General-purpose · General-purpose assistants · Medium confidence
OpenAI, OpCo, LLC · ChatGPT Business workspace (formerly Team). Standard and Premium seats. Not Enterprise, Edu, Healthcare, consumer ChatGPT or the API. Enterprise/Edu residency and SCIM do not automatically apply.
Managed general-purpose assistant for teams. No training by default. Optional storage residency is a gradual rollout and does not constrain inference; US abuse-monitoring copies still apply.
Opens a private software assessment of ChatGPT Business for one task, with this profile’s questions to hand.
| Deployment | SaaS |
|---|---|
| Hosting regions | United States, UnknownHosting regions source, checked 2026-10-10 (opens in a new tab) |
| Australian region | Unknown |
| Model providers | OpenAI |
| Assurance | SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018, ISO 27701, CSA STAR |
| Training on customer content | NoTraining on customer content source, checked 2026-10-10 (opens in a new tab) |
| Retention summary | Workspace retention is not the same as Enterprise custom windows. Storage residency (where offered) covers prompts and responses at rest in the chosen region. A copy of every prompt and response is still stored in the United States for a limited time for safety and abuse monitoring. Inference is not tied to the storage region. |
| Integrations | plugins and apps (many enabled by default), ChatGPT Work, Codex, SAML SSO |
| Pricing summary | Self-serve Try ChatGPT Business plus contact-sales. Mix Standard and Premium seats (Premium advertised as 5× usage, no five-hour limit). List price was not on the Business marketing page extract. |
| Legal content coverage | None as a licensed citator. Astra for Law is described as Enterprise Trusted Access, not as a Business SKU. |
| Australian presence | Unknown — Business data residency is rolling out gradually and is not yet available to all customers. The Business help article does not name Australia as a selectable region. Enterprise/Edu Australian storage is a different product path. |
A later research check disagrees with a value already on this profile. The published value is unchanged.
Define the configuration, people, information and tasks being assessed.
Public claim only
ChatGPT Business is the managed team workspace (marketing still uses team-sign-up URLs). It is not ChatGPT Enterprise. Need Enterprise for SCIM, role-based access controls and data residency as advertised on the Business page CTA.
Ask: Confirm the workspace is Business not Enterprise, and whether Standard or Premium seats are on the order.
Public claim only
Business data residency is rolling out gradually. Selecting a non-US storage region does not provide inference residency. Abuse-monitoring logs stay in the United States; a copy of every prompt and response is also stored in the US for a limited time even if primary content is stored elsewhere. Shopping is unavailable when residency is on.
Ask: Is residency enabled for our Business workspace, which region, and do we accept US abuse-monitoring copies?
Public claim only
Shared company context, plugins, ChatGPT Work and Codex. Mix Standard and Premium seats. Many apps are enabled by default; admins can change workspace access.
Ask: Which apps, Work and Codex are enabled?
Not confirmed
The Business storage article does not list Australia as a checkout region. Enterprise/Edu residency (which does list Australia) is expressly not this product.
Ask: Can an Australian firm obtain Business storage residency, or must we buy Enterprise?
Record the practical work needed to introduce and maintain the software.
Not confirmed
No public per-seat list price on the Business page extract. Flexible seats; optional credits for power users.
Ask: Itemised Standard vs Premium seat price, credits, renewal and notice.
Public claim only
Business includes SAML SSO and MFA. SCIM, RBAC and data residency are listed as Enterprise (contact sales). Apps: many enabled by default on Business.
Ask: Demonstrate SAML SSO and admin disable of apps; confirm SCIM is not required or that we must upgrade.
Not confirmed
No public Business SLA. Enterprise-grade support subprocessors sit on the shared business-data / subprocessor story, not a Business-specific SLA page.
Ask: What support tier is on the Business order?
Compare complete work at the required quality, including checking and correction.
Not confirmed
No Business-specific legal benchmark. Astra for Law Vals AI figures are an Enterprise Trusted Access announcement, not this SKU.
Ask: Do not apply Astra for Law scores to Business.
Not confirmed
General-purpose team assistant. Web search, apps and Work can send data outside the workspace region. Not a substitute for a licensed citator.
Ask: Which tasks, if any, will run in Business vs a legal-specific tool?
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Not confirmed
Business is a processor-style workspace with no-training-by-default, but US abuse-monitoring copies and default-on apps remain. Not Healthcare/BAA unless a separate product.
Ask: What client types may be processed here, and are apps/Work off for those matters?
Public claim only
OpenAI is the model provider. Cloud infrastructure subprocessors (Microsoft, AWS, GCP, Oracle, CoreWeave, Cerebras) are hosting, not substitute model vendors.
Ask: Which model IDs are enabled, and is GPT-6 Astra Law (Enterprise Trusted Access) absent?
Public claim only
Shared OpenAI sub-processor list (updated 9 July 2026 on the Enterprise sibling scrape; this review re-read the same URL). Includes Microsoft (including Australia), AWS, GCP, Cloudflare, TaskUs (Philippines — GPT moderation on Enterprise/Edu/Business), Intercom, Salesforce, WorkOS. Subscribe for new subprocessors.
Ask: Notice/objection rights for Business, and whether TaskUs will see our chats.
Public claim only
Business-data page and training FAQ: by default OpenAI does not use ChatGPT Business inputs or outputs to train or improve models. Explicit opt-in (feedback/evals/API dashboard) is the exception. Marketing line: 'Your data is never used for training our models.'
Ask: Confirm no workspace-level training opt-in is enabled, including feedback sharing.
Public claim only
Default off for business data. Explicit opt-in through feedback mechanisms can share data for training.
Ask: Disable training-related feedback for the Business workspace.
Public claim only
Business storage article: primary prompts/responses at rest in the selected region if residency is on. US abuse-monitoring copy of every prompt and response for a limited time. Enterprise custom retention windows are a different product. Deleted-chat 30-day purge is documented on the general ChatGPT retention article, which also discusses workspace policies.
Ask: What is the Business workspace retention setting, including US monitoring copies and backups?
Not confirmed
No Business-specific deletion certificate. Member-removal behaviour is a separate help article not scraped in this pass. DPA deletion terms need the signed copy.
Ask: Matter-level deletion, backup lag, and offboarding when a lawyer leaves the workspace?
Public claim only
US abuse-monitoring copies imply automated and possibly human review of flagged content. TaskUs is listed for GPT moderation on Business. Support tickets go to Intercom/Salesforce.
Ask: When can OpenAI or TaskUs read our Business chats, from which countries?
Public claim only
SAML SSO and MFA. Admins control users, usage and billing and can disable apps. SCIM and RBAC are sold as Enterprise. Many apps start enabled.
Ask: Show least-privilege roles and that unused apps are disabled.
Public claim only
Business-data / Edu marketing: encryption at rest AES-256 and in transit TLS 1.2+ is stated on the Edu page and the shared business-data trust story. Confirm it applies to Business in the signed DPA.
Ask: Confirm AES-256/TLS 1.2+ and key management for Business in the DPA.
Public claim only
Business-data page: CSA STAR, SOC 2 Type 2, ISO 27001/27017/27018/27701, with links into trust.openai.com. Reports were not inspected. BAA is a Healthcare add-on, not Business.
Ask: Current SOC 2/ISO reports scoped to ChatGPT Business.
Public claim only
Organisation data is described under the business-data commitments. The public Services Agreement and DPA are the Enterprise/API-style documents; confirm they are incorporated for self-serve Business. Do not assume Enterprise order-form terms.
Ask: Provide the signed Business terms, DPA, liability cap and governing law.
Public claim only
Even with non-US storage, a copy of every prompt and response is stored in the United States for safety and abuse monitoring. Inference is not confined to the storage region.
Ask: APP 8 assessment of US monitoring copies and out-of-region inference.
Not confirmed
DPA 'without undue delay' language is on the OpenAI DPA used by Enterprise; confirm it is signed for Business. No numbered hours on the Business pages.
Ask: Breach notice clock and NDB cooperation for Business.
Not confirmed
Subprocessor subscribe form exists. No Business-specific notice period for model or residency changes was extracted.
Ask: Notice before model, app-default or residency changes?
Not confirmed
Seat add/remove is marketed. Export/offboarding of workspace content was not on the Business storage article.
Ask: How do we export then delete the workspace, including US monitoring copies?
Public claim only
In ChatGPT Business, many apps are enabled by default; administrators can change workspace access. App calls are logged. Data sent to an app follows the provider's terms and may leave the storage region.
Ask: Disable all apps except those we approve, and record that list.
Not confirmed
Browsing/deep research are available unless workspace search controls or Lockdown Mode disable them (Lockdown is documented on the Enterprise/Edu residency article, not confirmed for Business).
Ask: Can web search be disabled on Business, and is it off?
Not confirmed
ChatGPT Work and Codex can take actions across apps. Tasks pause if an action requires approval. Healthcare turns event-triggered tasks off by default; that is not the Business default.
Ask: Which agentic features are on, and is approval required before external actions?
Not confirmed
No product-enforced lawyer review. Admin logs exist for app calls. Compliance API is an Enterprise feature in sibling documentation.
Ask: What audit log can we export on Business without upgrading to Enterprise?
Official pages reviewed for this profile, last reviewed 2026-09-21.
Add this product to your toolset for a particular task, or use it with a practice-area checklist. Add to your toolset Practice areas Best AI general-purpose assistants tools Australia
