// Trust & Security Report
ChatGPT
by OpenAI
ChatGPT - AI conversational assistant available in multiple tiers: Free/Plus/Pro (consumer), Team/Business (team/organizational), Enterprise (large-scale), Edu (education), Healthcare (HIPAA-compliant), and API Platform (developer). All powered by latest GPT models with options for extended capabilities like voice, file upload, image generation, and code execution.
Certifications held
13
Maturity
Enterprise
Trains on your data
Unknown
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on openai.com“Enterprise products and programs 8 products · 3 audit programs Product SOC 2 Type 2 ISO/IEC 27701:2019 ISO/IEC 27001:2022 ChatGPT Business A shared ChatGPT workspace for work, with admin controls”
Verify on openai.com“programs 8 products · 3 audit programs Product SOC 2 Type 2 ISO/IEC 27701:2019 ISO/IEC 27001:2022 ChatGPT Business A shared ChatGPT workspace for work, with admin controls and apps for company tools. ✓”
Verify on openai.com“rprise products and programs 8 products · 3 audit programs Product SOC 2 Type 2 ISO/IEC 27701:2019 ISO/IEC 27001:2022 ChatGPT Business A shared ChatGPT workspace for work, with admin controls and apps for company”
Verify on openai.com“ystems supporting the OpenAI API, ChatGPT Enterprise, and ChatGPT Edu services. ISO 42001 OpenAI maintains an ISO/IEC 42001:2023 AI Management System covering OpenAI’s consumer and business AI products and mod”
Verify on openai.com“OpenAI maintains PCI-DSS compliance for the components of ChatGPT that support delegated payment processing.”
Verify on trust.openai.com“have discovered a vulnerability, please send us a note. Report issue Built on FedRAMP 20x OpenAI FedRAMP 20x FedRAMP has granted OpenAI a FedRAMP 20x Moderate authorization for the ChatGPT Enterprise and”
Verify on openai.com“OpenAI supports our customers’ compliance with privacy laws, including the GDPR, CCPA, HIPAA, and FERPA, and offers a Data Processing Addendum and Business Associate Agreement for customers.”
Verify on openai.com“A secure AI workspace for healthcare that supports HIPAA-compliant use with trusted clinical search.”
Verify on openai.com“OpenAI contractually restricts itself from retaining, using, disclosing, or otherwise processing customer data except as necessary for business purposes specified in the agreement, when the data is subject to the CCPA. OpenAI does not 'sell' or 'share' personal data as those terms are defined by the CCPA.”
Verify on trust.openai.com“Party Dependence Yes Hosting Major Cloud Provider Reports Data Flow Diagram SOC 3 Report Network Diagram View more Access Control Access Log Management Bring Your Own Device (BYOD) Data Access View”
Verify on openai.com“liance for the components of ChatGPT that support delegated payment processing. CSA Star Level 1 ChatGPT business product services and the API Platform have been evaluated by the Cloud Security Alliance Secur”
// Privacy & AI training
Trains on customer data
Not stated
Data processing agreement
Offered
Data region
Available in 10+ regions: Europe, United Kingdom, United States, Canada, Japan, South Korea, Singapore, India, Australia, United Arab Emirates. Data residency can be selected for ChatGPT Enterprise, ChatGPT Edu, and API Platform customers.
Training policy varies by tier. For Consumer plans (Free, Plus, Pro): Data is used for model improvement by default, but users can opt out via Settings > Data Controls > 'Do not train on my content'. For Business/Team/Enterprise/Edu plans: By default, OpenAI does not use inputs or outputs for training or improving models. ChatGPT for Healthcare explicitly does not train on data.
// Security controls
Encryption in Transit
TLS 1.2 or higher between customer and OpenAI, and between OpenAI and service providers
openai.comEnterprise Key Management (EKM)
Customers can bring their own encryption keys for customer content stored at-rest, providing customer-managed encryption
openai.comData Residency
Available in Europe, UK, US, Canada, Japan, South Korea, Singapore, India, Australia, UAE. Covers conversations, uploaded files, custom GPTs, and image generation artifacts.
openai.comAudit Logs
Available for enterprise customers to monitor and track access to workspace data
openai.comSOC 2 Type 2 Audit Scope
Covers Security, Availability, Confidentiality, and Privacy Trust Services Criteria for API Platform, ChatGPT Enterprise, ChatGPT Edu, and ChatGPT Team
trust.openai.com// Products & data scope
Data it handles: Personal conversations used for model training by default (opt-out available)
Entry-level access to ChatGPT with limitations on model access and usage
Data it handles: Personal conversations used for model training by default (opt-out available)
Monthly subscription ($20/mo) with access to advanced models and features
Data it handles: Personal conversations used for model training by default (opt-out available)
Premium monthly subscription ($200/mo) with highest usage limits and priority access
Data it handles: Team data NOT used for training by default. No training on workspace data.
Shared workspace for small teams ($30/person/month) with centralized billing and admin controls
Data it handles: Business data NOT used for training by default. No training on workspace data.
Organizational workspace with extended session length, custom controls, and admin management. Governed by OpenAI Business Terms.
Data it handles: Enterprise data NOT used for training by default. No training on workspace data.
Enterprise-grade security with advanced data privacy controls, custom data retention, encryption at rest and in transit, data residency options, audit logs, and unlimited usage
Data it handles: Educational data NOT used for training. No training on workspace data.
Designed for educational institutions with data residency support and compliance features. Requires institutional sign-up.
Data it handles: Healthcare data NOT used for training. HIPAA-compliant secure workspace.
Specialized version for healthcare organizations with Business Associate Agreement support, HIPAA compliance, data residency, audit logs, and customer-managed encryption keys
Data it handles: API data NOT used for training by default (enterprise plan). Data residency available for eligible customers.
Developer API with enterprise compliance, SOC 2 Type 2 coverage, ISO 27001 certification, and FedRAMP authorization
// What to watch
- Consumer plans (Free/Plus/Pro) train on user data by default with opt-out required. This is standard for free tiers but represents a privacy difference from paid business/enterprise products.
- FedRAMP Moderate authorization is recent (March 2025) - may have limited government adoption yet as it's a new fast-track authorization pathway (FedRAMP 20x).
- Identity verification: ChatGPT is unambiguously OpenAI's official product. All certificates and policies verified from openai.com domain. No conflation risk.
// At a glance
Pricing model
Freemium with tiered subscriptions. Consumer: Free tier, Plus ($20/mo), Pro ($200/mo). Teams/Orgs: Team ($30/person/mo), Business (custom), Enterprise (custom). API: Pay-as-you-go plus enterprise plans.
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on OpenAI's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trust.openai.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.