// Trust & Security Report

    OpenAI Global, LLC logo

    OpenAI Global, LLC

    ChatGPT Edu - OpenAI's dedicated ChatGPT variant for colleges and universities, part of the broader ChatGPT business product suite (Enterprise, Team, Edu, for Healthcare, for Teachers).

    Certifications held

    12

    Maturity

    Enterprise

    Trains on your data

    No

    Trust center

    Yes

    // Certification ledger

    Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.

    SOC 2 Type 2
    HELD

    OpenAI's most recent SOC 2 Report covers controls relevant to the Security, Availability, Confidentiality, and Privacy Trust Services Criteria for the API Platform, ChatGPT Enterprise, ChatGPT Edu, and ChatGPT Team. The report covers the period of January 1, 2025 to June 30, 2025.

    Verify on trust.openai.com
    ISO/IEC 27001:2022
    HELD

    ISO/IEC 27001:2022 certifications for the information security and privacy management systems supporting the OpenAI API, ChatGPT Enterprise, and ChatGPT Edu services.

    Verify on trust.openai.com
    ISO/IEC 27017:2015
    HELD

    ISO/IEC 27017:2015: Cloud security controls

    Verify on trust.openai.com
    ISO/IEC 27018:2019
    HELD

    ISO/IEC 27018:2019: Personal data protection in cloud services

    Verify on trust.openai.com
    ISO/IEC 27701:2019
    HELD

    ISO/IEC 27701:2019 certifications for privacy information management systems supporting OpenAI API, ChatGPT Enterprise, and ChatGPT Edu services.

    Verify on trust.openai.com
    ISO/IEC 42001:2023
    HELD

    ISO/IEC 42001:2023: AI management systems covering consumer and business AI products and models.

    Verify on trust.openai.com
    GDPR
    HELD

    OpenAI is able to execute a Data Processing Addendum (DPA) with customers for their use of ChatGPT Edu in support of their compliance with GDPR and other privacy laws. ChatGPT Enterprise, Edu, or API Projects with EU residency enabled support GDPR compliance.

    Verify on trust.openai.com
    HIPAA
    HELD

    Only ChatGPT Enterprise or Edu customers that have a sales-managed account are eligible for a BAA for ChatGPT at this time. Two specific OpenAI tiers — ChatGPT Enterprise and ChatGPT Edu — can be configured to support HIPAA-regulated workloads under a Business Associate Agreement (BAA) signed with OpenAI.

    Verify on help.openai.com
    PCI DSS v4.0.1
    HELD

    PCI DSS v4.0.1: For payment processing security

    Verify on trust.openai.com
    FedRAMP
    HELD

    FedRAMP 20x: Federal compliance

    Verify on trust.openai.com
    CSA STAR
    HELD

    CSA STAR: Cloud Security Alliance certification

    Verify on trust.openai.com
    TX-RAMP
    HELD

    TX-RAMP: Texas security framework

    Verify on trust.openai.com

    // Privacy & AI training

    Trains on customer data

    No

    Data processing agreement

    Offered

    Data region

    Multiple options: US, Europe, UK, Japan, Canada, South Korea, Singapore, Australia, India, UAE

    OpenAI does not use data from ChatGPT Edu—including inputs or outputs—for training or improving models by default. Your organization's data always remains confidential, secure, and entirely owned by you. Opt-in is available if organizations wish to help improve models, but requires explicit consent.

    // Security controls

    Encryption at rest

    AES-256

    openai.com

    Encryption in transit

    TLS 1.2+

    openai.com

    Access controls

    Strict access controls to limit who can access data

    openai.com

    Data retention controls

    Configurable retention policies for qualifying organizations

    openai.com

    Administrative controls

    Group permissions, SSO, SCIM, and GPT management

    help.openai.com

    // Products & data scope

    ChatGPT EduEducational AI Assistant

    data: Conversations and generated content; not used for model training by default

    Designed for colleges and universities. Includes latest flagship model, advanced tools (data analysis, web browsing, file uploads), ability to build custom GPTs, higher message limits, SSO, SCIM, group permissions, multilingual support (50+ languages)

    // At a glance

    Pricing model

    Per-seat subscription model for institutions; volume-based pricing

    Self-hostable

    No

    // How we verified this

    Every certification marked HELD is confirmed against a verbatim quote on OpenAI Global, LLC's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.

    Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.

    trust.openai.com

    > Browse all vendor trust reports