← AI for business
AI for business · Data protection

Does your AI assistant use your company data?

Business and free plans compared: does the provider train on your data, how long it keeps it, can it stay in the EU, do you get a GDPR data processing agreement and what it costs.

✓ Every fact was checked on the vendors' official pages on 28 September 2026. Terms change — check the linked sources before deciding.

In short

  • Free and personal plans mostly train on your chats by default and have no data processing agreement — not suitable for company data.
  • Business plans of ChatGPT, Microsoft 365 Copilot, Gemini for Workspace and Claude do not train on your data by default and offer a DPA.
  • EU data: Microsoft 365 Copilot (EU Data Boundary), Gemini for Workspace (data regions), ChatGPT Enterprise and Mistral. ChatGPT Business and Claude Team/Enterprise store data in the USA.
  • Watch out: Mistral Le Chat Team trains on data by default — an admin must switch training off for the whole organisation.
  • DeepSeek processes and stores data in China and trains on it; don't use it for company data.

Business plans

PlanTrains on your data?Data in the EUData processing agreementPrice
ChatGPT BusinessNo No, not by defaultNo No data residency on this planYes€21/user/month billed annually, €26 monthly (standard seat); 2–200 users
ChatGPT EnterpriseNo No, not by defaultYes Yes — EU storage for new workspaces and in-region processing (since Jan 2026)YesContact sales
Microsoft 365 CopilotNo No — prompts, responses and company data are not used to train modelsYes Yes — EU Data Boundary service (except models supplied by Anthropic)Yes (Microsoft Products and Services DPA)$30/user/month billed yearly; SMB add-on Copilot Business $21 ($18 promo until 31 Dec 2026)
Gemini in Google WorkspaceNo No — contractual training restriction; no human review without permissionYes Yes — data regions cover Gemini prompts and responses (full with Enterprise Plus or add-on; basic on Business Standard/Plus)Yes (Cloud Data Processing Addendum)Business Standard €13.60, Plus €21.10 per user/month billed annually (€16.20 / €25.30 flexible); Enterprise on request
Claude TeamNo No, not by defaultNo No — stored in the USA (EU only via AWS Bedrock or Google Vertex)Yes (part of the Commercial Terms)$20/user/month billed annually, $25 monthly (standard seat); 2–150 users
Claude EnterpriseNo No, not by defaultNo No — stored in the USA (EU only via AWS Bedrock or Google Vertex)Yes (part of the Commercial Terms)$20/seat/month billed annually plus usage at API rates; or via sales
Le Chat (Vibe) TeamYes, opt-out Yes by default — an admin can switch it off for the whole organisationYes Yes — hosted in the EU by default (some features may transfer data outside the EU under SCCs)Yes€29.99/user/month incl. VAT
Le Chat (Vibe) EnterpriseNo No, off by defaultYes Yes — EU by default; features that transfer data outside the EU can be switched offYesContact sales

Free and personal plans — for comparison

PlanTrains on your data?Data in the EUData processing agreementPrice
ChatGPT Free / Plus / ProYes, opt-out Yes by default — you can switch it off (Data controls)No NoNo (consumer terms)Free / paid personal plans
Microsoft Copilot (personal)Depends Depends on the app version: the new app (Aug 2026) says no; the older app trains by default with an opt-outNo n/sNo (consumer terms)Free / Microsoft 365 personal plans
Gemini app (personal)Yes, opt-out Yes with “Keep Activity” on (default); some chats are reviewed by humansNo NoNo (consumer terms)Free / Google AI plans
Claude Free / Pro / MaxYes, opt-out Your choice (setting since 2025); if allowed, data is kept up to 5 yearsNo No — stored in the USANo (consumer terms)Free / paid personal plans
Le Chat (Vibe) Free / ProYes, opt-out Yes by default — you can switch it offYes Yes — hosted in the EU by defaultNo (consumer terms)Free / Pro
DeepSeek (app / web)Yes Yes — inputs are used to train and improve models (opt-out mentioned, mechanism n/s)No No — collected, processed and stored in ChinaNo business plan or DPA statedFree

APIs for developers

PlanTrains on your data?Data in the EUData processing agreementPrice
OpenAI APINo No, not by defaultYes Yes — EU-region projects process in the region (new projects)YesPer token
Claude APINo No, not by defaultPartly Not directly (US or global only) — EU via AWS Bedrock or Google VertexYes (part of the Commercial Terms)Per token

How to choose

Ban personal accounts for work data

Even the best business plan does not help if staff paste data into free chatbots. List the approved tools in your AI usage policy.

Policy generator →
Must data stay in the EU?

If customers or contracts require it, choose from Microsoft 365 Copilot, Gemini for Workspace with the right data regions, ChatGPT Enterprise or Mistral.

Check the settings, not just the plan

On Mistral Team switch training off; on every plan set retention and check who the admins are.

Still hide personal data

A DPA does not mean you may enter everything. Replace names, ID numbers, IBANs and addresses with labels before pasting — with Clean before AI, which runs on your computer.

Clean before AI →

Details and sources

ChatGPT Business
Training on your data
No No, not by default
Data in the EU
No No data residency on this plan
Retention
Admin controls retention; deleted chats are removed within 30 days
Data processing agreement (DPA)
Yes
Provider
USA (for the EEA: OpenAI Ireland Ltd)
Certifications
SOC 2 Type 2
Price
€21/user/month billed annually, €26 monthly (standard seat); 2–200 users
Admin
SAML SSO; no Compliance API/audit log
Sources
openai.com/enterprise-privacy · chatgpt.com/pricing
ChatGPT Enterprise
Training on your data
No No, not by default
Data in the EU
Yes Yes — EU storage for new workspaces and in-region processing (since Jan 2026)
Retention
Admin controls retention
Data processing agreement (DPA)
Yes
Provider
USA (for the EEA: OpenAI Ireland Ltd)
Certifications
SOC 2 Type 2, ISO 27001/27017/27018/27701
Price
Contact sales
Admin
SAML SSO, SCIM, own encryption keys (EKM), Compliance API audit log
Sources
openai.com/enterprise-privacy · OpenAI — data residency in Europe
ChatGPT Free / Plus / Pro
Training on your data
Yes, opt-out Yes by default — you can switch it off (Data controls)
Data in the EU
No No
Retention
Temporary chats up to 30 days (not used for training); regular chats n/s
Data processing agreement (DPA)
No (consumer terms)
Provider
USA (for the EEA: OpenAI Ireland Ltd)
Certifications
—
Price
Free / paid personal plans
Admin
None
Sources
help.openai.com — data controls · OpenAI EU privacy policy
Microsoft 365 Copilot
Training on your data
No No — prompts, responses and company data are not used to train models
Data in the EU
Yes Yes — EU Data Boundary service (except models supplied by Anthropic)
Retention
Follows your Microsoft Purview policies; users can delete history
Data processing agreement (DPA)
Yes (Microsoft Products and Services DPA)
Provider
USA (EU Data Boundary)
Certifications
ISO 27001, ISO 27018, ISO 42001
Price
$30/user/month billed yearly; SMB add-on Copilot Business $21 ($18 promo until 31 Dec 2026)
Admin
Entra ID, Purview retention, eDiscovery and audit
Sources
learn.microsoft.com — Copilot privacy · microsoft.com — Copilot Business
Microsoft Copilot (personal)
Training on your data
Depends Depends on the app version: the new app (Aug 2026) says no; the older app trains by default with an opt-out
Data in the EU
No n/s
Retention
Older app: conversations stored 18 months
Data processing agreement (DPA)
No (consumer terms)
Provider
USA
Certifications
—
Price
Free / Microsoft 365 personal plans
Admin
None
Sources
support.microsoft.com — Copilot privacy FAQ
Gemini in Google Workspace
Training on your data
No No — contractual training restriction; no human review without permission
Data in the EU
Yes Yes — data regions cover Gemini prompts and responses (full with Enterprise Plus or add-on; basic on Business Standard/Plus)
Retention
Admin sets 90 days to indefinite (apps), up to 36 months in the Gemini app; 72 hours with history off
Data processing agreement (DPA)
Yes (Cloud Data Processing Addendum)
Provider
USA (for the EEA: Google Ireland / Cloud EMEA)
Certifications
SOC 1/2/3, ISO 27001/27017/27018/27701/42001
Price
Business Standard €13.60, Plus €21.10 per user/month billed annually (€16.20 / €25.30 flexible); Enterprise on request
Admin
Workspace admin, audit logs for Gemini, data regions
Sources
support.google.com — Gemini for Workspace privacy · Data covered by data regions · workspace.google.com/pricing
Gemini app (personal)
Training on your data
Yes, opt-out Yes with “Keep Activity” on (default); some chats are reviewed by humans
Data in the EU
No No
Retention
18 months by default (3/36 months or never); human-reviewed chats up to 3 years; 72 hours with activity off
Data processing agreement (DPA)
No (consumer terms)
Provider
USA (for the EEA: Google Ireland Ltd)
Certifications
—
Price
Free / Google AI plans
Admin
None
Sources
support.google.com — Gemini apps privacy
Claude Team
Training on your data
No No, not by default
Data in the EU
No No — stored in the USA (EU only via AWS Bedrock or Google Vertex)
Retention
Kept until deleted, then removed within 30 days
Data processing agreement (DPA)
Yes (part of the Commercial Terms)
Provider
USA
Certifications
SOC 2 Type 2, ISO 27001/27017/27018
Price
$20/user/month billed annually, $25 monthly (standard seat); 2–150 users
Admin
SSO; no audit logs, SCIM or Compliance API
Sources
privacy.claude.com · claude.com/pricing · Data residency
Claude Enterprise
Training on your data
No No, not by default
Data in the EU
No No — stored in the USA (EU only via AWS Bedrock or Google Vertex)
Retention
Custom retention (minimum 30 days); default indefinite
Data processing agreement (DPA)
Yes (part of the Commercial Terms)
Provider
USA
Certifications
SOC 2 Type 2, ISO 27001/27017/27018
Price
$20/seat/month billed annually plus usage at API rates; or via sales
Admin
SSO, SCIM, audit logs, Compliance API, IP allowlisting
Sources
privacy.claude.com · claude.com/pricing
Claude Free / Pro / Max
Training on your data
Yes, opt-out Your choice (setting since 2025); if allowed, data is kept up to 5 years
Data in the EU
No No — stored in the USA
Retention
Without training: deleted chats removed within 30 days; with training: up to 5 years (de-identified)
Data processing agreement (DPA)
No (consumer terms)
Provider
USA (for the EEA: Anthropic Ireland Ltd)
Certifications
—
Price
Free / paid personal plans
Admin
None
Sources
Anthropic — consumer terms update (28 Aug 2025)
Le Chat (Vibe) Team
Training on your data
Yes, opt-out Yes by default — an admin can switch it off for the whole organisation
Data in the EU
Yes Yes — hosted in the EU by default (some features may transfer data outside the EU under SCCs)
Retention
Until the user deletes them (exact days n/s)
Data processing agreement (DPA)
Yes
Provider
France (EU)
Certifications
SOC 2 Type II, ISO 27001/27701
Price
€29.99/user/month incl. VAT
Admin
No SSO or audit logs (Enterprise only)
Sources
help.mistral.ai — training · help.mistral.ai — data location · mistral.ai/pricing
Le Chat (Vibe) Enterprise
Training on your data
No No, off by default
Data in the EU
Yes Yes — EU by default; features that transfer data outside the EU can be switched off
Retention
Until the user deletes them (exact days n/s)
Data processing agreement (DPA)
Yes
Provider
France (EU)
Certifications
SOC 2 Type II, ISO 27001/27701
Price
Contact sales
Admin
SAML SSO, audit logs
Sources
help.mistral.ai — training · help.mistral.ai — data location
Le Chat (Vibe) Free / Pro
Training on your data
Yes, opt-out Yes by default — you can switch it off
Data in the EU
Yes Yes — hosted in the EU by default
Retention
Until you delete them
Data processing agreement (DPA)
No (consumer terms)
Provider
France (EU)
Certifications
—
Price
Free / Pro
Admin
None
Sources
help.mistral.ai — training
DeepSeek (app / web)
Training on your data
Yes Yes — inputs are used to train and improve models (opt-out mentioned, mechanism n/s)
Data in the EU
No No — collected, processed and stored in China
Retention
“As long as necessary” — no fixed period
Data processing agreement (DPA)
No business plan or DPA stated
Provider
China (Hangzhou)
Certifications
—
Price
Free
Admin
None
Sources
DeepSeek privacy policy (10 Feb 2026)
OpenAI API
Training on your data
No No, not by default
Data in the EU
Yes Yes — EU-region projects process in the region (new projects)
Retention
Up to 30 days; zero data retention on request for eligible endpoints
Data processing agreement (DPA)
Yes
Provider
USA
Certifications
SOC 2 Type 2
Price
Per token
Admin
Projects, keys, usage limits
Sources
openai.com/enterprise-privacy
Claude API
Training on your data
No No, not by default
Data in the EU
Partly Not directly (US or global only) — EU via AWS Bedrock or Google Vertex
Retention
Deleted within 30 days; zero data retention for eligible use
Data processing agreement (DPA)
Yes (part of the Commercial Terms)
Provider
USA
Certifications
SOC 2 Type 2, ISO 27001/27017/27018
Price
Per token
Admin
Workspaces, keys, usage limits
Sources
Data residency · claude.com/regional-compliance

Frequently asked questions

Does ChatGPT train on company data?

Free ChatGPT, Plus and Pro train on chats by default; you can switch this off in settings. ChatGPT Business, Enterprise and the API do not train on your data by default.

Is Microsoft 365 Copilot safe for company data?

Microsoft states that prompts, responses and Microsoft Graph data are not used to train models. Copilot is an EU Data Boundary service, except for models supplied by Anthropic. Retention follows your Purview policies.

Which AI assistant keeps data in the EU?

According to official pages (28 September 2026): Microsoft 365 Copilot, Gemini for Google Workspace with data regions, ChatGPT Enterprise (new workspaces) and Mistral Le Chat. ChatGPT Business has no residency option, and Claude stores data in the USA — EU only via AWS Bedrock or Google Vertex.

Do we need a data processing agreement?

Yes, if you enter personal data. Under the GDPR the provider must be a processor bound by a DPA. Free personal plans don't have one; business plans include it.

Is DeepSeek suitable for companies?

Not for company data: according to its privacy policy DeepSeek collects, processes and stores data in China, uses inputs for training and states no business plan with a DPA.

Sources are listed with each plan. General information, not legal advice. Prices without guarantee (VAT not always stated).