ChatGPT for Your Team · Lesson 2 of 7
Settings that protect you
25 minutes. For the owner. Seven decisions, made once, on purpose.
---
Most of the protection in ChatGPT Business is already on when you sign up. That's good news. But "on by default" isn't the same as "chosen." This lesson walks through seven areas, tells you what OpenAI's pages say about each, and asks you to write down one decision per area on the Workspace Setup Checklist.
Some of these settings live in Workspace settings (in your ChatGPT Business workspace). Some live in the Admin console, which OpenAI added for managing plugins and some tenant-wide controls. And some are personal settings each person sets for themselves. Each section says which.
This is the question people ask first, so start here.
OpenAI's Business pages say it won't train on your workspace's data, and that Business data is excluded from training by default and encrypted in transit and at rest. Its privacy page adds that this also covers apps: by default, OpenAI doesn't train on data accessed from connected apps in Business.
Two things to know:
- "By default" has an exception. OpenAI's privacy page says that if you explicitly opt in to share data, for example through its feedback tools, that shared data may be used for training. Tell your team: think before using thumbs up or thumbs down on a chat that contains customer or company details.
- Personal accounts are different. On Free, Go, Plus and Pro, a setting called Improve the model for everyone controls whether new chats can be used for training. It lives in Settings > Data controls. This is one more reason for the one-account rule from Lesson 1. In the Business workspace, you don't depend on each person finding that switch.
Decision to write down: "Company work happens only in the Business workspace. We don't rate chats that contain customer details."
What OpenAI's pages say:
- Regular and archived chats stay in an account until they're deleted, or until a workspace retention policy removes them.
- When someone deletes a chat, it disappears from their view right away, and OpenAI schedules it for permanent deletion within 30 days, unless it must be kept longer for security or legal reasons. A deleted chat can't be restored, even by Support.
- Temporary chats don't appear in history, don't create memories and aren't used to improve models. OpenAI may keep a copy for up to 30 days for safety.
- Files added to a project stay until the project or file is deleted. Files uploaded to a custom GPT stay until the GPT is deleted.
OpenAI's privacy page also says that in ChatGPT Business, workspace admins can control how long data is retained, and that shorter retention can affect features like chat history. The help pages I checked don't give the exact menu for this in Business, so look in Workspace settings for a retention or data setting. If you don't see one, keep the default and revisit it in your 30-day check.
Decision to write down: your retention choice (or "default, revisit on [date]"), and a rule that staff use a temporary chat for quick one-off questions that don't need to be kept.
Tell your team this plainly, because it surprises people in both directions.
- Coworkers can't see each other's chats. OpenAI's Business page says each person has their own chat history, and other members don't automatically see it. People share a specific chat, project or GPT on purpose.
- The company can. OpenAI's privacy page says Business workspace admins "can view, access, export, and delete" member conversations in the workspace. Its help page also says workspace owners can export a member's data. Usage and spending reports, on their own, don't show anyone's chats.
So the right way to say it to staff is: "Your work chats are company records, like your work email."
Any member can make a link to one of their chats. In Business, OpenAI says only people in the same workspace can open it. Someone outside gets a "no access" message. If a coworker continues a shared chat, it becomes their own private copy.
In Business, you can't turn shared links off for the whole workspace. OpenAI says that control is Enterprise only. Each person can review and delete their own links at Settings > Data controls, under Shared links, by selecting Manage.
Decision to write down: "Share chats inside the company only when it helps. Review your shared links once a quarter."
Memory lets ChatGPT remember details from past conversations. It's convenient. It also means facts from one chat can show up in another.
What OpenAI's Business memory page says:
- Each person can turn Memory off in their own settings at any time.
- Workspace owners can control whether memory and personalization are available across the whole workspace. If an owner turns Memory off for the workspace, members' existing saved memories in that workspace are deleted.
- Memories belong to one person. They aren't shared with coworkers.
- Memories aren't used for training by default.
There's no single right answer. A reasonable small-business choice: leave Memory on, tell staff they can turn it off, and ask them never to rely on it for facts (prices, policies, customer details). Those belong in a shared project (Lesson 4), where everyone sees the same version.
Apps connect ChatGPT to tools like Google Drive, Slack, Outlook or SharePoint. Plugins bundle apps and reusable instructions together. Lesson 5 covers how staff use them. Here, you decide what's allowed.
The fact to know: OpenAI says many apps are enabled by default in Business. Admins can change that.
- Apps are managed in Workspace settings > Apps. OpenAI's release notes say this section has Enabled, Available and Draft tabs, with bulk actions to disable several at once.
- Plugins are managed in the Admin console: select your ChatGPT workspace, then open Plugins.
Do this now: open the Enabled list. For each app, ask one question: "Does anyone here need this in the next 30 days?" If not, disable it. You can turn it back on in a minute when someone asks. Write the apps you kept on the checklist.
Roles. Business has four built-in roles:
- Owner: full access, including billing, sign-in settings and workspace settings. Can invite admins and other owners.
- Admin: manages members and routine admin tasks, including workspace settings and apps. Can remove members with a lower role.
- Analytics Viewer: can view workspace information and analytics.
- Member: uses ChatGPT fully and can create GPTs, with no admin rights.
Keep it small. Two owners (from Lesson 1). Maybe one admin. Everyone else is a member. Only owners can change roles or seat types.
Multi-factor authentication (MFA). This adds a second check at sign-in, such as a code from an authenticator app or a passkey. Each person turns it on in Settings > Security and login, under Multi-factor authentication (MFA). OpenAI says it can't currently be enforced for a whole workspace, so make it a rule and check it person by person. Owners first.
Single sign-on (SSO). If your company signs in to Microsoft 365 or Google Workspace with one company account, SSO lets people sign in to ChatGPT the same way. OpenAI says SSO and domain verification are included with Business. An owner sets it up in Workspace settings > Identity & access, under Identity & provisioning, by verifying your email domain and then selecting Set up SSO. If you have an IT partner, this is a good job to hand them. If you don't, MFA for everyone is the priority.
Go through the seven areas. For each one, write one decision on the Workspace Setup Checklist, Part 2, with the date. Then turn on MFA for both owners today.
Check it worked
- All seven areas have a written decision, even if it's "keep the default."
- Both owners have MFA on.
- The enabled apps list contains only apps someone needs.
- There are no more than two or three people with owner or admin roles.
- Your team has heard, in plain words: work chats are company records, and coworkers can't see them unless shared.
---
Next: the workspace is ready. Now teach your team to use it well every day.
→ Lesson 3: Daily use for staff
Previous: Pick the plan and set up the workspace · Next: Daily use for staff