Product and intended use
Define the configuration, people, information and tasks being assessed.
Campus only
Public claim only
ChatGPT Edu is marketed to universities for students, faculty, researchers and campus operations. Eligibility is institutional. A commercial law firm should not assume it can buy or inherit Edu terms.
Ask: Are we an eligible education institution, and which campus populations are in the workspace?
Storage vs inference
Public claim only
Eligible new Enterprise/Edu customers can store in-scope content at rest in Australia, Canada, Europe, India, Japan, Singapore, South Korea, UAE, UK or US. Inference residency (GPU in-region) requires data residency in the same region and is listed only for Europe, the United States and the UAE. Australian storage is not Australian inference.
Ask: Record Data Residency Region and Inference Residency Region in writing, including features out of scope.
Features
Public claim only
Higher message limits than Free; GPT-6; data analysis, web browsing, file integrations, document summarisation; custom GPTs shareable in university workspaces.
Ask: Which tools (browsing, GPTs, file integrations) are approved for coursework vs research data?
Not a law-firm SKU
Not confirmed
Edu is an education offering. Australian storage is available on the Enterprise/Edu residency table. That does not make Edu a commercial legal product or grant Astra for Law.
Ask: If a university legal clinic will use Edu, is that inside the institution-approved scope?
Adoption and implementation
Record the practical work needed to introduce and maintain the software.
Pricing
Not confirmed
Contact sales. Residency included at no extra cost for Education plans. Consolidated invoicing advertised.
Ask: Seat/usage quote, term and whether alumni or clinic lawyers are in scope.
SSO and SCIM
Public claim only
SAML SSO, domain verification, SCIM, group permissions, GPT management, admin console and user analytics. New Edu workspaces start with a selected set of enabled apps (connectors help).
Ask: Demonstrate Entra SAML+SCIM and the default app set.
Support
Public claim only
Priority support queue and technical resources advertised for campus administrators. No public severity SLA.
Ask: Contractual support hours for the academic calendar?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Student and research data
Not confirmed
Edu privacy marketing: no conversations used to train. Identity lifecycle, restricted content and institution-approved use still need confirmation. Not a BAA/Healthcare product.
Ask: What student, research and clinic data classes are permitted?
Models
Public claim only
OpenAI models (GPT-6 advertised). Hosting subprocessors as on the shared list.
Ask: Which models are enabled for students vs staff?
Subprocessors
Public claim only
Shared OpenAI sub-processor list. TaskUs (Philippines) is described as GPT moderation on Enterprise/Edu/Business. Microsoft listed including Australia.
Ask: Notice/objection rights and whether TaskUs will see student chats.
No training
Public claim only
Edu product page and business-data page: no data or conversations used to train OpenAI models by default. Same default as Enterprise/Business/API.
Ask: Confirm no opt-in feedback sharing is enabled for the campus workspace.
Feedback
Public claim only
Default off. Explicit opt-in can share data to improve models.
Ask: Disable training-related feedback campus-wide.
Custom windows
Public claim only
Custom data-retention windows advertised. In-scope content at rest in the selected region: conversations, files, memory, custom GPTs, code-interpreter artifacts, image generation. New features are out of scope unless listed. Library files follow workspace retention for Edu.
Ask: Set the retention window and list out-of-scope features.
Deletion
Public claim only
Deleted chats: 30-day permanent deletion on the general retention article used by Enterprise/Edu. DPA deletion/return needs the signed copy.
Ask: Student offboarding and certified deletion on contract end?
Vendor access
Public claim only
TaskUs moderation listed for Edu. Support subprocessors as on the shared list. Inference/auth/analytics may occur outside the storage region.
Ask: When can OpenAI staff or subprocessors read student or clinic chats?
Admin
Public claim only
Dedicated workspace, admin console, SAML SSO, SCIM, group permissions, GPT management. New Edu workspaces start with a selected enabled-app set.
Ask: Map groups to least privilege and disable unused GPTs/apps.
Encryption
Public claim only
Edu page: AES-256 at rest and TLS 1.2+ in transit.
Ask: Confirm in the DPA, including CMK if required.
Assurance
Public claim only
Edu page: SOC 2 Type 2 and ISO 27001, 27017, 27018 and 27701. Reports not inspected.
Ask: Current reports scoped to ChatGPT Edu.
Contract
Not confirmed
Contact-sales education agreement. Public Services Agreement/DPA exist; confirm they are the Edu contract. Not a law-firm MSA.
Ask: Provide the Edu agreement, DPA, liability and law/forum.
Transfers
Public claim only
AU storage available. Inference residency not listed for Australia, so GPU execution may occur outside AU. Auth, routing, analytics, apps and web search may leave the region.
Ask: APP 8 / research-ethics assessment of out-of-region inference and apps.
Incidents
Not confirmed
Rely on the signed DPA. No numbered hours on the Edu marketing page.
Ask: Breach notice and whether the university security team is the notice party.
Changes
Public claim only
Residency article: new features are not residency-eligible unless listed; inference-residency changes apply only to new conversations. Subprocessor subscribe form exists.
Ask: Notice before model, residency-scope or app-default changes?
Exit
Not confirmed
SCIM deprovisioning advertised. Workspace export/deletion path not on the Edu marketing page.
Ask: How are student workspaces exported and deleted at term or contract end?
Apps
Public claim only
File integrations and web browsing advertised. New Edu workspaces start with a selected enabled-app set. Admin-managed app indexing has provider-specific residency limits.
Ask: Which connectors are on, and do they support the AU storage region?
Web search
Not confirmed
Web browsing is listed. External search may remain available unless workspace search controls or Lockdown Mode disable it (Lockdown is documented on the residency article).
Ask: Is browsing off for clinic or assessment use?
GPTs and agents
Not confirmed
Custom GPTs can be shared in university workspaces. ChatGPT Work support on Edu was not separately specified on the Edu page (UAE inference residency disables Work).
Ask: Who may publish GPTs, and are agentic actions restricted?
Oversight
Not confirmed
Admin analytics advertised. No product-enforced academic-integrity or lawyer review gate.
Ask: What logging will the institution retain for misuse investigations?