OpenAI API Data Usage Policies

This document is OpenAI's Enterprise Privacy page, a marketing and disclosure resource governing data handling practices for ChatGPT Enterprise, ChatGPT Business (Teams), and the API Platform, with contractual obligations grounded in OpenAI's Data Processing Addendum and Terms of Service. The document states that API and ChatGPT Enterprise customers' inputs and outputs are not used to train OpenAI models by default, that enterprise customers retain ownership of their inputs and outputs, and that OpenAI acts as a data processor under customer instructions for these tiers. The document discloses that OpenAI maintains SOC 2 Type 2 certification and encryption at rest and in transit, and asserts GDPR compliance through Standard Contractual Clauses for EU data transfers, though the document is a marketing page rather than a binding legal instrument, and specific contractual terms are governed by separate agreements referenced but not reproduced here. The policy engages GDPR, CCPA, and HIPAA-adjacent considerations, and references a Data Processing Addendum as the primary mechanism for compliance obligations; EU and California users face the most operationally significant compliance dependencies. Enterprise customers operating under BAA or DPA agreements should note that the page references but does not reproduce those instruments, and compliance verification requires review of those underlying contracts.