Private AI vs. ChatGPT Enterprise: what "your data is safe" actually means in each model.

"Your data is safe with us."

The sentence appears, in some form, on every AI vendor's website. It is on OpenAI's. It is on Anthropic's, Google's, and Microsoft's. It is on the website of every private AI provider, ours included. The words are nearly identical everywhere. The machinery behind them is not.

This matters because most firms evaluating AI never get past the words. A partner asks "is our data safe," someone finds the enterprise privacy page, reads "we don't train on your data," and the diligence ends there. That is not wrong, exactly. It is incomplete in a way that only becomes visible under stress: a subpoena, a breach, a lawsuit your vendor is fighting that has nothing to do with you.

So this article does the comparison properly. What ChatGPT Enterprise actually promises, what that promise is made of, where it held up under real pressure and where the seams showed, what private AI promises instead, and the honest tradeoffs of each. No straw men. Both models are legitimate. The point is to understand what you are actually buying.

What ChatGPT Enterprise actually promises

Credit first, because the enterprise tier deserves it. ChatGPT Enterprise represents a genuine, well-engineered data protection regime, and it is a categorical upgrade over the consumer tools your team is probably using today. The current commitments include:

No training on your data by default. Inputs and outputs from ChatGPT Enterprise, Business, Edu, and the API platform are excluded from model training unless you explicitly opt in. This is the headline promise, and OpenAI has been consistent about it.

Ownership and control. You own your inputs and outputs. Workspace admins control data retention periods, and deleted conversations are removed from OpenAI's systems within 30 days.

Real security engineering. Encryption in transit (TLS 1.2+) and at rest (AES-256), SAML SSO, SCIM provisioning, role-based access controls, IP allowlists, audit logs, and an admin console. The certification portfolio is extensive: SOC 2 Type 2, ISO/IEC 27001, 27017, 27018, and 27701, plus CSA STAR.

Compliance machinery. A Data Processing Agreement supporting GDPR and state privacy law obligations, HIPAA BAA availability, data residency options for regulated jurisdictions, and Enterprise Key Management for customers who want to hold their own encryption keys.

Zero Data Retention for the API. Qualified API customers can configure ZDR so that inputs and outputs are not retained on OpenAI's servers at all.

To be clear about the category: this is not unique to OpenAI. Claude Enterprise, Google's Gemini enterprise offerings, and Microsoft Copilot make materially similar commitments: no training on business data by default, contractual confidentiality, enterprise security controls. The analysis in this article applies to enterprise cloud AI as a class. ChatGPT Enterprise simply gets top billing because it is the product most firms evaluate first.

If your alternative is agents and analysts on personal free-tier accounts, moving to any of these enterprise tiers is one of the highest-value compliance moves available to you, full stop.

Now for the part the privacy page does not dwell on.

What the promise is made of

Every commitment listed above shares two properties.

First, each one is a contract term. A promise, made by a company, enforceable through legal remedies, revisable through the mechanisms contracts are always revisable through. The protection is as strong as the agreement, the vendor's ongoing business decisions, and the legal environment the vendor operates in.

Second, every one of those terms executes on infrastructure you do not control. Your prompts transit OpenAI's network, rest in OpenAI's storage, and are processed by OpenAI's systems, operated by OpenAI's personnel, subject to OpenAI's legal obligations. "You own your data" is true as a legal statement. As a physical statement, your data lives in someone else's building.

Neither of these is a criticism. It is simply what cloud means. But it produces a load-bearing phrase that appears in OpenAI's own enterprise privacy documentation, and in every competitor's equivalent:

That "unless" is not sinister. It is the law, and every SaaS company on earth carries the same clause. But it means the final authority over your data's fate is not you, and not even the vendor. It is whatever legal process reaches the vendor. Which brings us to the most instructive AI data story of the past year, and one that most operators evaluating AI tools have never heard.

The stress test: when a lawsuit reached the delete button

In its copyright litigation against OpenAI, The New York Times and co-plaintiffs asked the court to make OpenAI preserve user conversations as potential evidence. In May 2025, a federal magistrate judge ordered OpenAI to preserve and segregate all output log data that would otherwise be deleted, indefinitely, across ChatGPT Free, Plus, Pro, and Team, and API traffic without a Zero Data Retention agreement.

Sit with what that meant. Users who deleted conversations, relying on published deletion policies, had those conversations frozen instead of purged, by court order, in a lawsuit they were not party to. OpenAI called the order an overreach, publicly committed to fighting it, and appealed. The court clarified within weeks that ChatGPT Enterprise was excluded from preservation, and ZDR API traffic was never in scope. In October 2025, the judge lifted the going-forward preservation obligation. But logs preserved under the order remained accessible to litigation, and in November 2025 the court ordered OpenAI to produce 20 million de-identified consumer conversation logs to the plaintiffs, a ruling the district judge affirmed in early 2026.

Three lessons, and they cut in different directions.

The enterprise tier held. Enterprise's exclusion from the preservation order is the strongest real-world validation the tier distinction has ever received. The contractual wall was tested by adversarial litigation and it mattered. Firms on consumer and Team plans were swept in. Enterprise customers were not.

The vendor fought for users and still did not decide the outcome. OpenAI's resistance was genuine and public. It also did not control the result. A magistrate judge did. That is the structural point: when your data sits in a third party's custody, the set of people who can determine its fate includes parties you have never met, in disputes you have no stake in.

The carve-out clause is real. "Unless legally required to retain them" went from boilerplate to headline in a single court order. Every enterprise cloud agreement, from every vendor, contains that clause, because no contract can override a court.

The full residual-risk ledger for enterprise cloud

Beyond legal process, four other residual risks survive even a well-negotiated enterprise agreement. None is disqualifying. All belong in the analysis.

Concentrated breach surface. A frontier AI vendor's infrastructure holds the confidential prompts of hundreds of thousands of organizations simultaneously, which makes it one of the most valuable intrusion targets on the planet. The vendor's security teams are excellent. They are also defending a target whose value grows with every customer signed. Your risk includes their entire attack surface, and every incident response is on their timeline, not yours.

Terms and policy drift. Contracts renew. Products get repriced, repackaged, and deprecated. Vendors get acquired, change leadership, and revise policies as the legal and competitive landscape shifts. Today's commitments are genuinely strong. The agreement you sign governs the term you sign it for, and the AI industry is not famous for stability.

Human and system access. OpenAI's own documentation is honest about this: access to stored conversations is limited to authorized personnel for defined purposes such as support, abuse investigation, and legal compliance. Limited is doing real work in that sentence, and it is a reasonable design. It is also categorically different from nobody outside your firm.

The classification gap. The enterprise tier protects whatever your people put into it, uniformly. It cannot know that one paste is a public press release and the next is a client's negotiation ceiling wrapped in a privileged memo. Every employee makes a split-second sensitivity judgment with every prompt, and security researchers analyzing enterprise AI usage consistently find those judgments going wrong at scale. The contract is only as protective as the discipline of the ten thousandth prompt.

What private AI promises, and what that promise is made of

Private AI means the models, the knowledge base, and the inference all run on infrastructure your organization owns or exclusively controls: on-premises hardware or a dedicated environment with no shared custody. The data protection story is shorter to tell, because it is not a list of commitments. It is a property of the architecture.

Your data never enters third-party custody. Prompts, documents, and outputs stay on your hardware, inside your network boundary. There is no vendor-side copy to train on, retain, review, or produce.

There is no one else to serve legal process on. Subpoenas, discovery orders, and preservation demands targeting your data come to you, through your counsel, with your privilege arguments, on notice to you. The NYT-style scenario, where a third party's litigation freezes your deleted data without your involvement, has no mechanism to occur. There is no third party in the custody chain.

There are no terms to drift. No renewal cycle can change what happens to data that never leaves your building.

The breach surface is yours alone. Your infrastructure is a target, but it is a target containing one organization's data, defended on your terms, not a shared honeypot aggregating the secrets of a hundred thousand firms.

Access governance is native. Who can query what, which matters for ethical walls, client confidentiality boundaries, and need-to-know structures, is enforced by your identity systems, logged in your audit trail, provable in your compliance reviews.

Some obligations simply require it. Certain client MSAs prohibit third-party processing of client data outright. Some government, defense, and regulated-industry regimes require air-gapped or sovereign processing. For those obligations, the enterprise cloud question is not "how good is the contract." The answer is no contract suffices, and private infrastructure is the only architecture that satisfies the requirement as written.

It is worth noticing what the most sophisticated knowledge businesses do here. McKinsey permits general-purpose AI tools internally, but confidential client data is allowed only on the platform the firm built and controls. That is the revealed preference of an organization with unlimited budget and maximal legal sophistication: contractual protection for generic work, architectural protection for the crown jewels.

The honest tradeoffs of private AI

If this article stopped at the previous section it would be marketing. Private AI carries real costs and real risks, and a serious evaluation names them.

Security becomes your job. Architectural safety is only as good as its implementation. A well-run enterprise cloud beats a misconfigured on-premises server every day of the week. Private AI shifts the security burden from the vendor to you, which is an advantage only if you, or the partner operating it for you, actually carry it: patching, monitoring, backups, access review, incident response. This is the strongest argument for managed private AI over pure DIY.

The capability question, answered honestly. The best closed frontier models still hold a measurable lead on the hardest reasoning benchmarks and the longest multi-step agentic workflows, typically cited in the range of a few percentage points. If your workload lives at that frontier, that edge is real. But the workloads a firm knowledge platform actually runs, retrieval-augmented question answering over your documents, summarization, extraction, drafting, analysis grounded in your archive, are exactly where 2026's open-weight models (the Llama, DeepSeek, Qwen, Mistral, GLM, and Nemotron families) have closed the gap to the point where analysts now describe them as no longer a compromise. Multiple open-weight models sit in the frontier tier as of this year, and the per-workload consensus across the industry has flipped from "closed unless you have a reason" to "open where sovereignty or cost matters, closed for the narrow frontier edge."

The cost model inverts. Enterprise cloud is opex: predictable per-seat pricing, zero hardware. Private AI is capex plus operations: hardware, deployment, and upkeep. The crossover math depends on headcount and usage intensity, but the strategic difference matters more than the arithmetic: cloud spend buys access that ends when payment ends, while owned infrastructure and an owned, structured knowledge base are assets that persist, compound, and carry value in a transaction.

You still need governance. Private AI removes vendor risk. It does not remove the need for an AI use policy, output verification standards, and access discipline. A hallucinated citation is just as wrong on your hardware as on anyone else's.

The decision framework: custody follows classification

The practical answer for most firms is not either/or. It is a two-tier architecture that routes data by sensitivity, and it starts with three questions applied to each class of work:

1. Who could ever be compelled to produce this data? If the honest answer must be "only us," the data cannot live in third-party custody, however good the contract.
2. What happens if the vendor's terms, ownership, or legal posture changes in three years? If the answer is "unacceptable exposure," the protection needs to be architectural, not contractual.
3. What do our client agreements and regulators actually permit? Read the MSAs. Some already prohibit third-party processing of client data in terms written before anyone was thinking about AI.

Then route accordingly:

Generic research, public-facing drafting, and non-confidential production work belong on enterprise cloud tiers, which are excellent at exactly that. Client-confidential material, regulated data, and the institutional knowledge that constitutes your firm's actual competitive asset belong on infrastructure you own. The most sophisticated firms already run this split. The only question is whether you build it deliberately or discover it in an incident report.

For how this custody logic plays out inside specific professions, see our posts on Rule 1.6(c) and law firm confidentiality, the RIA books-and-records rule, IRC §7216 for CPA firms, brokerage client confidentiality, and institutional knowledge in consulting.

This article is for general information and is not legal advice. Vendor terms, certifications, and case law change; verify current commitments directly and consult counsel on your specific obligations.