ChatGPT Team vs Enterprise security controls: a control-by-control checklist
ChatGPT Business, the plan formerly called Team, covers the basics a small firm needs: single sign-on, no training on your data by default, encryption and a data processing agreement. Enterprise adds the controls auditors and regulated clients ask about: audit log export through the Compliance API, admin-set retention, data residency and your own encryption keys. The security controls in ChatGPT Team vs Enterprise differ most on proof and control, not on basic protection.
This is a reference page. It goes control by control. For the summary view of which plan protects client data, read our Team vs Enterprise vs free comparison. This page does not repeat it.
How to read the table
OpenAI changes these plans often. Features move from Enterprise down to Business. Names change too. So treat each row as a starting point. Then confirm it on OpenAI's own pages before you write it into a policy or a questionnaire.
The three places to check are the OpenAI trust portal, the OpenAI enterprise privacy page and the OpenAI help centre. Where a row says "Check", OpenAI's published detail has shifted more than once. Confirm it for your own account.
Rule of thumb: never quote a plan feature to a client or insurer from memory. Quote the OpenAI page, and note the date you checked it.
The checklist, side by side
| Control | Team / Business | Enterprise | Why a small UK firm cares |
|---|---|---|---|
| SAML single sign-on | Yes | Yes | Leavers lose access when their work account goes. Client audits ask this. |
| SCIM provisioning (accounts created and removed automatically) | Check | Yes | Saves manual joiner and leaver steps. Fewer forgotten accounts. |
| Domain verification | Check | Yes | Stops staff using personal ChatGPT accounts on your work email address. |
| Admin console and roles | Basic workspace admin | Finer roles and permissions | Shows who can change settings. Useful for UK GDPR accountability. |
| Compliance API and audit log export | No | Yes | The record you show an auditor or a regulator after an incident. |
| Retention settings | Limited | Admin-set retention. Zero-retention options by arrangement | UK GDPR says keep personal data no longer than needed. |
| Encryption at rest and in transit | AES-256 at rest, TLS 1.2 or above in transit | Same | Standard insurer question. Both plans answer it. |
| Enterprise key management (your own keys) | No | Yes, as an add-on | Rarely needed by small firms. Some large clients ask. |
| Data residency (where data is stored) | Check | Regional options, including Europe | Some clients insist data stays in the UK or EU. |
| Connector and GPT or app allowlisting | Some admin controls | Fuller controls | Decides whether staff can link ChatGPT to your drives and email. |
| SOC 2 Type 2 and ISO certifications | Covered by OpenAI's business reports | Same | Lets you answer a supplier-security question with a report, not a promise. |
| Data processing agreement | Available | Available | Required under UK GDPR when a supplier handles personal data for you. |
| Training on your data by default | Off | Off | The first question most clients ask. See whether ChatGPT trains on business data. |
Seat prices and minimums
Most comparison pages list seat prices and minimum seat counts. We have left them out on purpose. OpenAI has changed them more than once, and they differ for monthly and annual billing. Enterprise is priced by quote.
Check OpenAI's pricing page on the day you decide. Write down the date. That note is worth more than any figure copied from a blog.
Controls that matter most
Audit export
This is the biggest gap. Business does not give you an exportable log of what was asked and answered. Enterprise does, through the Compliance API.
Why it matters: if a client file goes into ChatGPT by mistake, you need to know what went in. Without a log, you are guessing.
Retention
On Enterprise, an admin can set how long chats are kept. On Business, control is more limited. Staff can delete chats, but you cannot set one rule for everyone.
Residency
Some clients write "data must stay in the UK or EU" into contracts. Enterprise offers regional storage. Check the current options for your plan before you sign that clause.
Gaps on Team that are deal-breakers
For regulated firms, three gaps can rule Business out.
- No audit export. If a regulator, client or insurer expects a record of use, Business cannot produce one from OpenAI's side.
- Limited retention control. If your policy names a retention period, you may not be able to enforce it.
- Residency. If a contract requires UK or EU storage, confirm it before relying on Business.
Solicitors and financial advisers meet these most often. Accountants and recruiters meet them when a large client sends a supplier questionnaire.
Gaps that usually are not
- Your own encryption keys. Few small firms need them.
- Finer admin roles. One or two admins is normal at 10 people.
- SCIM. Handy. Manual removal works if someone owns the leaver checklist.
Encryption, the processing agreement and training-off are the same on both plans. Those are not reasons to upgrade.
What neither plan does
Both plans protect data once it reaches OpenAI. Neither stops a person pasting a client's bank details in the first place. Neither covers staff using a personal account, or a different AI tool.
That is the question insurers now ask. Our guide on what cyber insurers ask about AI use covers the answers. For clients, see how to reply to a client asking about your AI controls.
Helio Guard works before anything is sent. Checked on the PC. Sensitive items are taken out and swapped for labels, so the question still goes. It works with Business, Enterprise and other AI tools alike, and you get a monthly record to show clients or insurers. See Helio Guard pricing if that gap matters to you.
Common questions about ChatGPT Team vs Enterprise controls
Is ChatGPT Business the same as ChatGPT Team?
Yes. ChatGPT Business is the new name for the plan OpenAI used to call Team. The security controls carried over with the rename. Older guides, contracts and questionnaires may still say Team. Treat the two names as the same plan, but check OpenAI's help centre for any feature changes made since the rename.
Does ChatGPT Business have audit logs?
ChatGPT Business does not offer audit log export through the Compliance API. That export is an Enterprise feature. Business admins can manage members and some settings, but cannot pull a full record of conversations for an auditor. If you need a usage record on Business, it has to come from a separate tool.
Can a small firm get ChatGPT Enterprise?
ChatGPT Enterprise is sold through OpenAI's sales team, priced by quote, and has historically carried a minimum seat count well above most small firms. Ask OpenAI directly for the current minimum. Many small firms find Business plus their own controls meets what clients and insurers ask.