What makes AI use secure?
Data location
You know which company, and which computer, processes each prompt and file.
No training
Your content isn’t used to improve someone else’s model.
Access
People and the assistant see only what their role allows.
Accountability
Logs show who did what, and a person reviews output before it leaves.
The 10-point checklist
- Use work accounts onlyBusiness-plan protections apply to the work account, not to a staff member’s personal login.
- Turn off training where you canPersonal ChatGPT plans share data for training by default; business plans don’t.
- Decide what never goes into cloud AIFor example: tax IDs, account numbers, health details and privileged strategy.
- Set retentionKnow how long chats are kept and who can delete them.
- Limit connectorsConnect only the mailboxes and folders the job needs.
- Restrict by roleFolder-level access so the assistant can’t surface files a person couldn’t open.
- Log admin and remote accessEvery support session recorded.
- Watch for instructions hidden in contentEmails and documents can contain text meant to steer an AI; review actions it proposes.
- Review before sendingNothing goes to a client or regulator without a person reading it.
- Write it downA one-page policy staff can follow, reviewed yearly.
Cloud vs on-site: who controls what
| Consumer AI (Free, Plus, Pro) | Business cloud plans | On-site model (AdminOnsite) | |
|---|---|---|---|
| Where prompts are processed | Vendor’s servers | Vendor’s servers | Your office |
| Training default | On, unless you turn it off | Off by default | No vendor involved |
| Retention | Vendor settings; temporary chats up to 30 days | Admin-controlled on many plans; deleted chats removed within 30 days at OpenAI | You decide |
| Who else can access content | Vendor staff for abuse and support, per vendor terms | Vendor staff and contractors for abuse review, per vendor terms | Our logged support access only |
| Patching and uptime | Vendor | Vendor | Us (managed) or your IT |
| Model quality | Frontier | Frontier | Strong for office work; behind frontier models on hard reasoning |
OpenAI details from its Enterprise privacy and Data controls pages, checked November 13, 2026.
Is on-site AI automatically secure?
No. Keeping data in the building removes one risk, the AI vendor, and leaves the usual ones: an unpatched computer, weak passwords, an exposed port, over-broad folder access. An on-site box still needs updates, disk encryption, backups and logged remote access. That’s the part AdminOnsite manages.
Questions
Is ChatGPT secure for business?
OpenAI’s business plans encrypt data in transit and at rest, don’t train on workspace data by default and have completed SOC 2 Type 2 audits, per OpenAI. Whether that’s secure enough depends on your files and your clients: the data is still processed and stored by OpenAI.
What data should you never put into AI?
Into consumer AI accounts: anything confidential. Even on business plans, many firms keep out tax IDs, account numbers, health information and privileged strategy unless contracts and policy allow it.
What is AI data privacy?
Control over what personal or client information an AI system receives, who can see it, how long it’s kept and whether it trains a model.
Is AdminOnsite certified for compliance?
We don’t make compliance or certification claims. AdminOnsite keeps processing on a box in your office; your obligations are for you and your advisors to confirm.