Is It Safe to Put Client Data in ChatGPT?

On 11 March 2023, Samsung gave engineers in its semiconductor division access to ChatGPT. Within three weeks, staff had reportedly leaked sensitive data to the chatbot in three separate incidents — source code, and internal meeting notes. By 1 May, Samsung had banned generative AI on every company-owned device. Computers, tablets, phones — the lot.

Samsung spends more on information security in a week than your agency will earn this decade. Its engineers weren't stupid. They were busy, and the chat box was right there.

So ask the uncomfortable question: what's your agency's version of that? You don't have Samsung's security team watching the exits. You have a free ChatGPT tab that's been open since March, and a client brief that needs summarising by 3pm.

Most agency owners assume they're covered because they pay. £20 a month feels like a business product. It isn't — and the gap between "paid consumer" and "business" is exactly where the confidentiality line sits.

What OpenAI Actually Says

Most people arguing about AI and confidentiality are guessing. You don't have to guess. OpenAI publishes the rules in plain English, and they're more specific than the rumours — in both directions.

From OpenAI's data-usage documentation:

"When you use our services for individuals (Free, Plus, Pro), we may use your content to train our models."

Read that again. A £20-a-month Plus account is not a confidentiality tier. It's the same default as the free one: your conversations are eligible training material unless you opt out — via Settings → Data Controls → "Improve the model for everyone", or the "Do not train on my content" switch in OpenAI's Privacy Portal.

The next line of the same document is the one agencies should care about:

"By default, we don't use inputs or outputs from ChatGPT Business, ChatGPT Enterprise, ChatGPT Edu, or our API to improve our models."

So the honest answer to this post's title is boringly specific: it depends entirely on which account is open in your tab. Business, Enterprise, Edu and API usage are excluded from training by default. Free, Plus and Pro are not. OpenAI's enterprise privacy page frames the same split as "ownership and control over your business data" — for business products.

Two more rules cut across every tier:

The feedback loophole. On individual plans, tapping thumbs-up or thumbs-down on a response can send the entire associated conversation for training — even if you've opted out. Every pasted client brief, riding along with your thumbs-up.
Temporary chats aren't used for training while they stay temporary, and they don't appear in your history or memory (the details). Save one, and it becomes a normal chat under your normal settings.

One more wrinkle worth knowing: opting out isn't retroactive. OpenAI's wording is careful — after you opt out, your new conversations won't be used. Whatever you pasted last year has already gone wherever it went.

None of this is hidden. It's just written in a help centre rather than on the login screen.

What "Training on Your Data" Actually Means

Worth a short detour, because people hear "training" and picture their client brief being quoted back to a stranger.

That's not how it works. Training means your text becomes statistical raw material — patterns absorbed into a model, not documents filed away for retrieval. OpenAI says it takes steps to reduce personal information in training datasets before use. Nobody at OpenAI is sitting there reading your rate card.

So is the risk imaginary? Samsung didn't think so, and its reasoning had nothing to do with science fiction. Once data sits on someone else's servers, the company noted, it's difficult to "retrieve and delete" — and it "could be disclosed to other users".

Samsung's own internal survey found 65% of staff considered generative AI a security risk. The big banks reached the same conclusion even earlier: JPMorgan, Citi and Goldman Sachs restricted employee use months before Samsung's ban.

The risk isn't that the model memorises your client. It's that confidential material left your perimeter, you can't get it back, and you can't prove where it went.

And there is no undo. You can delete a chat from your history, and retention policies eventually cycle data off the servers. But once content has been absorbed into training, there is no machine-unlearning button — no way to extract your client's brief back out of a model's weights. Regulators understand this better than most agencies: Italy temporarily blocked ChatGPT outright in 2023 over data-protection concerns, and service only resumed after OpenAI added new privacy controls.

The Three Ways Agencies Actually Leak

Forget the theoretical version. Here's the Tuesday-afternoon version.

1. The free-tier tab. You pay for Plus personally. It's logged in everywhere. The client brief goes in because it's fast — and a Plus account is, for training purposes, a consumer account. Nobody made a bad decision at any single moment; the decision was simply never made at all. The NDA you signed doesn't have a "but it was convenient" clause.

2. The helpful subcontractor. You'd never paste client material into a personal account. Your overflow designer just did, to riff on names for the client's rebrand. You don't know, because you never told them not to.

3. The NDA mismatch. Your client contract promises confidential handling. Your AI tool's consumer terms say content may improve the model. When those two documents disagree, the one that gets read first isn't the help centre article. We covered the disclosure side of this in Should You Tell Clients You Use AI? — this post is the plumbing underneath it.

The Confidentiality Ladder

Strip it down and there are four rungs.

Free / Plus / Pro — trains by default

Fine for generic work: blog outlines, naming exercises, learning a new topic. Not fine for anything carrying a client's name, numbers or unreleased strategy. If you use it anyway, at minimum flip the opt-out — and never touch the feedback buttons on a client conversation.

Business / Enterprise / Edu / API — excluded by default

This is the tier where client work belongs: no training on inputs or outputs, admin controls, and contractual commitments instead of settings you hope a colleague toggled.

Temporary chat — the emergency exit

No training, no history, no memory. Useful for a one-off where a consumer account can't be avoided. The moment you save the chat, the exemption dies.

Feedback buttons — the trapdoor

On consumer plans, a single thumbs-up can send the whole conversation for training even after you've opted out. The simplest rule in this post: on client work, don't rate responses.

What "Solved" Looks Like

The agencies that have this under control share a pattern, and none of it is exotic:

A written rule, one sentence long: no client material in consumer-tier AI accounts. Not a vibe — a sentence people can be shown. (The full version is in How to Write an AI Policy for Your Agency.)
Business-tier accounts for client work, so the protection is contractual rather than a toggle someone forgot.
A boundary per client, so what goes in is deliberate — the current brief, the approved voice doc — not whatever was sitting in the conversation history. This is the problem we built Vythos around: giving AI a clean, per-client workspace on accounts that don't train, so confidentiality is the default state rather than a daily discipline.
A habit of checking. Once a quarter: which AI accounts exist, who holds them, what tier they're on, and what's sitting in their histories. Accounts you can see can't hurt you quietly.

One more, from our side of the fence: Vythos never trains on client or agency data — not as a setting, as an architecture. Your material lives in your workspace and is used for retrieval: giving you and your AI the right context at the right time, nothing else. The models underneath run on Amazon Bedrock, which doesn't share customer content with model providers at all. Confidentiality isn't a toggle here; it's the design.

The Honest Trade-Off

Training exposure is the headline risk, but it isn't the one that hurts most agencies. A compromised account, a chat link shared with the wrong person, or Client A's positioning bleeding into Client B's deck — the cross-contamination problem — will damage you long before a training set does.

Business tiers also cost real money. If you're a solo freelancer with two clients, a business seat for every tool adds up, and a disciplined opt-out plus careful habits may be a rational halfway point. Just make it a decision, not an accident.

The calculus changes the moment you employ anyone — or subcontract. Their habits are your exposure, and they won't ask before they paste.

The one thing: The question was never "can AI keep a secret?" It's whether the account you're using is contractually obliged to. Consumer tiers make no promises. Business tiers do. So: business accounts for client work, one written rule, a quarterly check that the rule actually holds — or use tooling where "never trains on your data" is the architecture rather than a setting. Everything else is hoping the help centre doesn't change.

Is It Safe to Put Client Data in ChatGPT?