Is it safe to put our company data into ChatGPT or Copilot?
It can be, on a business or enterprise plan your company controls: ChatGPT's business plans, and Microsoft 365 Copilot signed in with a work account, do not train their models on what you type, and they give an administrator control over who uses them and how long chats are kept. The risk is staff pasting company data into free or personal accounts, which sit outside any agreement your company has signed. For data that must not leave your own machines at all, the model can run on your own hardware instead.
Evidence
HARchive keeps a whole video archive private by running every model that looks or listens on one laptop. The footage is never uploaded. Only short text, such as captions and place names, goes to a cloud model, and search works without it.
- 440 hours of raw video indexed without a frame leaving the laptop
- 12.7 TB of footage kept on the owner's own disks
- 16 GB graphics card running the speech, image and face models
Read the full story in the HARchive case study.
Consumer plans and business plans are not the same product
The free and personal versions of ChatGPT and Copilot are made for individuals. The person who signs up owns the account and its history, the settings are theirs to change, and your company has no agreement with the vendor about what happens to what they paste in.
The business and enterprise versions are sold to the company. They come with terms that say your data is not used for training, an administrator who adds and removes people, single sign-on, and logs of use. Microsoft 365 Copilot also works inside your existing Microsoft 365 permissions, so it can only show a person files they could already open. That cuts both ways: if your shared drives are open to everyone, Copilot will find what was always visible but never noticed.
The first step is usually not a new tool. It is a short policy that says which plan staff use for work, and turning on the one your company already pays for.
Retention and training
Two questions matter, and they are different. Training is whether what you type is used to improve the vendor's models, where pieces of it could in principle resurface for someone else. Retention is how long your chats and files are kept on the vendor's servers, and who there can read them.
Business plans have training off by default. Personal plans of ChatGPT can be used for training unless the person turns it off in their own settings, which your company cannot check. Retention differs by plan and changes over time, so read the vendor's current data terms for the plan you buy, and ask whether an administrator can set how long chats are kept and delete them.
PIPEDA and data residency
PIPEDA, Canada's private-sector privacy law, does not forbid sending personal information to a service in another country. It does keep your company accountable for it: you need a contract that protects it to a comparable standard, and you should tell the people it belongs to that it may be processed outside Canada. Quebec's Law 25 goes further and asks for a privacy impact assessment before personal information leaves the province.
Where the data is stored is a question to put to the vendor for the exact plan you are buying, because storage in Canada is offered on some plans and not others. Some client contracts, and most public-sector ones, require it outright.
This is general guidance, not legal advice. For a decision that depends on a specific contract or regulation, ask your lawyer or privacy officer.
When a private deployment is warranted
A business plan is enough for most companies and most data. A model running on your own machines, or in your own cloud account, is worth its extra work when a contract or regulation says the data may not go to a third party, when the data is large, like years of recordings, or when a leak would cost far more than the setup.
Open models that run on one good graphics card can now transcribe, read documents, describe images and answer questions well enough for many jobs. They are not as capable as the largest cloud models, so the usual design keeps the sensitive material local and sends only what is safe, as HARchive does.
Next step
Tell me what data your staff want to use AI on and which tools they use today, and I will tell you plainly which of it is fine on the plan you have, what needs a business plan or a written policy, and what should stay on your own machines.