November 3, 2026 · Last updated November 4, 2026 · 10 min read · By Cyber Dogs AI
Last updated: November 3, 2026
There is no single answer for every account and every document. Suitability depends on the product, workspace settings and information you intend to share. Review the provider's current terms alongside your company's requirements. Start with approved data and a defined use case rather than treating a familiar chat window as blanket permission.
A public product description, an internal sales forecast and a client case file need different handling. Identify the data first, then decide which tools and settings are appropriate. This guide describes practical review questions, not a certification that a particular workflow is compliant.
OpenAI says it does not train models on data from ChatGPT Business, ChatGPT Enterprise and its API by default. That statement concerns model training, not every aspect of data handling. Review the relevant product terms and any data-sharing choices your organization has made before deciding what information employees may enter.
Source: OpenAI's enterprise privacy commitments. A business product's default should not be assumed to cover a staff member's personal account or every external service connected to a workflow.
For personal Free, Plus and Pro accounts, OpenAI documents a model-improvement choice in Data controls. It also says voluntarily submitting response feedback can allow use of the associated conversation even after an individual opts out. Review the current feedback policy instead of assuming the same exception applies to managed workspaces.
No. Model training and retention are separate questions. OpenAI's data-controls documentation says switching off its model-improvement setting does not remove saved chats. Review the controls available for the specific account and workspace. Decide who can access records, how sharing is handled and what retention your business needs before uploading sensitive information.
Source: OpenAI's data controls documentation. Do not describe an account as storing nothing simply because a training option is disabled.
OpenAI says chats that remain temporary are excluded from model improvement and may be retained for up to 30 days for safety. Its current documentation also distinguishes saving a temporary chat as a regular conversation. These controls do not replace approval to use a particular category of business information.
Until your organization approves a specific workflow, keep passwords, access tokens and unnecessary personal details out of prompts. Treat client records and restricted business documents according to your existing rules. Use invented examples or carefully minimized data for early trials, then seek the appropriate approval before expanding to more sensitive material.
A useful trial might rewrite a public service description or summarize a fictional customer request. Replacing a person's name alone may not make a real document anonymous if other details still identify them. Ask the owner of the data to review what remains.
Name the approved tools and accounts, identify permitted data and explain which outputs need human review. Give employees a clear route to request a new use case or report a mistake. Assign an owner who checks whether the rules still fit as products, connected services and business processes change over time.
The NIST AI Risk Management Framework organizes risk management around govern, map, measure and manage. A small business can use those functions to structure its questions without claiming a NIST certification. For a team rollout, see AI training for teams.
Map where information enters, which services receive it and what actions the assistant can take. Review permissions and sharing separately from the quality of its answers. Start with the least access needed, test with approved examples and make a person responsible for exceptions before allowing the workflow to affect customers or records.
Record the provider, account type and decision for each use case. A tool approved for drafting public copy is not automatically approved to send messages or update a customer database. Review proposed connections individually rather than assuming approval transfers between tasks.
Compare the actual plan and settings rather than the ChatGPT name alone. Personal accounts and managed workspaces have different training defaults and administrative features. A managed workspace does not automatically expose every employee conversation to colleagues. Use the provider documentation to verify the controls your organization needs before choosing an account structure.
Last checked: November 3, 2026. Recheck the linked documentation before rollout because product terms and features change.
| Account or workspace | Training default | Administration and retention | Account decision |
|---|---|---|---|
| Personal Free, Plus or Pro | Sharing enabled by default; the user can opt out | User-managed controls; turning off training does not delete history | Confirm whether company rules permit work in a personal account |
| ChatGPT Business | Business data excluded by default | Managed workspace; members do not automatically see each other's histories | Assign ownership of workspace membership and permitted uses |
| ChatGPT Enterprise | Business data excluded by default | Enterprise access controls and retention controls described in the vendor's commitments | Review the organization's contracted configuration |
Sources: OpenAI data controls, Business workspace privacy and enterprise privacy commitments.
The plan is only one part of the decision. Staff can still share information with the wrong audience, connect more data than a task needs or accept an inaccurate answer. Decide what each workflow is allowed to read and do. Keep a human review point for important output and a clear route for reporting mistakes.
For example, a draft message may contain details from an attached document that were unnecessary for the task. Before sharing a link or sending the draft, review the actual content and intended audience. A sound account choice cannot make that business decision for the person sending it.
Read our articles on AI agent incidents, AI and business information risks and AI-assisted phishing for related questions. See AI regulation and governance for policy considerations. Those examples do not justify assuming every use of a public AI product exposes information to everyone.
Keep credentials and restricted information out of a workflow until the business has approved both the purpose and the tool. Examples include customer records, non-public financials and confidential documents. Classify the information before uploading it. An approved use should still send only the information needed for that task and follow the relevant internal rules.
The Australian Cyber Security Centre's small-business guidance recommends minimizing sensitive information and reviewing provider handling. The Cyber Readiness Institute guide supplies questions about approved tools, confidential data and accountability.
Choose an approved account structure, review training settings, write the usage rules, limit connected access and train the team to check outputs. Treat those steps as a starting process rather than a guarantee. Give each decision an owner and review the setup whenever the intended data or allowed actions change materially.
Our AI training for teams can be discussed alongside the workflow design. Training should include the exceptions and the stop conditions, not only examples where the tool produces a useful answer.
Apply the same product-specific review to other providers. Anthropic distinguishes consumer model-improvement choices from commercial data terms and its commercial documentation describes feedback exceptions. That does not establish that one brand is universally safer. Review the relevant account, connections and data-handling choices for the particular work you want to do.
Anthropic's consumer-terms update covers Free, Pro and Max choices. Its commercial training policy says commercial inputs and outputs are not used for training by default, with exceptions such as explicit feedback or permission. Do not transfer a statement about one provider's feedback controls to another provider.
Make a short record for each approved tool: product, workspace, permitted use and review date. Revisit it before connecting new data or enabling new actions. A policy that names only a brand can become unclear when the brand offers several account types.
A private AI setup is worth discussing when your team needs a defined shared workspace, controlled access to business knowledge and clear operating rules. Ask exactly what private means in the proposed design. It should identify providers, data flows and permissions rather than implying that the word alone guarantees isolation or compliance.
Connecting approved procedures or customer information does not necessarily mean retraining a model. The design may retrieve relevant documents or use other supported features. Ask how access is enforced and what happens when a document changes or an employee leaves.
The private AI chat service is the place to discuss that scope. The Blueprint includes a security and privacy assessment. If you are deciding between an internal trial and implementation help, read DIY with ChatGPT versus hiring an adviser. Keep the decision tied to your workflow and avoid treating a service label as a regulatory assurance.
For the health-data question below, see OpenAI's BAA eligibility and compliance guidance. Eligibility depends on the product and configuration; a BAA alone does not establish that your application is compliant.
Your organization should decide that explicitly rather than letting convenience become the policy. Personal accounts have different controls from managed workspaces. If a personal account is permitted, define the allowed data and review its settings. Give staff an approved alternative and a way to ask about tasks that fall outside the rules.
Do not assume that it does. OpenAI documents model-improvement settings separately from saved chats and deletion controls. Check the current instructions for the product you use and your workspace policies. Turning off a training setting is not evidence that previous content has been deleted or that no records will be retained.
Do not infer compliance from the product name or a no-training default. OpenAI documents separate BAA eligibility and covered-product requirements and says a BAA alone does not make an application compliant. Have the responsible reviewer assess the exact service and workflow before health information is used. This article makes no compliance claim for Cyber Dogs AI.
A written policy gives the team a shared answer about approved tools, permitted information and responsibility for reviewing output. Keep it practical and pair it with examples. Name an owner and a route for reporting mistakes. Review it when the work changes rather than treating the document as a one-time guarantee of safe use.
A brand-level ranking would hide the important differences between account types, settings and workflows. Compare the current provider documentation against your requirements, including training, retention and connected access. Check feedback exceptions separately. The safer fit for a particular task depends on the approved configuration and how your team actually uses it.
Choose between a DIY ChatGPT trial and scoped AI consulting by comparing workflow complexity, staff time and oversight. Start with one measurable business task.
November 3, 2026 · 10 min read
Build an AI receptionist budget from call volume, setup and oversight. Compare usage charges and calculate break-even using contribution from completed jobs.
November 3, 2026 · 10 min read
Understand AI consulting cost drivers, deliverables and ongoing responsibilities. Define scope and acceptance criteria before discussing a tailored proposal.
November 3, 2026 · 9 min read
The first step
Scoped to your company size
