ChatGPT — Enterprise
Vendor: OpenAI.
| Field | Value |
|---|---|
| Retention (default) | Admin-controlled; deleted chats removed within 30 days source · 2026-10-15 |
| Retention configurable | Yes (workspace admins) source · 2026-10-15 |
| Trains on customer data | No by default (unless opted in via feedback) source · 2026-10-15 |
| Zero data retention option | Not documented for ChatGPT (ZDR is API-only, eligible endpoints) source · 2026-10-15 |
| Data residency | Yes – storage at rest in US, EU (EEA+CH), UK, JP, CA, KR, SG, IN, AU, UAE; inference residency in EU, US, UAE source · 2026-10-15 |
| SSO | SAML SSO source · 2026-10-15 |
| SCIM | Yes – workspace or tenant-wide SCIM source · 2026-10-15 |
| Audit logs / compliance API | Yes – Compliance API / Compliance Logs Platform source · 2026-10-15 |
| Customer-managed keys | Yes – EKM (AWS KMS, GCP, Azure Key Vault); needs named account rep source · 2026-10-15 |
| Admin connector controls | Yes – admins control which apps are enabled source · 2026-10-15 |
| SOC 2 | Yes – SOC 2 Type 2 source · 2026-10-15 |
| ISO 27001 | Yes – ISO 27001:2022 & 27701 (Enterprise, Edu, API) source · 2026-10-15 |
| HIPAA / BAA | BAA offered for API; ChatGPT for Healthcare is the HIPAA offering source · 2026-10-15 |
| Encryption | AES-256 at rest, TLS 1.2+ in transit source · 2026-10-15 |
| DPA available | Yes source · 2026-10-15 |
| Feedback used for training | Yes, if user opts in via feedback source · 2026-10-15 |
| Vendor human review | Only for incidents, with permission, or legal need source · 2026-10-15 |
| AI mgmt cert (ISO 42001) | Yes – ISO 42001 (OpenAI products) source · 2026-10-15 |
| FedRAMP | FedRAMP 20x Moderate (ChatGPT Enterprise & API) source · 2026-10-15 |
| Pricing note | Contact sales; credit- or token-based options source · 2026-10-15 |