ChatGPT Business and confidential documents: what it solves and what it doesn't
The short answer. ChatGPT Business (formerly ChatGPT Team) is a real improvement: OpenAI doesn't train on your business data by default, you get admin controls and a business agreement. But it does not solve one thing: you still send the raw content of your documents to OpenAI. Not training is different from not sending. For confidential client documents, there is one step to take first: replace the details the task doesn't need, such as names, client names and account numbers, and then give ChatGPT Business the protected version.
What ChatGPT Business handles well
Credit where due, this is valuable:
- No training on your business data by default, no opt-out hunting.
- A business agreement instead of consumer terms.
- Admin controls for managing who is in your workspace.
If your team works with AI daily, a business plan is the right foundation. This is not a "ChatGPT bad" story.
What it does not handle
Four things stay open, and they are exactly what your client will ask about:
- The data still leaves your control. Your client's question is not "was it trained on?" but "why were my name and figures sent there at all?". No plan answers that.
- Minimisation remains your duty. GDPR requires processing no more than necessary. A summary usually doesn't need real names or account numbers. An agreement with OpenAI does not release you from that.
- Chat history is an archive. Every chat with raw client data stays in that person's history until it is deleted. One phished account, and everything that person ever pasted is exposed.
- You cannot verify it yourself. Retention and logging happen outside your sight. The policy may be sound; you cannot audit it.
The combination that works
Don't choose between ChatGPT Business and protected documents. Stack them:
| Layer | What it covers |
|---|---|
| ChatGPT Business | Training, administration, contractual base |
| ShareSafe.ai in front | What gets sent in the first place |
| Recovery key with you | Putting the real names back after the answer comes in |
The workflow: put the document through ShareSafe.ai first. It is processed in the EU and not kept as a file. You get a recovery key (Identity Key); ShareSafe Free keeps no copy. The protected version goes into ChatGPT Business, and your key puts the real names back in the answer. How that works team-wide: A 5-step AI workflow for consultants.
FAQ
- Is ChatGPT Enterprise enough then?
- A bigger plan changes the contract and the admin options, not the principle: the raw data is still sent. Minimisation remains your measure, on every plan.
- Does this apply to Claude and Copilot business plans too?
- Yes. Business plans from Anthropic, Microsoft and Google arrange similar things and leave the same question open. The step in front is the same for all of them.
- Doesn't replacing personal data hurt ChatGPT's answers?
- Often less than you'd expect. Consistent placeholders keep the structure: [NAME_01] stays the same person throughout. Replace data the task doesn't need. Leave amounts the model has to compare or calculate with. Try it on one document and judge the answer for your task.
- We already have an agreement with OpenAI. Why this extra step?
- An agreement governs the relationship with the processor. Minimisation governs what you hand that processor. They are two separate obligations, and your client feels the second one most.
ShareSafe.ai keeps raw files in the EU. Minimal retention. You hold the key. Try it with your own document →