not used to train its models unless the workspace opts in, and that you own your inputs and outputs. The Business help pages extend that to memories, data reached through apps, GPT conversations and projects.
- Encryption. AES-256 at rest and TLS 1.2 or later in transit.
- Attestations. ChatGPT Business has completed a SOC 2 Type 2 audit. ISO 27001 certification differs: OpenAI's pricing comparison marks it Yes for Enterprise and No for Business, and the trust portal lists the ISO 27001 scope as the API, ChatGPT Enterprise and ChatGPT Edu.
- Contracts. A DPA for GDPR and similar laws is available for Business through an online form. A Business Associate Agreement is not: OpenAI's BAA article says it does not offer one for ChatGPT Business.
- App permissions. Connected apps respect the permissions a user already has in the source, each user authenticates to the app themselves, and data reached through apps is not used for training by default.
Not on the plan: SCIM, custom roles, the Compliance Platform, IP allowlisting, Enterprise Key Management, Lockdown Mode, a workspace-wide switch for shared links, and data residency (the pricing table says No; a help article says it is rolling out at checkout). Those are compared in ChatGPT Business vs Enterprise.
Which ChatGPT Business security settings should an admin review?
Each row is an official default or control; the recommendation is ours.
| Setting | Where | Default | Recommended |
|---|---|---|---|
| Workspace owners | Workspace settings, Members | The creator is the only owner | Two owners on company accounts; owners alone control billing, identity and GPT settings |
| Domain verification | Identity and access | Not verified | Verify every company domain; it is required for SSO and for controlling who can find the workspace |
| Single sign-on | Identity and access, Identity and provisioning | Not configured | SAML or OIDC with your identity provider; it is the only way to enforce MFA and cut access when an account is disabled |
| Multi-factor authentication | Each user's OpenAI account | Optional; cannot be enforced by the workspace | Enforce through the identity provider; until then, require an authenticator app or passkey by policy |
| Workspace discovery | Identity and access, User Provisioning | On | Off if contractors or another company share your domain; otherwise on, with join requests reviewed |
| Automatic account creation and external-domain invites | Identity and access | Controls available | Automatic creation only if every verified-domain user should get a paid seat; external invites off unless named contractors need them |
| Memory | Workspace settings; each user's personalization | Available; users can disable it | Follow the data policy; an owner can turn it off workspace-wide, which deletes existing memories |
| Retention | Admin-controlled | Admins set it; deleted conversations removed within 30 days | Set it, record the reason, and know that a removed member's chats are retained indefinitely |
| Connected apps and plugins | Admin Console, Plugins | Apps enabled | Disable unapproved apps; approval default Always ask or Allow read actions; never Allow all actions as the default |
| Custom MCP servers | Plugins | Only admins and owners can publish | Keep it that way; review each server's tools before publishing and after any change |
| GPT creation and sharing | Workspace settings, GPTs | Every role can create; sharing levels from invite-only to GPT Store | Share inside the workspace or invite-only; one owner per GPT; plan the plugin migration before the December 11, 2026 retirement |
| Workspace agents | Each workspace agent's settings | Write actions set to Always ask | Leave it; review every published agent and the connections it owns |
| Shared projects | Each project | Up to 100 collaborators; project-only memory available | Project-only memory for sensitive work; a named owner per shared project |
| Spend limits and alerts | Billing | No limits specified | Monthly credit limits per seat type and alerts; a sudden spike is also an abuse signal |
Sign-in
OpenAI's MFA article is explicit that MFA cannot currently be enforced at the ChatGPT workspace level, and its SSO guidance says to enforce it through the identity provider instead. Business includes SAML and OIDC SSO, so verify the domain, connect Microsoft Entra ID, Okta or Google, require MFA there, and treat password sign-in as a pilot-only state. The steps are in ChatGPT SSO setup for Business and Enterprise.
Retention and leavers
Admins control retention and deleted conversations leave OpenAI's systems within 30 days, with one caveat: OpenAI may keep a copy of a temporary chat for up to 30 days for safety purposes. When a member is removed from a Business workspace, OpenAI's retention article says their chats, files and canvas documents are retained indefinitely and restored if they are re-added, and their projects and GPTs are reassigned to a workspace owner. On Enterprise the removed member's data follows the configured policy instead; write the Business behavior into your retention policy.
Connected apps
Apps are the setting most likely to be wrong: they are on by default in Business and inherit whatever access the user already has. OpenAI's apps and plugins article gives admins workspace-wide availability, an approval default (Always ask, Allow read actions, Allow low-risk actions, or Allow all actions, which OpenAI itself warns carries more risk), per-app overrides and a policy for newly added actions. Microsoft apps for SharePoint, Outlook and Teams also need a Microsoft Entra administrator to consent to the ChatGPT application. Enable only the apps the policy allows, start with read actions, and test each with a low-privilege account; if it sees too much, fix SharePoint or Google Drive, not ChatGPT.
Can my company see my ChatGPT history?
Two official pages answer this differently, so quote both. OpenAI's enterprise privacy page says Business workspace admins can view, access, export and delete end-user conversations in the workspace. Its Business data sharing article says each user has their own chat history, other members do not automatically see it, by default admins and owners cannot see all private member chats, usage analytics do not expose transcripts, and owners can export a member's data from the Members page where that option is available; members cannot export their own data. For ChatGPT Enterprise, admins can access an audit log of conversations and GPTs through the Compliance API. GPT builders cannot view the conversations people have with their GPTs. Tell staff plainly that work in the company workspace belongs to the company and can be exported by an owner.
What risks remain after the settings are right?
- Staff still paste what they should not. A workspace that does not train on your data still receives it. The usage policy decides what may be pasted; our AI usage policy template is the one-page version.
- Apps surface oversharing. If a SharePoint library is open to everyone, ChatGPT will find the files in it faster than a person would. Fix the source permissions.
- Prompt injection through connected content. A document, email or web page an app reads can contain instructions. Keep write actions behind Always ask and review any agent with write access.
- Output nobody checks. A confident wrong answer in a client email is a risk no setting prevents. Name the reviewer for anything that leaves the company.
Security review checklist
- Two owners on company accounts; no owner on a personal or departing address.
- Every company domain verified; discovery and automatic account creation set deliberately.
- SSO configured and in use, MFA required at the identity provider, a fallback owner tested.
- Memory and retention decisions recorded, with the leaver behavior written into the retention policy.
- Apps limited to the approved list; approval default Always ask or read-only; Entra consent granted only for the Microsoft apps you use.
- Each app tested with a low-privilege account.
- Custom MCP servers published only by admins, each reviewed for the tools it exposes.
- Shared GPTs, agents and projects inventoried with an owner each; GPT retirement plan dated.
- Spend limits and alerts set per seat type.
- Usage policy issued, acknowledged and trained; a quarterly review date on the calendar.
Frequently asked questions
Does ChatGPT Business train on our data?
No, by default. OpenAI states that Business workspace data, including memories, data reached through apps, GPT conversations and projects, is not used to train its models unless the workspace opts in. On personal Free, Go, Plus and Pro accounts, training is on unless each user turns it off.
Is ChatGPT Business HIPAA compliant?
OpenAI does not offer a BAA for ChatGPT Business. Its HIPAA-eligible products are ChatGPT for Healthcare, ChatGPT Enterprise with Regulated Workspace, ChatGPT FedRAMP, ChatGPT for Clinicians and the API with modified retention. Which AI tools sign a BAA is covered in Is ChatGPT HIPAA compliant?
Can admins read employees' chats in ChatGPT Business?
Not by default: OpenAI's help page says admins and owners cannot see all private member chats and analytics show no transcripts. Its privacy page says admins can view, export and delete conversations, and owners can export a member's data. Treat workspace chats as company records that can be produced.
Should we turn Memory off?
It depends on the data. Memory is per user and never shared, but it carries context between chats. Firms handling client matters often turn it off workspace-wide or use project-only memory. Decide before rollout, because switching it off later deletes existing memories.
Are connected apps safe to enable?
They respect the permissions the user already has, authenticate per user and are excluded from training by default. The risk is oversharing at the source and unreviewed write actions. Enable only approved apps, start with read actions, keep Always ask for writes and test with a low-privilege account.
Is ChatGPT Business SOC 2 compliant?
Yes: ChatGPT Business has completed a SOC 2 Type 2 audit, with the report available to authenticated users of OpenAI's trust portal. ISO 27001 certification covers Enterprise, Edu and the API, not Business, as of October 2026.
Can we enforce MFA on ChatGPT Business?
Not inside ChatGPT; OpenAI says MFA cannot be enforced at the workspace level. Connect SSO and require MFA in Microsoft Entra ID, Okta or Google.
How NetSys reviews a ChatGPT workspace
Our AI security assessment reviews a ChatGPT Business or Enterprise workspace against this checklist: who owns it, which sign-in and data controls are set, which apps, agents and GPTs are shared and with whom, and what evidence the plan can produce. The findings name the setting, the current value, the recommended value and the owner, with the limits of what the review could see. When NetSys also runs the workspace under our ChatGPT Business setup service, the same checklist is applied before anyone is invited, and the written usage policy comes from the same engagement. If you want a quick read on your exposure first, the seven-question AI security self-assessment takes a few minutes.
NetSys engineers review the workspace, the identity provider and the connected sources together, so request an AI security assessment before the next department is invited.
Discuss chatgpt business setup for your business.
Tell us about your current systems, the result you need and your timeline. We will discuss the work, responsibilities and pricing before you decide on an engagement.