Data privacy guide

Is It Safe to Put Client Data Into ChatGPT or Claude? A Plan-by-Plan Answer

Published November 7, 2026 by Igor Golubev. Vendor pages checked November 8, 2026.

It depends on the plan. On their own pages, OpenAI and Anthropic say they do not train on data from their business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) or their APIs by default. Personal plans can use your chats for training: at OpenAI unless you turn it off, at Anthropic if you allow it.

“Not used for training” is a narrow promise: the chats are still stored, a business admin can read them, and a legal hold can override deletion. If a client contract bars sending their data to any outside company, no plan is enough; a local model on your own server is the alternative.

IG Digital Lab is a technology provider, not a law firm or compliance auditor. This is a technical comparison, not legal advice; confirm your client contracts and professional rules with your counsel or CPA.

What does each plan do with your data?

The tables compare four things: whether the vendor trains on your data, how long it keeps it, who inside your company can read it, and whether a BAA (Business Associate Agreement) is available. Each cell comes from the vendor's own page, linked in the cell and opened on 2026-11-08; where a page says nothing, the cell says “not stated” or “none listed.” We quote no prices, because they change faster than privacy terms. A team plan needs at least two seats at both vendors (ChatGPT pricing FAQ, Claude Team plan).

OpenAI: ChatGPT plans and the API

Plan	Training by default, and opt-out	Retention	Admin access and controls	BAA available?
ChatGPT Free, Plus, Pro personal plans	Yes, may be used. Sharing is on by default; turn off “Improve the model for everyone” in Settings > Data controls, or use OpenAI's Privacy Portal. Voice mode has its own training switch, and OpenAI's Trusted Access (Daybreak) sessions can be used for training even with the setting off. A thumbs-up or thumbs-down can still send the whole conversation to training. Sources: How your data is used; Data controls	Kept until you delete it. A deleted chat is scheduled for removal within 30 days, unless OpenAI must keep it for security or legal reasons or it was already de-identified; separately saved files stay until you delete them. A Temporary Chat is not used for training; a copy may be kept up to 30 days for safety. Sources: Chat and file retention	OpenAI's business-data page lists SSO and admin roles for its business plans and the API, not for personal plans. Its pricing page says Free, Go and Plus “are designed to be used by individuals.” Sources: Business data page; ChatGPT pricing	None listed. OpenAI's BAA pages name the API, sales-managed Enterprise and Edu, ChatGPT for Healthcare, and ChatGPT for Clinicians (a separate plan, free for verified U.S. clinicians), not Free, Go, Plus or Pro. Sources: BAA page; Business data page; ChatGPT for Clinicians
ChatGPT Business called Team until August 29, 2025	No, not by default. OpenAI: “OpenAI does not train on your workspace data.” Thumbs-up and thumbs-down feedback does not permit training on Business, but a workspace admin may be able to opt the workspace in. Sources: Business FAQ; How your data is used; Managed accounts	No workspace retention setting is documented for Business. OpenAI lists admin-set retention for Enterprise, Edu and Healthcare only, and says chats and files of members removed from a Business workspace are kept indefinitely. One line in OpenAI's Business FAQ says admins can control retention, so check your Admin Console. Deleted or unsaved conversations are removed within 30 days, unless longer retention is required by law or is “reasonably necessary to protect our services or any third party from harm.” Sources: Enterprise privacy; Removed members; Chat and file retention	Workspace admins “can view, access, export, and delete end user conversations in the workspace.” Roles: owner, admin, analytics viewer, member. MFA, SAML SSO, third-party GPT controls. OpenAI staff access is limited to engineering support, abuse investigation and legal compliance, plus abuse-review contractors. Sources: Enterprise privacy; Business data page; Business FAQ	No. OpenAI: “We do not offer a BAA for ChatGPT Business.” A data processing addendum (DPA) is available. Sources: BAA page; Enterprise privacy
ChatGPT Enterprise and Edu	No, not by default; the same commitments as Business. Sources: Enterprise privacy	Workspace admins control retention. Deleted conversations are removed within 30 days unless OpenAI is legally required to keep them. Sources: Enterprise privacy	Everything in Business, plus SCIM, role-based access controls and user analytics. Admins can read an audit log of conversations through the Compliance API. Eligible customers can choose where data is stored. Sources: Business data page; Enterprise privacy	Yes, by contract. OpenAI: “For a BAA for a sales-managed ChatGPT Enterprise or Edu account, contact sales.” Sources: BAA page
OpenAI API	No, not by default. Data sent to the API “is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us).” Sources: Your data, API docs	Abuse-monitoring logs are kept up to 30 days by default (for conversations: until deleted). Stored features (conversations, assistants, files, vector stores) keep data until you delete it and cannot use Zero Data Retention. The Responses API stores application state for at least 30 days by default. Zero Data Retention and Modified Abuse Monitoring exist for other endpoints, subject to OpenAI's approval. Sources: Your data, API docs	MFA, SAML SSO, projects with limits, an Admin API, an Audit Logs API and a usage dashboard. Sources: Business data page	Yes. A standard BAA can be accepted in the API Platform; self-serve enrollment needs an established history of API usage, and no enterprise agreement is required. Accepting it does not by itself make an application meet HIPAA. Sources: BAA page

Checked 2026-11-08. Enterprise privacy prints “Updated: January 8, 2026”; help articles show relative dates. The training page does not name ChatGPT Go, so treat Go as “not stated.”

Anthropic: Claude plans and the API

Plan	Training by default, and opt-out	Retention	Admin access and controls	BAA available?
Claude Free, Pro, Max, Ultra personal plans	Only if you choose to allow it. Anthropic trains on chats and coding sessions when you allow it; you pick at signup and can change it in Privacy settings. Chats flagged for safety review can still be used to train Anthropic's safety models, and the feedback buttons store the whole conversation for up to 5 years and Anthropic may train on it. Incognito chats are not used. Sources: Training, personal plans; Privacy settings; Consumer terms update	A deleted chat leaves back-end storage within 30 days. If you allow training, de-identified data can be kept up to 5 years, and turning the setting off does not pull your data out of training runs already under way. A chat flagged as a policy violation: inputs and outputs up to 2 years. Sources: Personal-plan storage	None listed. Anthropic's pricing page puts SSO, domain verification and central administration on Team and Enterprise. Sources: Claude pricing	No. Anthropic's pricing page lists no HIPAA offering for Free, Pro, Max or Ultra; its BAA covers Enterprise, the first-party API and Claude in Microsoft Foundry. Sources: Claude pricing; BAA page
Claude Team	No, not by default (commercial products). Exception: feedback you submit with the thumbs buttons, which Anthropic may train on; owners can switch it off with “Rate chats” in Organization settings. Sources: Commercial training	A deleted chat leaves back-end systems within 30 days. Custom retention is Enterprise only. A flagged chat: up to 2 years. Sources: Org data retention; Claude pricing	SSO, domain verification, central billing and administration, spend controls. Four fixed roles (User, Admin, Owner, Primary Owner); custom roles and group-level permissions are Enterprise only. The Primary Owner can request data exports that may contain members' conversations. No audit logs and no SCIM on Team. Sources: Roles and permissions; Claude pricing; Team data ownership	No. Anthropic's pricing page lists a HIPAA offering for Enterprise, not Team. Its DPA is automatically part of the Commercial Terms. Sources: Claude pricing; DPA
Claude Enterprise	No, not by default (commercial products); the same feedback exception as Team. Sources: Commercial training	Owners can set a custom retention period (minimum 30 days). Without one, “data is retained indefinitely”. Chats inside a project follow the project's own period, and projects are kept indefinitely unless you set one. Sources: Custom data retention	Team features plus SCIM, audit logs, a Compliance API, custom roles with fine-grained permissions and IP allowlisting. Sources: Claude pricing; Roles and permissions	Yes, after setup. The Primary Owner turns on HIPAA under Data and privacy and accepts the BAA; several features (Console, Cowork in the cloud, published artifact pages, beta features) are excluded. The BAA page lists each one. Sources: BAA page
Anthropic API	No, not by default (commercial products). Sources: Commercial training	Inputs and outputs are deleted from Anthropic's backend within 30 days, except features with longer retention (for example the Files API), agreed zero-data-retention terms, usage-policy enforcement or legal requirements. Flagged inputs and outputs: up to 2 years. Sources: Org data retention	Console organizations support SSO; its settings appear only after Sales has enabled SSO or a merge proposal is complete. Zero data retention is by agreement, approved per organization. Sources: SSO setup; Zero data retention	Yes, for the first-party API: the Primary Owner signs a BAA and asks Anthropic's sales team to turn it on. The Batch API, Files API, Skills API, Code Execution and Web Fetch are not covered, and Covered Models require 30-day retention. Sources: BAA page

Checked 2026-11-08. Printed dates: personal-plan training March 16, 2026; commercial training August 18, 2026; storage articles July 1, 2026. The personal-plan training page names Free, Pro and Max; Anthropic's other privacy pages list Ultra among its consumer plans, so we read the same rules as applying to it.

If you already pay for Microsoft 365 or Google Workspace

Product	Training by default, and opt-out	Retention	Admin access and controls	BAA available?
Microsoft Copilot in Microsoft 365	No. Prompts, responses and data accessed through Microsoft Graph “aren't used to train foundation LLMs”. Sources: Copilot privacy page	Stored “in alignment with contractual commitments with your organization's other content in Microsoft 365.” Admins can set retention policies in Microsoft Purview; users can delete their Copilot activity history. Sources: Copilot privacy page	Admins can view stored interactions with Content search or Microsoft Purview. Microsoft lists OpenAI and Anthropic models as subprocessors in Copilot. Sources: Copilot privacy page	Yes, through Microsoft's Online Services Data Protection Addendum; its list of in-scope services names Microsoft Copilot and Copilot Chat. Sources: Microsoft HIPAA page
Gemini in Google Workspace	No, not without permission: “Your content is not human reviewed or otherwise used for Generative AI model training outside your domain without permission.” Sources: Workspace Privacy Hub	Gemini in Workspace prompts and responses: “90 days to indefinite, as determined by admins”. Gemini app: up to 36 months, set by admins. Sources: Workspace Privacy Hub	Admins set retention and can use Vault for Workspace data; users can delete conversations unless admins prohibit it. Sources: Workspace Privacy Hub	Yes, through the Workspace BAA that admins accept in the Admin console. Google says Gemini can support HIPAA workloads; Gemini Notebook and Gemini in Chrome are not covered. Sources: Privacy Hub; Google Workspace HIPAA

Checked 2026-11-08. Microsoft's Copilot privacy page says “Last updated on 11/03/2026”; Google's Privacy Hub says “Last updated: October 6, 2026”.

What does “not used for training” leave out?

It only means your text will not be used to train future models. It says nothing about how long the text is stored, who can open it, or what a court can order.

People. On ChatGPT Business, workspace admins can view, export and delete every member's conversations; on Claude Team, the Primary Owner can request exports that may include them. Vendor staff can open chats in narrow cases. Tell your staff before you roll a shared workspace out.
Legal holds. In 2025 a court order in The New York Times' lawsuit made OpenAI keep consumer ChatGPT and API content it would normally delete after 30 days. OpenAI's FAQ said it reached Free, Plus, Pro and Team plans and API customers without Zero Data Retention, not Enterprise or Edu. OpenAI says the obligation ended on September 26, 2025, and that it still stores limited April to September 2025 data for the case. OpenAI's account, updated October 22, 2025.

What do your client contracts allow?

Your engagement letter, NDA or services agreement is a second set of promises, and many confidentiality clauses restrict disclosure to third parties. A vendor that processes the text you paste is a third party. Check whether the clause names subcontractors or processors, whether it requires notice or consent, and whether it covers derived material such as summaries and drafts. If it is unclear, ask the client in writing before the data goes in.

Lawyers, accountants and health practices also answer to professional rules that can be stricter than a contract; take those to your counsel or professional association. If you run a law firm, our page for law firms sets out the California rule on lawyers' use of generative AI and what we do and do not set up.

Which client data can go where?

Sort what staff paste into four classes and set one rule for each. These are our working rules, not a legal determination.

Class	Examples	Suggested home
1. Keep out	Passwords, API keys, full card numbers, government ID numbers, and anything a client contract or law bars from outside processors.	No outside AI service.
2. Business account only	Client names with matters, contracts, financial statements, internal documents under NDA.	A business plan or an API key in your own organization, with SSO or MFA.
3. Redact first	Notes, emails and transcripts where names, account numbers and addresses can be replaced before pasting.	A business plan; a personal plan with training switched off only after the redaction is done.
4. No restriction	Public information, your own website text, templates and general questions.	Any plan.

When is a team plan enough, and when does a private setup make sense?

A team plan can be enough when

Your client contracts and your own policy allow an outside processor, and you can sign the vendor's data processing addendum (OpenAI offers one for Business, Enterprise and the API, per Enterprise privacy; Anthropic's is part of its Commercial Terms, per DPA article).
The data falls in classes 2 to 4.
You do not need a BAA; ChatGPT Business and Claude Team offer none.

A private setup is worth a look when

Contract. A client contract, a regulator or your own policy says the data may not go to an outside company.
Volume. Many people paste documents all day. Multiply seats by the vendor's monthly seat price by 12 and compare that with a one-time setup plus a server and model usage; the arithmetic is quick on the ChatGPT and Claude pricing pages.
Budget. Our setup is a one-time fee (the price is below); hardware or hosting, AI plans and API usage are billed separately, and someone has to look after the machine. If you cannot cover that, a business plan is the sensible choice.

What do we set up, and where does the data go?

Our AI agent setup and training is $1,999. We prepare a server in your name (an office computer or a remote server), install Cardloop (our open-source workspace for AI agents), connect the agents you choose (Claude, OpenAI Codex through your ChatGPT plan, Grok or local models) and your accounts, and train your team to use it. The scope is agreed before we start.

The system can live on your own server. If a system uses an outside AI model, we tell you which one and what data it sees. In practice:

Step	Where it runs	What an outside model sees
Your files, notes and the agent workspace	Your server.	Nothing, until an agent sends part of it to a model.
A task sent to Claude, OpenAI Codex or Grok	That provider's service, under the plan or API terms you connect.	The text of the task and the files the agent opens for it. The row for that plan in the tables above applies, including training on personal plans, and Codex cloud environments have their own “Include environments” switch.
A task sent to a local model	Your own hardware.	No outside provider is involved.

A private setup changes where the data sits; it does not by itself satisfy a contract or a regulation, because access control, backups and logs still have to be set up and kept up. A fully offline setup is a separate quote. A private assistant that answers from your own documents is our custom software service: private AI on your documents.

What ten rules can you adopt today?

Use one business account for client work and name its owner.
Turn on SSO or at least MFA, and remove people the day they leave.
No personal logins for client data. If one is unavoidable, switch training off first (Settings > Data controls in ChatGPT, plus the separate voice-mode switch; Privacy settings in Claude).
Read the confidentiality clause in each client contract and NDA; if it names subcontractors or processors, get written permission first.
Redact names, account numbers and addresses before pasting class 3 material.
Never paste passwords, API keys, full card numbers or government ID numbers.
Turn off “Rate chats” on Claude Team, because feedback can be trained on. ChatGPT Business feedback is not used for training; admins can still switch it off under Workspace settings > Allow response feedback.
Set retention as short as the work allows where the plan lets you (ChatGPT Enterprise admins, Claude Enterprise owners; confirm the ChatGPT Business setting). On Claude Team, delete chats when the job ends.
Keep patient records and other regulated data out unless the exact product and feature appears in a BAA you hold.
Re-check the vendor pages every quarter. Terms have moved before: Anthropic added a training choice for personal plans, OpenAI's court-ordered retention ended, and ChatGPT Team became ChatGPT Business.

Frequently asked questions

Do ChatGPT and Claude train on my business data?

Not by default on their business plans and APIs. OpenAI says it does not use ChatGPT Business, Enterprise or API data for training unless you opt in; Anthropic says the same for Claude Team, Enterprise and its API, except feedback you submit with the thumbs buttons.

Is the free version of ChatGPT or Claude safe for client data?

We would not use it for client data. ChatGPT Free, Plus and Pro may train on your chats unless you switch the setting off, Claude's personal plans train on chats if you allow it, and neither gives your company an admin console to review or delete what staff pasted.

Can OpenAI or Anthropic employees read my chats?

In narrow cases. OpenAI says access to Business conversations is limited to authorized employees for engineering support, abuse investigation and legal compliance, plus contractors who review for abuse and misuse. Anthropic says that on its personal plans its employees cannot open your conversations by default; the exceptions are feedback you send and reviews to enforce its Usage Policy, which are limited to designated Trust & Safety staff on a need-to-know basis (Anthropic's data protection page). Its commercial-plan pages give no equivalent statement. Inside your company, ChatGPT Business admins can view, export and delete members' conversations.

Do I need a BAA to use ChatGPT or Claude with patient information?

A vendor that handles patient information for a covered entity normally needs a Business Associate Agreement. OpenAI offers one for the API, sales-managed Enterprise and Edu, ChatGPT for Healthcare and ChatGPT for Clinicians, not for ChatGPT Business. Anthropic offers one for Enterprise and the API; its pricing page lists no HIPAA offering for Team or its personal plans. Microsoft and Google offer BAAs for covered Copilot and Gemini services. IG Digital Lab does not sign BAAs and does not receive patient data.

When does a private AI setup make sense, and what does it cost?

When a contract, a regulator or your own policy bars sending the data to any outside company, or when you want agents working on your own files on a machine you control. Our AI agent setup and training is $1,999; hardware or hosting, AI plans and API usage are billed separately.

Not sure which tier your client data needs?

Request the free AI audit; the written review arrives by email. Tell us which AI tools your team already uses and what client data touches them.

Get the free audit

The review is yours whether you hire us or not.

Tell us what's slowing you down.

You get a free written review by email within two business days.

Only your email and the task are required. Name, phone and text messages are optional. No passwords or client data needed.

Which task does your team still do by hand?

Name

Phone

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.