ChatGPT Business gives a small mortgage brokerage a managed team workspace with business data excluded from model training by default. Choose Enterprise when you need contractual retention controls, more detailed access management or specific data-residency arrangements. Both plans still need rules for client information and a broker checking the output.
ChatGPT Business vs Enterprise
ChatGPT Business suits a brokerage starting with redacted drafting and internal reference material. Enterprise fits a business whose security or procurement requirements need controls beyond the self-service plan.
ChatGPT Team became ChatGPT Business in 2025. The rename did not require existing teams to migrate their workspace or purchase another subscription, according to OpenAI’s Business FAQ.
| Decision | ChatGPT Business | ChatGPT Enterprise |
|---|---|---|
| Buying the plan | Self-service subscription, billed monthly or annually | Sales-led agreement with custom pricing |
| Paid seats | Usually two, combining Standard and Premium seats. Some new workspaces can start with one if checkout permits | Seat requirements form part of the sales proposal |
| Training | Business content excluded by default | Business content excluded by default |
| Retention | Saved content needs a deletion procedure | Custom retention policies available |
| Access management | Workspace administration and single sign-on | Additional role-based controls and automated user provisioning through SCIM |
| Data location | Storage-region selection is rolling out, with separate US safety copies | Eligible regional storage and separate inference-residency options |
OpenAI’s billing guide explains the Business seat minimum and its checkout exception. Business cost depends on the number and type of paid seats, billing period and any extra usage credits. Premium seats provide higher usage allowances. Set a spending limit before enabling additional usage.
The Enterprise plan adds controls including custom retention, SCIM and granular permissions. SCIM automates account provisioning and removal through your identity system. Enterprise pricing reflects the agreed seats, usage and contract terms. A small team can have an Enterprise requirement if its client-data rules demand those controls.
Plus and Pro are personal subscriptions. Buying several personal subscriptions does not create the brokerage’s managed Business workspace. Compare plans by the required administration and data handling, rather than treating a higher personal usage limit as a team control.
How Business Plans Handle Client Data
OpenAI excludes Business and Enterprise inputs and outputs from training by default. Its business data commitments also describe encryption at rest and in transit. Those commitments do not mean that client information disappears after each response.
Retention and Deletion
Regular and archived chats stay saved until deleted or removed by an applicable workspace retention policy. Deleted chats are normally scheduled for removal from OpenAI systems within 30 days, subject to stated security and legal exceptions. Archiving does not delete a chat.
Files can have a separate lifecycle. A file saved separately in Library or Space can remain after its chat is deleted. Project files remain until the file or project is deleted, unless an applicable retention policy removes them. Build a deletion procedure covering those saved copies, using OpenAI’s chat and file retention rules.
For Enterprise, agree the required retention period during procurement and apply the workspace policy before admitting client material. OpenAI’s enterprise privacy commitments distinguish these organisation-level retention controls from its general no-training commitment.
Storage Location
Business storage-region selection is rolling out and is not available to every customer. OpenAI says a selected region covers primary customer content stored at rest. It does not determine where models process requests. For a non-US region, a copy of every prompt and response is still stored temporarily in the US for safety and abuse monitoring. The Business storage explanation describes that distinction.
Eligible Enterprise customers can select Australia for in-scope storage at rest. Australian storage does not establish Australian model processing. OpenAI lists inference residency separately in its Enterprise residency guide. If your policy requires all processing to stay in Australia, a storage-region choice alone does not meet it.
Zero Data Retention on the API
Zero data retention is a separately approved control for OpenAI’s application programming interface, or API. It excludes customer content from abuse-monitoring logs and changes storage behaviour for eligible endpoints. Some features can still retain application state, and additional conditions apply.
It is not a switch that makes a ChatGPT Business subscription retain nothing. A brokerage commissioning an API-based tool needs the actual endpoint and account configuration assessed against OpenAI’s API data controls.
Projects, Connectors and Memory for Client Work
Projects group working material, connectors retrieve information from other services and memory carries context into later conversations. Each changes what ChatGPT can use, so give each a separate policy.
Projects
Use a shared project for approved generic templates and writing instructions. Everyone who joins a shared project can access its shared material, including downloadable files. Keep client-specific work separate and invite only staff assigned to that work.
For a client project approved under your policy, choose project-only memory. It prevents project chats from referencing conversations outside that project or being referenced by chats outside it. Shared projects use project-only memory automatically. The projects guide explains these boundaries and their settings requirements.
Project-only memory still lets conversations use information inside the project. It does not anonymise files or prevent another project member from reading them.
Connectors and Apps
ChatGPT connectors are now managed through apps and plugins. A connected app can retrieve content allowed by the connected account’s source permissions and the workspace’s settings. A broker’s mailbox or document-store access can therefore expose far more than the one file they intended to discuss.
Leave mailbox, full document-store and client-record connections off during the initial rollout. Also leave custom connections and actions that send messages or change records disabled. Approve a connection only when its task needs that access and the permitted data is documented.
Business apps are enabled by default, so an administrator must review them. OpenAI’s app administration guide explains the workspace-wide controls. A project boundary does not replace a review of connected-app permissions.
For an approved app, start with Always ask where that permission is available. Check both reading access and actions that write to another service. OpenAI’s app permission settings distinguish approval prompts from the source account’s actual access.
Memory
For the first rollout, turn memory off and keep client facts out of saved personalisation. Memory can retain details supplied in conversations for later use. A fact useful in one client’s draft can be inappropriate context for another.
Workspace owners can disable memory across Business, and users have their own controls. OpenAI’s Business memory guidance says disabling workspace memory also deletes existing saved memories. Approve that change with the team before removing material they rely on.
Project-only memory requires memory to be enabled at both workspace and account levels. If the brokerage later approves it, enable those prerequisites deliberately and set each client project to project-only. Keep the initial memory-off arrangement until that exception is approved.
Set Up the Workspace
Set the workspace up with dummy information before staff use it for client work. The owner needs authority to buy seats and configure the brokerage’s sign-in arrangements.
- Create the brokerage workspace and give it a recognisable business name. Keep personal workspaces separate so staff can identify the approved destination before pasting anything.
- Assign a responsible owner and a backup owner. Give routine user administration to an admin and ordinary drafting access to members. OpenAI’s member and role guide explains the different permissions.
- Invite named staff through Workspace settings, then Members. Check their role and seat assignment. Business members can invite other members, so require owner approval for invitations and review the member list regularly.
- Configure the approved sign-in method. Where the brokerage uses single sign-on, complete that configuration before rollout. Include removal of workspace access in the staff departure procedure.
- Apply the data-handling settings. Enterprise administrators must save the agreed retention policy. For Business, assign an owner to the deletion procedure and record the storage arrangement selected at checkout. Start with memory disabled.
- Open Admin Console, select the brokerage workspace and review Plugins and the underlying apps. Older controls can appear through Manage Legacy Apps. Disable unapproved connections, then approve only the required apps and actions.
- Create a generic reference project with a dummy template. If client projects are authorised, configure their memory and invite list separately. Give members chat access unless their job needs editing access.
- Sign in as an ordinary member and reopen the saved settings. Confirm the test member sees the intended project, cannot use a disabled app and can draft from the dummy material. Review membership and spending controls before adding the rest of the team.
If a member sees the wrong projects, first check which workspace is active and who appears in the project’s sharing list. If an app is unavailable, check the workspace’s app setting and the connected source account before broadening permissions.
To cancel a Business subscription, the workspace owner opens Workspace settings, then Billing and Manage plan. Use the cancellation control there. Cancellation and workspace deactivation are separate from deleting stored information, so complete the data-retention procedure as well.
Staff Rules That Still Apply
A business plan changes the service terms and administration. Staff still decide what information enters it and whether the result is suitable for a client.
Require staff to redact identifiers and remove unnecessary financial detail before submitting material. An account name removed from a document does not make it anonymous if its address or other details identify the borrower. Prefer a fictional example when the task only needs help with wording.
Treat generated credit explanations and lender-policy statements as drafts. The broker must check the underlying policy, figures and suitability of the message before using it. A confident answer does not establish a client’s eligibility or satisfy the brokerage’s review process.
Write these rules into the brokerage’s AI policy, including approved tasks, prohibited data, sharing limits and an incident contact. Keep the original client record and the reviewed final output in the brokerage’s authorised record system. Start staff on redacted drafting, then approve any broader data access through the same policy.
