---
title: "ChatGPT Enterprise (OpenAI, OpCo, LLC)"
url: "https://ailawframework.com/software/chatgpt-enterprise"
type: "software_profile"
site: "AI Law Framework"
id: "chatgpt-enterprise"
vendor: "OpenAI, OpCo, LLC"
category: "General-purpose"
segment: "General-purpose assistants"
confidence: "high"
last_reviewed: "2026-09-20"
---

# ChatGPT Enterprise (OpenAI, OpCo, LLC)

> Enterprise general-purpose assistant with SSO, retention controls and optional US legal-research configuration. Australian storage residency is available; Australian inference residency is not listed.

Canonical page: https://ailawframework.com/software/chatgpt-enterprise  
Last reviewed: 2026-09-20

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: ChatGPT Enterprise workspace only, including optional Astra for Law (US Trusted Access), ChatGPT Work, Codex and admin-enabled apps. Business, Edu, consumer ChatGPT and the API have separate profiles.

## Capabilities

- Document summarisation
- Contract drafting
- Legal research
- Case-law summarisation
- Knowledge search
- Agentic workflows
- Contract review and redlining

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | Australia, United States, European Union / EEA, United Kingdom, Singapore, Canada, Another named location |
| Australian region | On request |
| Model providers | OpenAI |
| Assurance | SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018, ISO 27701, CSA STAR |
| Training on customer content | No |
| Retention | Workspace admins set retention. Deleted conversations removed within 30 days unless law requires otherwise. Data residency covers listed content types at rest in the chosen region; apps and web search may fall outside. |
| Integrations | iManage, Relativity, Clio, Microsoft 365 / Outlook / SharePoint (via apps), Harvey, Legora, Thomson Reuters |
| Legal content coverage | Astra for Law's legal search index is described as US case law, statutes, regulations, court rules and administrative decisions. Australian primary law is not described. Partner plugins may add licensed sources if separately subscribed. |
| Pricing | Sold via sales. Help pages refer to an Enterprise token-based rate card. Auto-renewal and 30-day non-renewal notice sit on the order form. List prices are not on the public Enterprise page. |
| Australian presence | Unknown. AU data residency is offered for eligible Enterprise/Edu workspaces. Inference residency is not listed for Australia. Astra for Law Trusted Access is described as selected US firms. No Australian office or named AU law-firm customer was found on the pages reviewed. |
| Website | https://openai.com/chatgpt/enterprise/ |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| Plan in scope | Public claim only | This profile covers ChatGPT Enterprise (not Business, Edu, Healthcare, consumer ChatGPT or the API). Astra for Law (announced 17 Sep 2026) is GPT-6 Astra with a US legal search index and legal plugins; help documentation says it is initially offered to selected US law firms through Trusted Access and Codex, with API access coming soon. ChatGPT Work and Codex are Enterprise features that can take actions across apps. | Confirm our workspace is ChatGPT Enterprise (not Business), whether Astra for Law / GPT-6 Astra Law is enabled, and which of ChatGPT Work, Codex, apps and plugins are in the order form. | [ChatGPT Enterprise product page](https://openai.com/chatgpt/enterprise/); [Introducing Astra for Law (17 Sep 2026)](https://openai.com/index/astra-for-law/); [Astra for Law \| OpenAI Help Center](https://help.openai.com/en/articles/20001528-astra-for-law); [Enterprise privacy at OpenAI](https://openai.com/enterprise-privacy/) |
| Deployment and residency | Public claim only | ChatGPT Enterprise is multi-tenant SaaS. Eligible new Enterprise/Edu customers can select data residency (storage at rest) in Australia among other regions. Inference residency (GPU execution in-region) is listed only for Europe, the United States and the UAE, and requires data residency in the same region. Australian storage is therefore not an Australian inference guarantee. Apps, web search, metadata, billing and logins may sit outside the selected region. | Record our Data Residency Region and Inference Residency Region in writing, and list every feature that is out of scope for those settings. | [Data residency and inference residency for ChatGPT](https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt) |
| Legal features | Public claim only | Astra for Law searches US case law, statutes, regulations, court rules and administrative decisions (230 million+ URLs; Free Law Project / CourtListener coverage of published US precedential case law). Partner plugins include iManage, Relativity, Clio, Thomson Reuters, Harvey and Legora. It is not described as covering Australian primary law. OpenAI reports 54.0% all-pass on 200 US questions from Vals AI Legal Research Bench versus 38.7% for GPT-6 Astra with web search alone. | Is Astra for Law available to an Australian workspace, and does the legal search index include any Australian authorities? | [Introducing Astra for Law (17 Sep 2026)](https://openai.com/index/astra-for-law/); [Astra for Law \| OpenAI Help Center](https://help.openai.com/en/articles/20001528-astra-for-law) |
| Australia | Public claim only | Australian storage residency is available for eligible Enterprise workspaces. Inference residency is not listed for Australia as at 20 Sep 2026. Astra for Law Trusted Access is described as US law firms. No Australian law-firm customer was named on the Astra announcement (US firms were named). | Can our Australian entity obtain AU data residency on this workspace, and is Astra for Law licensed for use from Australia? | [Data residency and inference residency for ChatGPT](https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt); [Introducing Astra for Law (17 Sep 2026)](https://openai.com/index/astra-for-law/); [Astra for Law \| OpenAI Help Center](https://help.openai.com/en/articles/20001528-astra-for-law) |
| Pricing | Public claim only | Enterprise is sold via contact-sales. Help articles refer to a ChatGPT Rate Card (Enterprise token-based pricing). Services Agreement: auto-renewal and 30-day non-renewal notice are set on the order form; price changes on the Pricing Page take effect 14 days after posting; OpenAI may correct pricing errors after invoice. No public list price was on the Enterprise marketing page. | Provide an itemised quote (seats, token or usage minimums, Astra for Law, plugins, support) with renewal uplift, auto-renewal and notice period. | [ChatGPT Enterprise product page](https://openai.com/chatgpt/enterprise/); [OpenAI Services Agreement (effective 1 Jan 2026)](https://openai.com/policies/services-agreement/); [Astra for Law \| OpenAI Help Center](https://help.openai.com/en/articles/20001528-astra-for-law) |
| SSO, Word and DMS | Public claim only | Enterprise privacy page: SAML SSO, fine-grained feature access, Compliance API for conversation audit logs. WorkOS and Okta/Auth0 are identity subprocessors. Astra help: iManage plugin can save a draft to the matter file. Apps respect existing permissions after the user authenticates. Merge API is used only if connectors are enabled. | Demonstrate Entra SAML SSO and SCIM, iManage save-back with live permissions, and admin control of apps on our tenant. | [Enterprise privacy at OpenAI](https://openai.com/enterprise-privacy/); [OpenAI Sub-processor list (updated 9 Jul 2026)](https://openai.com/policies/sub-processor-list/); [Astra for Law \| OpenAI Help Center](https://help.openai.com/en/articles/20001528-astra-for-law); [Compliance APIs for Enterprise customers](https://help.openai.com/en/articles/9261474-compliance-apis-for-enterprise-customers) |
| Support | Public claim only | Support subprocessors include Intercom (US), Salesforce (multiple countries including Australia), Pylon (premium, US), TaskUs (Philippines) and Accenture. Bug bounty via Bugcrowd. Phone support 1-888-GPT-0090 is advertised on help pages (calls may be recorded). No public severity SLA was inspected. | What are contractual Sev-1/Sev-2 response times, the security contact, and whether Australian-hours coverage is included? | [OpenAI Sub-processor list (updated 9 Jul 2026)](https://openai.com/policies/sub-processor-list/); [OpenAI Trust Portal](https://trust.openai.com/); [Astra for Law \| OpenAI Help Center](https://help.openai.com/en/articles/20001528-astra-for-law) |
| Quality evidence | Public claim only | OpenAI published Vals AI Legal Research Bench results for Astra for Law on US questions (54% all-pass at highest reasoning). That is vendor-reported, US-only, and still leaves nearly half of questions failing the overall correctness check. Services Agreement 4.3: customer is solely responsible for evaluating Output accuracy. | May we re-run an Australian gold-set after model changes, and will you disclose known failure modes for the legal search index? | [Introducing Astra for Law (17 Sep 2026)](https://openai.com/index/astra-for-law/); [OpenAI Services Agreement (effective 1 Jan 2026)](https://openai.com/policies/services-agreement/) |
| Task fit | Not confirmed | General ChatGPT Enterprise is a general-purpose assistant. Astra for Law is configured for US legal research and writing; help text still requires review of answers and cited sources before reliance. ChatGPT Work can take multi-hour actions across apps. Affidavits, Australian authorities, deadlines and figures remain lawyer-led. | For each proposed task, is Astra for Law or web search used, and can we disable agentic Work actions on privileged matters? | [Astra for Law \| OpenAI Help Center](https://help.openai.com/en/articles/20001528-astra-for-law); [Introducing Astra for Law (17 Sep 2026)](https://openai.com/index/astra-for-law/); [ChatGPT Enterprise product page](https://openai.com/chatgpt/enterprise/) |
| Client-facing use | Not confirmed | Astra help: access is for eligible lawyers and people working under their supervision (Trusted Access). ChatGPT Enterprise itself can be given to any employee. No Australian client-disclosure templates were found. GPTs can be published externally if admins allow (not for Healthcare). | Will public GPT sharing be disabled, and is use limited to admitted practitioners and supervised staff? | [Enterprise privacy at OpenAI](https://openai.com/enterprise-privacy/); [Astra for Law \| OpenAI Help Center](https://help.openai.com/en/articles/20001528-astra-for-law) |
| Model provider | Public claim only | OpenAI is the model provider (GPT-5-class models, GPT-6 Astra, Codex). Microsoft, CoreWeave, Oracle, Google Cloud, AWS and Cerebras appear as cloud-infrastructure subprocessors, which is hosting rather than a substitute model vendor. | List model IDs enabled for our workspace (including whether GPT-6 Astra Law is on) and whether any request is routed to a non-OpenAI model. | [ChatGPT Enterprise product page](https://openai.com/chatgpt/enterprise/); [Introducing Astra for Law (17 Sep 2026)](https://openai.com/index/astra-for-law/); [OpenAI Sub-processor list (updated 9 Jul 2026)](https://openai.com/policies/sub-processor-list/) |
| Subprocessors | Public claim only | List updated 9 Jul 2026 names Cloudflare, Microsoft (including Australia), CoreWeave, Oracle, GCP, AWS, Cerebras, Snowflake, TaskUs (Philippines — GPT moderation on Enterprise/Edu/Business), Intercom, Salesforce, Pylon, Accenture, Cinder, WorkOS, Okta, Merge API (connectors, customer election). Subscribe form for new subprocessors. Moderation samples of flagged content may be shared with subprocessors. | Provide notice/objection rights in our DPA, and confirm TaskUs/Accenture will not receive our privileged chats unless we enable public GPTs or file a support case. | [OpenAI Sub-processor list (updated 9 Jul 2026)](https://openai.com/policies/sub-processor-list/); [OpenAI Data Processing Addendum](https://openai.com/policies/data-processing-addendum/) |
| Training | Public claim only | Services Agreement 4.2: OpenAI will not use Customer Content to develop or improve the Services unless Customer explicitly agrees. Enterprise privacy: no training on business data by default; opt-in feedback mechanisms are the exception. Fine-tuned models (API) are not shared with other customers. | Confirm the signed agreement contains the no-training clause for prompts, files, outputs, embeddings and logs, with no workspace-level opt-in left on. | [OpenAI Services Agreement (effective 1 Jan 2026)](https://openai.com/policies/services-agreement/); [Enterprise privacy at OpenAI](https://openai.com/enterprise-privacy/) |
| Feedback | Public claim only | Enterprise privacy FAQ: if the customer explicitly opts in through feedback mechanisms, shared data may be used to train. Default is off for business data. | Disable all training-related feedback sharing for our Enterprise workspace and confirm historical feedback (if any) is excluded. | [Enterprise privacy at OpenAI](https://openai.com/enterprise-privacy/) |
| Retention | Public claim only | Enterprise admins control how long data is retained. Deleted conversations are removed within 30 days unless legally required. Shorter retention may reduce conversation history. API (separate product) may retain inputs/outputs up to 30 days for abuse monitoring unless ZDR is approved. | Set our Enterprise retention period in the workspace and contract, including backups, Compliance API logs and any Astra index caches. | [Enterprise privacy at OpenAI](https://openai.com/enterprise-privacy/); [Data residency and inference residency for ChatGPT](https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt) |
| Deletion | Public claim only | Deleted conversations: 30 days. DPA deletion/return terms apply (inspect the signed DPA for the exact period; this review's DPA scrape states breach notice and processing terms; confirm the deletion schedule in the executed copy). No sample deletion certificate was published. | Confirm matter-level deletion, backup purge lag, embeddings, and a deletion certificate within 30 days of exit. | [Enterprise privacy at OpenAI](https://openai.com/enterprise-privacy/); [OpenAI Data Processing Addendum](https://openai.com/policies/data-processing-addendum/) |
| Vendor staff access | Public claim only | Enterprise FAQ: authorized OpenAI employees access conversations only to resolve incidents, recover conversations with explicit customer permission, or where required by law. TaskUs may moderate GPTs. Business (not Enterprise) FAQ additionally describes specialized third-party contractors reviewing for abuse — do not assume that broader contractor review applies to Enterprise. | Confirm in writing that no third-party moderator reads our Enterprise chats unless we open a support case or enable public GPTs, and that employee access is logged to us. | [Enterprise privacy at OpenAI](https://openai.com/enterprise-privacy/); [OpenAI Sub-processor list (updated 9 Jul 2026)](https://openai.com/policies/sub-processor-list/) |
| SSO and admin | Public claim only | SAML SSO, feature access controls, admin control of agents/tools/actions, Compliance API. WorkOS for identity. Lockdown Mode is referenced from the residency article as a way to disable external search. | Enable SSO-only, SCIM if available, Lockdown Mode or equivalent web-search off, and exportable audit logs for 12 months. | [Enterprise privacy at OpenAI](https://openai.com/enterprise-privacy/); [ChatGPT Enterprise product page](https://openai.com/chatgpt/enterprise/); [Data residency and inference residency for ChatGPT](https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt); [Compliance APIs for Enterprise customers](https://help.openai.com/en/articles/9261474-compliance-apis-for-enterprise-customers) |
| Encryption | Public claim only | Enterprise privacy: AES-256 at rest and TLS 1.2+ in transit between customers, OpenAI and service providers. No customer-managed key option was found on the public Enterprise pages reviewed. | Confirm encryption of chats, files, embeddings, backups and log stores, and whether BYOK is available. | [Enterprise privacy at OpenAI](https://openai.com/enterprise-privacy/) |
| Assurance | Public claim only | Trust Portal: SOC 2 Type 2; ISO 27001, 27017, 27018 and 27701; CSA STAR; PCI DSS; bug bounty on Bugcrowd. Services Agreement: audit reports once per year on request, treated as OpenAI confidential. Reports were not inspected. ISO/IEC 42001 was not listed. | Provide under NDA the current SOC 2 Type II and ISO certificates scoped to ChatGPT Enterprise and Astra for Law, with exceptions and a bridge letter. | [OpenAI Trust Portal](https://trust.openai.com/); [OpenAI Services Agreement (effective 1 Jan 2026)](https://openai.com/policies/services-agreement/); [Enterprise privacy at OpenAI](https://openai.com/enterprise-privacy/) |
| Contract | Public claim only | OpenAI Services Agreement (1 Jan 2026) plus DPA. Customer owns Input and Output. Customer Content is Confidential Information. IP indemnity for the Services (exclusions apply); Service-Specific Terms Indemnity uncapped as of the Effective Date. Liability cap: fees in prior 12 months, with carve-outs for gross negligence/willful misconduct, indemnities, and (for indirect damages) confidentiality and security-measures breaches. Australian customers: California law; arbitration/venue San Francisco. Material feature reduction: customer may terminate with notice. | Execute the DPA, confirm Customer Content is confidential, and negotiate Australian law/forum and a higher cap for privacy/security breach if required. | [OpenAI Services Agreement (effective 1 Jan 2026)](https://openai.com/policies/services-agreement/); [OpenAI Data Processing Addendum](https://openai.com/policies/data-processing-addendum/) |
| Cross-border transfers | Public claim only | AU data residency stores listed customer content in Australia; inference may still run outside Australia unless a supported inference region is selected (AU is not on that list). Microsoft Azure subprocessors include Australia. Web search and apps can leave the region. DPA includes SCCs. Breach notice is without undue delay, not a stated 48- or 72-hour clock. | Complete an APP 8 map for storage versus inference versus apps versus support, and confirm SCC execution. | [Data residency and inference residency for ChatGPT](https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt); [OpenAI Sub-processor list (updated 9 Jul 2026)](https://openai.com/policies/sub-processor-list/); [OpenAI Data Processing Addendum](https://openai.com/policies/data-processing-addendum/) |
| Incidents | Public claim only | DPA 2.7: notify Customer without undue delay after becoming aware of a Personal Data Breach, with reasonable assistance. 24/7 security on-call is claimed on the enterprise privacy page. Bug bounty exists. No 48-hour contractual clock was found. No public Enterprise incident register was inspected. | Will you contract a maximum 72-hour (preferably 48-hour) notice with NDB-usable content and no gag on notifying the OAIC or clients? | [OpenAI Data Processing Addendum](https://openai.com/policies/data-processing-addendum/); [Enterprise privacy at OpenAI](https://openai.com/enterprise-privacy/); [OpenAI Trust Portal](https://trust.openai.com/) |
| Changes | Public claim only | Services Agreement: OpenAI may update Services; material functional reduction triggers a termination right. Pricing Page changes effective in 14 days. Subprocessor subscribe form. Astra for Law launched 17 Sep 2026. Auto-renewal depends on the order form (30-day notice to reduce or non-renew). | What notice before a default model or legal-index change, and is auto-renewal off unless we confirm? | [OpenAI Services Agreement (effective 1 Jan 2026)](https://openai.com/policies/services-agreement/); [OpenAI Sub-processor list (updated 9 Jul 2026)](https://openai.com/policies/sub-processor-list/); [Introducing Astra for Law (17 Sep 2026)](https://openai.com/index/astra-for-law/) |
| Exit | Public claim only | Effects of termination are in the Services Agreement (export/return details should be read in section 11 of the signed copy). Deleted conversations: 30 days. Compliance API can export conversation audit data during the term. No escrow was found. | Provide export of conversations, files, GPTs, plugin configs and audit logs in open formats, then certified deletion within 30 days. | [OpenAI Services Agreement (effective 1 Jan 2026)](https://openai.com/policies/services-agreement/); [Enterprise privacy at OpenAI](https://openai.com/enterprise-privacy/); [Compliance APIs for Enterprise customers](https://help.openai.com/en/articles/9261474-compliance-apis-for-enterprise-customers) |
| Apps, plugins and MCP | Public claim only | Admins control apps. Data from apps is not used for training by default. Merge API processes connector data at customer election. Astra plugins (iManage, Relativity, Clio and others) send matter context into ChatGPT. External integrations are outside data-residency scope. | List every app and plugin that will be on, the data each sends, and confirm unused connectors stay off. | [Enterprise privacy at OpenAI](https://openai.com/enterprise-privacy/); [OpenAI Sub-processor list (updated 9 Jul 2026)](https://openai.com/policies/sub-processor-list/); [Data residency and inference residency for ChatGPT](https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt); [Astra for Law \| OpenAI Help Center](https://help.openai.com/en/articles/20001528-astra-for-law) |
| Web search | Public claim only | External search remains available unless Lockdown Mode or workspace search controls disable it. Web search is outside the selected residency region. Astra for Law's legal index is a separate corpus from open web search. | Disable web search / Lockdown Mode for privileged workspaces, and confirm legal-index queries are not sent to the open web. | [Data residency and inference residency for ChatGPT](https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt); [Introducing Astra for Law (17 Sep 2026)](https://openai.com/index/astra-for-law/); [Astra for Law \| OpenAI Help Center](https://help.openai.com/en/articles/20001528-astra-for-law) |
| Agents and ChatGPT Work | Not confirmed | ChatGPT Work can plan and take action across apps and files, including long-running projects. Admins can manage who can use agents, connected tools and actions. OpenAI may suspend for security emergency or policy breach. No timed customer kill-switch for in-flight Work agents was documented on the pages reviewed. | Which actions require human confirm before send/share/delete, and how do we immediately revoke agents and API-connected apps? | [ChatGPT Enterprise product page](https://openai.com/chatgpt/enterprise/); [Enterprise privacy at OpenAI](https://openai.com/enterprise-privacy/); [OpenAI Services Agreement (effective 1 Jan 2026)](https://openai.com/policies/services-agreement/) |
| Human oversight | Public claim only | Services Agreement 4.3 requires the customer to evaluate Output. Astra help: review answers and cited sources before relying on them. Compliance API gives admins an audit log of conversations. The product does not force a review gate. | Can we export per-user conversation metadata to our SIEM for 12 months, and is there any forced review step before export to Word or iManage? | [OpenAI Services Agreement (effective 1 Jan 2026)](https://openai.com/policies/services-agreement/); [Astra for Law \| OpenAI Help Center](https://help.openai.com/en/articles/20001528-astra-for-law); [Compliance APIs for Enterprise customers](https://help.openai.com/en/articles/9261474-compliance-apis-for-enterprise-customers); [Enterprise privacy at OpenAI](https://openai.com/enterprise-privacy/) |

## Notes

Enterprise list price not public. DPA breach notice is without undue delay, not 48 hours. AU inference residency not offered. Astra for Law initially US Trusted Access. SOC 2/ISO reports not inspected. Founded year 2015 is widely reported; not re-stated on the Enterprise product page.

## Sources

- [Enterprise privacy at OpenAI](https://openai.com/enterprise-privacy/) (checked 2026-09-20)
- [Business data privacy, security, and compliance](https://openai.com/business-data/) (checked 2026-09-20)
- [Apps in ChatGPT](https://help.openai.com/en/articles/11487775-connectors-in-chatgpt) (checked 2026-09-20)
- [Compliance APIs for Enterprise customers](https://help.openai.com/en/articles/9261474-compliance-apis-for-enterprise-customers) (checked 2026-09-20)
- [OpenAI Services Agreement (effective 1 Jan 2026)](https://openai.com/policies/services-agreement/) (checked 2026-09-20)
- [OpenAI Data Processing Addendum](https://openai.com/policies/data-processing-addendum/) (checked 2026-09-20)
- [OpenAI Sub-processor list (updated 9 Jul 2026)](https://openai.com/policies/sub-processor-list/) (checked 2026-09-20)
- [Data residency and inference residency for ChatGPT](https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt) (checked 2026-09-20)
- [ChatGPT Enterprise product page](https://openai.com/chatgpt/enterprise/) (checked 2026-09-20)
- [OpenAI Trust Portal](https://trust.openai.com/) (checked 2026-09-20)
- [Introducing Astra for Law (17 Sep 2026)](https://openai.com/index/astra-for-law/) (checked 2026-09-20)
- [Astra for Law | OpenAI Help Center](https://help.openai.com/en/articles/20001528-astra-for-law) (checked 2026-09-20)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.