ChatGPT Enterprise and ChatGPT Edu

The document exists. The ledger fetched it at its publisher and quotes it.

Record ID

AVD-2026-0003

Kind

Business tier

Jurisdiction

United States

Last verified

15 September 2026

Added

15 September 2026

• The enterprise privacy page states plainly that OpenAI does not train its models on your data by default.
• Retention is a customer control on Enterprise, Edu and Healthcare, and deleted conversations are removed within 30 days unless OpenAI is legally required to retain them.
• Edu does not travel with Enterprise on contracts. OpenAI processes Edu and Teachers data under a student data privacy agreement, not the DPA.
• Improved memory is disabled by default in regulated Enterprise workspaces and in ChatGPT for Healthcare.

Used for training by default, Retention period, Deletion on request, Storage region and residency, Subprocessor list published, Human review of content, Opt out available, DPA available, Persistent memory across sessions, Last change to the terms. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

Used for training by defaultStated

No by default. The enterprise privacy page states that OpenAI does not train its models on your data by default, and dates the business and API exclusion to 1 March 2023.OpenAI enterprise privacy, primary source, 8 January 2026.

Retention periodStated

Customer controlled, and stated as a headline commitment. Deleted conversations are removed within 30 days unless OpenAI is legally required to retain them.OpenAI enterprise privacy, primary source, 8 January 2026.

Deletion on requestStated

Yes, admin controlled, with an audit trail through the compliance API. At the end of the contract OpenAI returns or deletes customer data at the customer's instruction.OpenAI data processing addendum, primary source, 1 January 2026.

Storage region and residencyStated

No per workspace residency selector is documented for these tiers. European data runs through OpenAI Ireland on standard contractual clauses or an adequacy decision.OpenAI data processing addendum, primary source, 1 January 2026.

Subprocessor list publishedStated

Yes. ChatGPT Enterprise and ChatGPT Edu are named per entity, per country and per purpose, with two entries marked as at the election of the customer.OpenAI subprocessor list, primary source, 9 July 2026.

Human review of contentStated

Narrowest of the OpenAI tiers. Authorised OpenAI employees access conversations only to resolve incidents, and no third party abuse contractors appear in this clause.OpenAI enterprise privacy, primary source, 8 January 2026.

Opt out availableStated

Already excluded by default. Automated classifiers still run over business data and the classification result is kept as metadata rather than content.OpenAI enterprise privacy, primary source, 8 January 2026.

DPA availableStated

Yes for Enterprise. For Edu and for Teachers, OpenAI says it processes data under its student data privacy agreement rather than the DPA.OpenAI enterprise privacy, primary source, 8 January 2026.

Persistent memory across sessionsStated

Available, but improved memory is disabled by default in regulated Enterprise workspaces and in ChatGPT for Healthcare, and is excluded from the BAA.OpenAI Help Center, memory FAQ, primary source, 15 September 2026.

Last change to the termsStated

The enterprise privacy page prints Updated 8 January 2026, the DPA prints Effective 1 January 2026, and the subprocessor list prints Last updated 9 July 2026.OpenAI enterprise privacy, primary source, 8 January 2026.

1. 30 days

   Removal of deleted conversations

   OpenAI enterprise privacy, primary source, as of 8 January 2026.

A school and a bank buy different things here even though the marketing pairs them. Enterprise gets the DPA, the narrowest access clause on any OpenAI tier and customer controlled retention. Edu gets a student data privacy agreement instead, which a procurement checklist that only asks for a DPA will record as a gap that does not exist and will miss the terms that actually govern. Ask which instrument you are signing before you compare.

1. OpenAI enterprise privacyPrimary · 8 January 2026
2. OpenAI data processing addendumPrimary · 1 January 2026
3. OpenAI subprocessor listPrimary · 9 July 2026
4. OpenAI Help Center, memory FAQPrimary · 15 September 2026

• VerifiedBusiness tierAVD-2026-0002

  ChatGPT Business, the plan formerly called Team

  United States · verified 15 September 2026

  The training article states that by default OpenAI does not train on inputs or outputs from its products for business users, including ChatGPT Business.

• VerifiedAPI and platformAVD-2026-0004

  The OpenAI API and platform

  United States · verified 15 September 2026

  The platform guide states that as of 1 March 2023, data sent to the OpenAI API is not used to train or improve OpenAI models.

• Open questionOpen questionAVD-2026-0028

  Does a promise not to train on your data cover the safety classifiers?

  Global · verified 15 September 2026

  OpenAI's enterprise page says business data may be run through automated content classifiers and safety tools, with the classification kept as metadata rather than content.

• VerifiedAPI and platformAVD-2026-0026

  Amazon Bedrock

  United States · verified 15 September 2026

  Amazon Bedrock uses a zero data retention security model, so by default it does not store model inputs or outputs.

• VerifiedBusiness tierAVD-2026-0025

  GitHub Copilot Business and Enterprise

  United States · verified 15 September 2026

  GitHub states it does not use Copilot Business or Copilot Enterprise customer data to train AI models.

• VerifiedBusiness tierAVD-2026-0024

  Cursor and its privacy mode

  United States · verified 15 September 2026

  The terms of service state that Cursor will not use content to train any AI models unless you have explicitly agreed.