Last reviewed: 16 October 2026

Most likely to change: menu names and locations (OpenAI is moving admin controls into a Global Admin Console), retention options, the apps/plugins model, and which plans get which controls. Re-check the OpenAI Help Center references before each quarterly review.

Contents
  1. Executive summary
  2. Who this is for & prerequisites
  3. Concepts: two layers of control
  4. The 10 settings
  5. Prioritization
  6. Validation
  7. Common mistakes & trade-offs
  8. Framework mapping
  9. One-page checklist
  10. Key takeaways
  11. References

Executive Summary

Most ChatGPT data exposure in organizations doesn't come from a breach at OpenAI. It comes from settings nobody reviewed and from employees using personal accounts that sit outside corporate control. The scale is real: Menlo Security's 2025 report found that 68% of employees use free-tier AI tools like ChatGPT through personal accounts, and 57% of them enter sensitive data.[21] The defaults also differ sharply by plan. Free, Plus, and Pro conversations may be used to train models unless the user opts out, while Business, Enterprise, and Edu have no training by default and admin-controlled retention.[25]

Bottom line: move work into a managed workspace, configure the ten settings below, send the logs to your SIEM, and close the personal-account gap with policy and technical controls.

Who this is for

  • Security, IT, and privacy leads who own (or are about to own) a ChatGPT Business or Enterprise workspace.
  • GRC teams writing or auditing an AI acceptable-use policy.
  • SOC teams who need to know what telemetry exists.

Prerequisites

  • Owner or Admin role on the ChatGPT workspace. Only owners and admins can change key settings such as permissions, seat types, spend controls, and feature access.[9]
  • Know your plan. Several controls below (RBAC, custom retention, Compliance API, disabling shared links) are Enterprise/Edu-only. Each section says so.
  • An existing data classification scheme and an AI acceptable-use policy (even a draft).
  • A non-admin test account in the workspace, for validation.

Concepts: Two layers of control

Think of ChatGPT privacy as two layers:

LayerWho controls itExamples WorkspaceOwners / AdminsRetention, memory availability, link sharing, apps, GPTs, SSO, logs UserEach personTraining toggle (personal plans), memory contents, temporary chats, shared links they created

Two points matter most here:

  1. Workspace settings constrain user settings, but don't always mirror them. One security vendor found the workspace memory toggle and the desktop app's memory toggle are independent, so admins should check both.[23]
  2. Plan type changes the defaults. Business workspaces are excluded from training by default.[10] Personal accounts are not.

The 10 settings

Each setting covers: where it lives, the recommended value, why it matters, and how to verify it.

1. Model training ("Improve the model for everyone")

Settings → Data controls (personal accounts)

When "Improve the model for everyone" is off, new conversations aren't used to train OpenAI models.[1] The setting reaches beyond chat:

  • On a personal plan, it also covers Codex tasks.[1]
  • In the ChatGPT Atlas browser, a sub-setting (Include web browsing) controls whether browsed content can be used for training.[2]

Recommended: For managed workspaces, confirm the no-training default in your contract and DPA. For any personal account an employee is permitted to use, turn the setting off.

Why: It only works going forward. Turning it off doesn't delete or hide saved chats.[1]

Verify: Screenshot-based attestation for permitted personal accounts; contract terms for workspaces.

2. Memory (workspace and user)

Workspace Settings → Memory · User: Settings → Personalization → Memory

ChatGPT has two memory types: saved memories (details it keeps for future chats) and chat history reference (drawing on past conversations even when nothing was saved).[3] Turning off saved memories also turns off chat history reference.[3]

NOTE: THE DELETION TRAPDeleting a chat does not remove a memory saved from it, and turning memory off does not erase what's already stored. To fully remove something, delete both the saved memory and the original chat.[3]

Recommended (practitioner judgment):

  • Allow memory for general productivity users.
  • Disable it via RBAC for roles that routinely handle regulated data (legal, HR casework, clinical, M&A).
  • Teach everyone the two-step deletion.

Verify: As the test user, confirm the toggles match workspace policy on web and desktop.

3. Chat retention policy

Enterprise workspace settings or your OpenAI account team
  • By default, chats are kept until the user deletes them. Enterprise owners can set a custom workspace retention policy, with a 90-day minimum.[6]
  • Deleted chats leave the account immediately and are scheduled for permanent deletion within 30 days.[5]
  • Archiving is not deletion. Archived chats follow normal retention rules.[5]
  • Files have their own lifecycle. Deleting a chat doesn't delete Library files, and uploaded files expire independently of chat retention.[5]

Recommended: Align retention with your records schedule and legal-hold process. Short retention reduces exposure but limits how many past chats ChatGPT can reference.[6]

WARNINGShortening retention is effectively irreversible for content outside the new window. Before changing it: get sign-off from Legal and Records, confirm no litigation hold covers ChatGPT data, and export anything required via the Compliance API.

Verify: Query the Compliance API for a conversation older than the new window. It should be unavailable. Internal backups may keep it up to 30 more days.[5]

4. Temporary Chat

"Temporary" button on a new chat
  • A temporary chat stays out of history and isn't used for training while it stays temporary.[4]
  • It is not a no-trace mode. OpenAI may keep a copy for up to 30 days for safety purposes.[4]
  • On Enterprise, temporary chats are available through the Compliance API for 30 days, even if workspace retention differs.[4]

Recommended: Present Temporary Chat as "doesn't clutter history or memory," not as "private" or "off the record." If employees believe it evades monitoring, that's both a policy misunderstanding and an insider-risk blind spot.

Verify: Run a temporary chat from the test account and confirm it appears in your Compliance API pull.

5. Shared links

Workspace settings → Permissions & roles · User: Settings → Data controls → Shared links → Manage
  • Enterprise: chats can't be shared outside the workspace. An Enterprise shared link keeps showing new messages added after sharing.[8] A link shared for one answer exposes everything typed in that chat afterward.
  • Business: links are restricted to the workspace, but there's no workspace-wide switch to disable sharing.[7]
  • Personal accounts: links are anonymous by default and have no per-recipient access controls.[7]

Recommended:

  • Enterprise: restrict link sharing via RBAC to roles that need it.
  • All users: clean up links periodically. Use More actions → Delete all shared links.[7]
  • Teach users to start a new chat after sharing if they'll continue with sensitive content.

Verify: Open a test link from a browser signed into another workspace or personal account. Access should fail.

6. Apps, connectors, and plugins

Workspace settings → Apps / Admin Console → Plugins

Connected apps let ChatGPT read from, and sometimes act on, systems like Drive, SharePoint, CRM, and code repositories. This is the setting with the largest blast radius.

  • Business: apps are on by default. Admins choose which apps are available and which actions each can take.[12]
  • Enterprise/Edu: plugins and apps have separate RBAC checks. A member can have a plugin installed but still be blocked from one of its apps.[13]
  • Source permissions still apply. App access in ChatGPT doesn't override the connected system's permissions.[14] Overshared SharePoint sites become overshared ChatGPT answers.
  • Custom MCP servers are a separate risk. RBAC controls who may connect them, and only admins and owners can publish apps for the workspace.[15]

Recommended:

  • Business: start from deny and disable unused apps.
  • Enterprise: enable apps per role.
  • Restrict write/action permissions until there's a defined use case.
  • Limit developer mode and custom MCP to a named engineering group.
  • Fix source-system oversharing before connecting anything.

Verify: As the test user, confirm unapproved apps don't appear. Review the enabled-app list quarterly against your software inventory (CIS Control 2).

7. GPTs and third-party actions

Workspace settings → Permissions & roles

Custom GPTs can call external APIs through "actions," and that data leaves OpenAI's boundary. The receiving service may keep it beyond 30 days and use it for other purposes.[4]

Enterprise admins have several controls:[16]

  • An allowlist of domains that GPT actions may call.
  • Management of GPT sharing, configuration review, removal, ownership transfer, and global GPT capabilities.
  • Approval of specific third-party GPTs, or a global allow/block for all external GPTs.

Recommended:

  • Block external GPTs by default.
  • Allowlist action domains.
  • Treat each action endpoint as a third-party processor that goes through vendor risk review.
  • Transfer GPT ownership during offboarding so GPTs aren't orphaned.

Verify: Try to create a GPT action to a non-allowlisted domain from the test account. It should be blocked.

8. Identity: SSO, SCIM, domain verification

OpenAI Identity in the Global Admin Console
  • Domain verification is required before enabling SSO and Automatic Account Creation (AAC).[17]
  • SSO enforcement is narrower than many admins assume. It only covers logins whose email matches a verified domain. Users on other domains can still sign in with a password or social login.[17]
  • SCIM directory sync is Enterprise-only.[19]
  • AAC: OpenAI advises against enabling it alongside SCIM.[17]

Recommended:

  • Verify every corporate domain, including subsidiaries and acquired domains.
  • Enforce SSO with MFA at the IdP.
  • Use SCIM for joiner/mover/leaver. Offboarding speed is your biggest privacy win here.
  • Review guest (non-verified-domain) members quarterly.
TIPExisting personal accounts on your domain are prompted to migrate into the Enterprise workspace when invited.[18] Plan communications for this step. It's your best chance to bring pre-existing personal-account history under management.

Verify: A deprovisioned test user loses access within your SLA. A password login with a verified-domain email redirects to SSO.

9. Compliance logs and audit

Enterprise Compliance API / OpenAI Compliance Logs Platform
  • As of December 2025, the Compliance API sits inside the OpenAI Compliance Logs Platform, which added Admin Audit, User Authentication, and Codex Usage logs.[16]
  • Workspace owners can use it directly or through eDiscovery and DLP integrations.[16]

Recommended: Stream logs to your SIEM/archive. Alert on admin-setting changes, new app enablement, SSO configuration changes, and anomalous bulk activity.

Detection ideas (practitioner judgment; tune to your environment):

  • Retention or sharing setting changed outside a change window.
  • New custom app or MCP connection published.
  • One user exporting or deleting unusually large volumes before a resignation date. Correlate with HR feeds.

Verify: Make a known admin change and confirm it reaches the SIEM within your expected latency.

10. Personal accounts on work devices (the shadow-AI gap)

Outside ChatGPT: proxy, CASB/SSE, browser management, policy

The risk is measurable:

  • Verizon's 2025 DBIR (as reported by DuoCircle) found 15% of employees routinely use generative AI on corporate devices, and 72% of them do so with personal email accounts, out of reach of corporate DLP and logging.[24]
  • Harmonic Security's Q3 2025 data attributed 11.84% of sensitive data exposures to personal and free-tier accounts, and warned that departing employees can keep enterprise data in those accounts.[22]

If personal use is permitted at all, mandate these settings:

  • Training off (setting #1).
  • Memory reviewed (setting #2).
  • Shared links purged (setting #5).
  • Ad personalization off, where applicable. Ad Controls exist only for Free and Go users in ad markets; paid tiers like Plus, Pro, and Enterprise are ad-free.[20]

Recommended technical controls:

  • Use tenant restrictions or SSE policy to allow the corporate workspace and block or coach on personal ChatGPT logins.
  • Apply browser DLP for paste/upload of classified data.
  • Avoid a blanket block without a sanctioned alternative. In practice, that just pushes usage to phones.

Prioritization

Do this first (high impact, low effort)

#ActionPlan 1Verify domains, enforce SSOBusiness / Enterprise 2Lock apps/connectors to an approved list; restrict actionsAll managed 3Restrict link sharing (RBAC)Enterprise 4Block external GPTs; allowlist action domainsEnterprise 5Publish a one-page user guide: training toggle, Temporary Chat ≠ private, two-step memory deletionAll

Longer-term improvements

  • Compliance API → SIEM pipeline with detections.
  • Retention policy aligned to the records schedule.
  • SCIM-based lifecycle management.
  • SSE/CASB controls for personal-account use.
  • Quarterly settings review, owned by a named person.
  • Source-system permission cleanup before expanding connectors.

Validation: How to confirm the settings stuck

TestExpected resultEvidence source Test user opens a workspace shared link from an outside accountAccess deniedBrowser / screenshot Test user tries to enable a non-approved appNot visible / blockedUI GPT action to a non-allowlisted domainBlockedUI Admin changes a settingEvent in SIEMAdmin Audit log Temporary chat by test userVisible in Compliance API pullCompliance API Deprovision a test user in the IdPAccess revoked within SLAUser Authentication log Personal ChatGPT login from a managed deviceBlocked or coached per policySSE / proxy logs

Metrics worth tracking:

  • Share of ChatGPT traffic going to the managed workspace versus personal accounts.
  • Number of enabled apps with write/action scopes.
  • Count of active shared links.
  • Time-to-deprovision.

Common mistakes and trade-offs

  • "Temporary Chat is off the record." It isn't. There's a 30-day copy, and it's visible to the Compliance API on Enterprise.
  • "We deleted the chat, so it's gone." Saved memories, Library files, and shared links each have separate lifecycles.
  • Retention set too short or too long. Too short hurts usefulness and can conflict with legal holds. Too long expands the discovery surface. Let Records and Legal own the number.
  • Over-blocking. It drives usage to unmanaged devices. Pair restrictions with a sanctioned path.
  • Trusting connector scoping alone. ChatGPT honors source permissions, so source oversharing is inherited.
  • Assuming "Enforce SSO" covers everyone. It doesn't cover unverified-domain guests.

Framework mapping

Practitioner mapping; validate against your control library.

Setting areaNIST CSF 2.0CIS Controls v8.1ISO/IEC 27001:2022 Annex A AI use policy, personal accountsGV.PO, GV.SC14 (Awareness), 15 (Service Providers)5.10, 5.23 SSO/SCIM, RBACPR.AA5, 65.15, 5.16, 5.18 Retention, deletion, sharing, memoryPR.DS3 (Data Protection)5.12, 8.10, 8.12 Apps, GPTs, connectorsGV.SC, PR.PS2, 155.19–5.23 Compliance / audit logsDE.CM8 (Audit Log Mgmt)8.15, 8.16

MITRE ATT&CK (detection context):

  • Data leaving through personal AI accounts looks like T1567 (Exfiltration Over Web Service) from a detection standpoint, even without malicious intent.
  • Harvesting shared conversations aligns with T1213 (Data from Information Repositories).

One-page checklist

  • Plan confirmed; contract/DPA states no training on business data
  • All corporate domains verified; SSO enforced; MFA at IdP
  • SCIM enabled (Enterprise); AAC off if SCIM in use
  • Guest (non-verified-domain) members reviewed
  • Memory: workspace setting decided; restricted for regulated roles via RBAC
  • Retention period approved by Legal/Records; legal-hold process documented
  • Link sharing restricted (Enterprise) or user cleanup cadence set (Business)
  • Apps/connectors: approved list only; action/write scopes minimized; custom MCP limited
  • External GPTs blocked; GPT action domains allowlisted
  • Compliance logs flowing to SIEM; alerts on admin and app changes
  • SSE/proxy policy for personal ChatGPT accounts on managed devices
  • User guide published (training toggle, Temporary Chat, memory deletion, link hygiene)
  • Validation tests run and evidence filed
  • Quarterly review scheduled with a named owner

Key Takeaways

  • The biggest privacy risk is the account type, not a toggle. Get work into a managed workspace first.
  • Deletion is multi-part: chats, saved memories, Library files, and shared links each have their own lifecycle.
  • Temporary Chat reduces clutter, not visibility.
  • Connectors inherit source permissions, so fix oversharing upstream.
  • Logs in the SIEM turn settings into verifiable controls.
  • Re-review quarterly, because these menus move often.

References

  1. Data controls in ChatGPT — OpenAI Help Center, accessed Oct 2026. Link
  2. ChatGPT Atlas – Data Controls and Privacy — OpenAI Help Center, accessed Oct 2026. Link
  3. Memory FAQ; How does "Reference saved memories" work? — OpenAI Help Center, accessed Oct 2026. Link 1 · Link 2
  4. Temporary chat in ChatGPT — OpenAI Help Center, accessed Oct 2026. Link
  5. Chat and File Retention Policies in ChatGPT — OpenAI Help Center, accessed Oct 2026. Link
  6. Data governance and compliance — OpenAI Academy, 2026. Link
  7. Sharing conversations and scheduled tasks in ChatGPT — OpenAI Help Center, accessed Oct 2026. Link
  8. ChatGPT Shared Links FAQ (Enterprise Version) — OpenAI Help Center, accessed Oct 2026. Link
  9. Managing workspace settings in ChatGPT Enterprise — OpenAI Help Center, accessed Oct 2026. Link
  10. Managing data, sharing, and privacy in ChatGPT Business — OpenAI Help Center, accessed Oct 2026. Link
  11. ChatGPT Enterprise and Edu release notes — OpenAI, 2026. Link
  12. ChatGPT Business release notes — OpenAI, 2026. Link
  13. Admin controls, security, and compliance for plugins and apps — OpenAI Help Center, 2026. Link
  14. Managing feature access with role-based access control in ChatGPT — OpenAI Help Center, 2026. Link
  15. Developer mode and MCP apps in ChatGPT — OpenAI Help Center, accessed Oct 2026. Link
  16. New compliance and administrative tools for ChatGPT Enterprise (updated Dec 2025) — OpenAI. Link
  17. SSO overview; Login and authentication FAQs (SSO, SCIM, domain verification) — OpenAI Help Center, accessed Oct 2026. Link 1 · Link 2
  18. Getting started with identity and provisioning in ChatGPT Enterprise, Edu, and ChatGPT for Teachers — OpenAI Help Center. Link
  19. SSO for ChatGPT Business – FAQ — OpenAI Help Center. Link
  20. Ads in ChatGPT — OpenAI Help Center, 2026. Link
  21. 2025 Report: How AI is Shaping the Modern Workspace (press release) — Menlo Security, Aug 2025. Link
  22. GenAI in the Enterprise: It's Getting Personal — Harmonic Security, 2025. Link
  23. Securing ChatGPT Enterprise Guide — Harmonic Security, 2026. Link
  24. Shadow AI in the Inbox (citing Verizon 2025 DBIR) — DuoCircle, 2026. Link
  25. OpenAI Data Retention Policy (2026): What They Keep, and For How Long — Humla, 2026. Link