Is It Safe to Upload Confidential Documents to ChatGPT?

Is it safe to upload confidential documents to ChatGPT? On a personal account with default settings, no. On a business workspace your company has approved, often yes. In both cases the answer depends less on the tool than on two questions people rarely ask: whose information is in the file, and what did you promise about it. Below is what happens to an uploaded file as of October 2026, a list of what should stay out of any chatbot, and a redaction routine for the cases where you still want the help.

What happens to a file after you upload it

Three things are decided by your plan and settings: whether the content can be used to train future models, how long it is stored, and who can see it. We checked the vendors' own help and privacy pages on October 1, 2026.

Product	Used for training by default?	What you control
ChatGPT personal plans (Free, Go, Plus, Pro)	Yes	Settings → Data controls → "Improve the model for everyone." Temporary Chat is never used for training and is kept for up to 30 days.
ChatGPT Business, Enterprise, Edu	No	Workspace admins set retention. Deleted conversations leave OpenAI's systems within 30 days unless the law requires longer.
Claude personal plans (Free, Pro, Max)	Depends on your choice in the model training setting	Privacy settings. If training is allowed, data may be kept in de-identified form for up to five years. If not, deleted chats are removed from back-end systems within 30 days. Incognito chats are never used for training.
Claude Team, Enterprise	No	Covered by Anthropic's commercial terms; the consumer training setting does not apply.
Gemini app, personal Google account	Yes, while Keep Activity is on	Keep Activity setting. Activity auto-deletes after 18 months by default. With it off, chats are still kept for 72 hours.
Gemini in Google Workspace (business, education)	No	Content is not reviewed by humans or used for model training outside your domain without permission.

Two details in the fine print deserve attention.

Google states that human reviewers read a portion of chats on personal accounts, and that reviewed chats are kept for up to three years even if you delete your activity. Its privacy notice says it plainly: "Please don't enter confidential information that you wouldn't want a reviewer to see or Google to use to improve our services."

Anthropic keeps conversations flagged for policy violations for up to two years, whatever your training setting. OpenAI keeps deleted chats for up to 30 days and longer where it has a legal or security reason.

Settings change. Treat the table as a snapshot and check the vendor page before a decision that matters.

Training is one of four risks

Most advice stops at "turn off training." That handles the smallest of the four problems.

Training. Your text could influence a future model. The practical chance that a specific contract resurfaces word for word in someone else's chat is low, and the setting removes it.

Retention. The file sits on someone else's servers, and "deleted" has conditions. In 2025 a court order in the New York Times copyright case required OpenAI to preserve consumer ChatGPT conversations that users had deleted. The obligation ended that fall, but the data preserved while it was in force stayed under legal hold. Nobody who deleted a chat that summer could have known it would be kept.

Access. Human reviewers on some consumer plans. A shared login in a small team. Chat history open on a laptop in a meeting room. A share link forwarded further than intended. Memory features that carry a client's name from one conversation into the next. Connectors that let the assistant read your whole Drive when you meant to show it one file.

Your obligations. This is the one that the training toggle does not touch. An NDA usually forbids disclosure to third parties, and an AI vendor is a third party. Privacy laws such as GDPR require a legal basis and a processor agreement before personal data goes to a new vendor. Professional secrecy rules for lawyers, doctors, and auditors work the same way. The breach happens at the moment of upload. Whether the vendor later trains on the file is irrelevant to the person whose data it was.

That last point changes the question. "Is ChatGPT safe?" matters less than "am I allowed to hand this document to any outside company?"

What should stay out of a chatbot

Category	Typical examples	What to do instead
Other people's personal data	Résumés, employee reviews, salary lists, customer exports, medical notes	Remove names and identifiers, or use a company-approved workspace with a signed data processing agreement
Documents under NDA	Partner contracts, due diligence files, unreleased product specs	Read the NDA's disclosure clause first; redact parties and terms, or get written consent
Client-confidential and privileged material	Legal memos, audit workpapers, strategy decks for a named client	Only tools your firm has approved for client data
Trade secrets	Pricing models, source code, unreleased financials, customer lists	Enterprise workspace, or describe the structure without the real values
Credentials and security details	Passwords, API keys, network diagrams, access logs	Never. Replace with placeholders before pasting anything technical
Regulated records	Patient records, payment card numbers, government ID numbers	Only systems cleared by your compliance team

What is usually fine: published reports, public filings, your own drafts, templates with no real names, anonymized data, and anything you would be comfortable emailing to an outside freelancer without a contract.

A working example: redact first, then upload

A typical task. A consultant needs a summary of each party's obligations in a client's supplier agreement. The agreement is confidential and the consultant works on a personal Plus account. How to structure that summary once the data question is settled is covered in How to Summarize a Long PDF With AI Without Losing What Matters.

The mistake we see most often is asking the chatbot to do the redaction: "remove all names from this contract." By then the full contract is already uploaded. Redaction has to happen on your machine.

1. Save a copy of the document. Work only on the copy.
2. Use Find and Replace in your word processor: each company becomes [COMPANY_A], [COMPANY_B]; each person [PERSON_1]; amounts [AMOUNT_1]; identifying dates [DATE_1].
3. Keep the key (which placeholder stands for what) in a local file.
4. Accept or reject all tracked changes, delete comments, and paste the text as plain text. Tracked changes, comments, document properties, and hidden spreadsheet tabs travel with an uploaded file.
5. Reread the first page as a stranger. Could you tell who this is about?

Then give the model instructions that keep the placeholders intact.

I'm pasting a document in which identifying details are replaced with placeholders:
[COMPANY_A], [COMPANY_B], [PERSON_1], [AMOUNT_1], [DATE_1], and so on.

Rules for this chat:
- Treat placeholders as opaque labels. Do not guess who or what they stand for.
- Keep every placeholder exactly as written in your answer,
  so I can restore the originals myself.
- If the task cannot be done without a redacted detail, tell me which
  placeholder you need explained and why. Do not assume.

Task: Summarize the obligations of each party in a table with columns for
party, obligation, deadline or trigger, and clause number.
Then list anything that is ambiguous or missing.

DOCUMENT:
[paste the redacted text]

You get a table you can paste into your notes and restore with one more Find and Replace. If the model starts writing "the Supplier" where the text said [COMPANY_B], remind it of the second rule; that drift happens in long answers. If it asks what [AMOUNT_1] is, decide whether the task needs the real figure or only its role ("the annual fee").

For the legal-review version of this workflow, see our contract review prompt.

Four questions before every upload

• Whose information is in this file: mine, my employer's, a client's, or a private person's?
• Has anyone been promised confidentiality for it, in an NDA, a client contract, an employment policy, or a privacy notice?
• Is this account approved by my employer for this kind of data, and is training turned off?
• Would the task work just as well with placeholders in place of the real names and numbers?

If the second answer is yes and the third is no, the fourth is your only route.

Where this breaks

Redaction fails on small worlds. "The CFO of a 12-person company who resigned in March" identifies a person without a single name. The fewer people a description could fit, the less placeholders help. Spreadsheets have the same problem at scale: a customer table without names but with postal codes and birth dates can still point to individuals. We cover preparing data files in How to Analyze a Spreadsheet with ChatGPT.

Your company's policy overrides anything in this article. If your employer bans personal AI accounts for work files, a careful redaction is still a policy violation.

A business plan is not a compliance program. ChatGPT Business or Claude Team fixes the training question and gives admins control over retention. It does not sign your NDA counterparty's consent or establish a legal basis for processing personal data. We are not lawyers, and for anything regulated your compliance or legal team has the final word.

The model's answer about a confidential document needs checking like any other. Redacted input makes that harder, because the model sees less context. Our routine for that is in How to Fact-Check AI Answers.

Take this further in the practicum

What you can and cannot upload is part of Session 3 of AI system in two weeks, the session on documents, data, and visuals. We go through personal data, NDAs, and trade secrets with the kinds of files participants handle at work, set up the privacy controls in each tool, and practice the redaction routine until it takes a couple of minutes. The pages for legal professionals and HR teams show how the program maps to those roles; the full program is on the course page.