30 Days Gen AI Risk Trial -Start Now
Skip to main content
Chatbots·Free; Go $8/mo; Plus $20/mo; Pro $200/mo; Business $25/seat/mo; Enterprise custom·chatgpt.com

ChatGPT

OpenAI's flagship conversational AI assistant powered by GPT models; writes, codes, reasons, browses, runs agents, and creates images/video across web, mobile, and desktop.

Risk Score
High
6/10

Independent assessment across data handling, compliance, security and transparency.

Overview

ChatGPT is OpenAI's consumer and enterprise chat assistant built on the GPT family of models. It handles writing, research, code generation, image and video creation (Sora), voice chat, file analysis, Deep Research, and agentic task execution via Agent Mode. It is the most widely adopted generative-AI product in the enterprise, available in Free, Go, Plus, Pro, Business, Enterprise, and Edu tiers. Business and Enterprise plans add SSO, admin controls, a signed DPA, SOC 2 Type II scope, and a contractual no-training default, while consumer tiers train on user data unless the user toggles it off.

Risk by subscription tier

3

The same vendor often carries very different risk depending on the plan. Free tiers typically allow training on prompts, paid tiers usually do not.

PlanRisk
Team4/10·Medium
Plus7/10·High
Free9/10·Critical

Risk factors

2
  • Consumer tiers train on user data unless toggled off
  • Complexity in understanding data usage policies

Recommendations

2
  • Enhance user education on data privacy settings
  • Provide clearer documentation on data handling

Data handling

Storage
Stored in OpenAI-managed infrastructure (primarily AWS/Azure US); ChatGPT Enterprise and API offer regional data residency in the EU, UK, Japan, Korea, Singapore, India, Canada, and Australia.
Retention
Consumer tiers retain chat history until user deletes it (with 30-day soft delete), subject to ongoing legal hold. Business/Enterprise admins set retention. API Zero Data Retention is available for eligible endpoints and is required for the BAA.
Training on inputs
Consumer Free/Plus/Pro/Go default to training on user inputs unless opted out. ChatGPT Business, Enterprise, Edu, Healthcare, and the API do not train on customer data by default.