Is ChatGPT Secure to Use? What You Actually Need to Know Before Pasting Sensitive Data

If you're asking whether ChatGPT is secure to use, you're asking the wrong question in the right direction. "Secure" is not a binary. It's a stack of properties: encryption in transit, encryption at rest, retention windows, training-data policies, access controls, legal exposure, vulnerability surface. Each one has a different answer depending on which tier you're on, what settings you've toggled, and whether a federal court has recently had other plans for your data. This piece breaks all of that down, with citations, so you can make an informed call for your team.

Key Takeaways

• ChatGPT uses AES-256 encryption at rest and TLS 1.2+ in transit. The transport layer is solid. The question is what happens to your data after it arrives.
• On consumer plans (Free and Plus), your conversations are used for model training by default. You can opt out, but the data is still retained for 30 days for abuse monitoring.
• A 2025 federal court order forced preservation of consumer chat logs regardless of user deletion settings, and a subsequent order compelled production of 20 million de-identified logs. Your retention policy is only as durable as the next subpoena.
• Enterprise tiers offer meaningfully different controls: SOC 2 Type 2 audits, no training on business data by default, SSO enforcement. But a February 2026 vulnerability showed that even isolated code-execution environments can leak data through hidden channels.
• The structural question is not "is the vendor secure" but "does the vendor ever receive the sensitive data in the first place." Policy controls limit what a vendor does with data they already have. Architectural controls limit whether they receive it at all.

What Does "Secure" Actually Mean for a Cloud AI Service?

It means at least three distinct things, and most coverage conflates them.

Transport security is whether your data can be intercepted between your browser and the vendor's servers. Storage security is whether your data is protected once it arrives. Usage policy is what the vendor is allowed to do with it, and for how long. You need all three to be adequate. Two out of three is not a passing grade when you're pasting customer PII or proprietary source code into a text box.

There is also a fourth dimension most people miss entirely: legal durability. A vendor's retention policy is a contract, not a physical law. Courts can override it. We'll get to that.

How Does ChatGPT Handle Encryption?

OpenAI encrypts data at rest with AES-256 and in transit using TLS 1.2 or higher, both between users and their servers and between their infrastructure and downstream service providers. This is table-stakes for any SaaS product handling sensitive data. It means a network eavesdropper can't read your prompts in flight, and a stolen hard drive yields ciphertext.

What it does not mean: your data is encrypted in a way that the vendor themselves cannot read it. OpenAI holds the keys. They can access your conversations for abuse monitoring, safety review, model improvement (on consumer tiers), and legal compliance. This is standard for cloud services, and it is also the core architectural limitation that downstream risks flow from.

Does ChatGPT Use Your Conversations for Training?

On consumer plans (Free and Plus), yes, by default. OpenAI uses those conversations to train and improve its models unless you explicitly opt out. You can disable this in Settings > Data Controls. Opting out is straightforward but not well-publicized, and most users never touch the toggle.

On business and enterprise tiers, the default flips. OpenAI does not use business data for training unless a customer explicitly opts in. This is the single largest practical difference between consumer and enterprise usage from a data-governance perspective.

API access follows a similar pattern: data submitted via the API is not used for training by default, with the same 30-day retention window for abuse monitoring.

So: if you're on a consumer plan and haven't changed the default, every prompt you've sent has potentially been folded into training data. If you're on an enterprise plan, it hasn't (absent your explicit consent). The gap between those two states is enormous, and it's controlled by a settings toggle most people don't know exists.

How Long Does ChatGPT Keep Your Data?

Even with training opt-out enabled, OpenAI retains data for 30 days for abuse and safety monitoring. After 30 days, the data is deleted (per their stated policy). API customers with contractual arrangements may have shorter windows, but the standard is 30 days.

This is the part where most "is ChatGPT secure" articles stop. They shouldn't.

Can a Court Override ChatGPT's Deletion Policy?

Yes. It already happened.

In mid-2025, as part of the New York Times copyright lawsuit, a federal judge ordered OpenAI to preserve and segregate all output log data, including consumer ChatGPT conversations, regardless of what deletion commitments OpenAI had made to its users. If you had pressed "delete," the data did not go away. The vendor's hands were tied by a court order.

That preservation order was lifted in late September 2025, after which OpenAI resumed normal deletion practices. But conversations from the April-through-September 2025 window remain in secure storage pending litigation, accessible only to a small audited legal and security team. ChatGPT Enterprise was explicitly excluded from the preservation order, adding another reason the tier distinction matters.

Then it got worse.

In January 2026, a federal court in the Southern District of New York upheld two discovery orders requiring OpenAI to produce a sample of 20 million de-identified user logs as part of copyright litigation brought by news organizations and class plaintiffs. The users whose conversations were included received no notification and had no opportunity to object.

Read that again. Twenty million conversation logs, produced to opposing counsel in litigation. De-identified, yes. But "de-identified" is a process with known limitations, and the users never consented to or even learned about the production.

A University of Washington Tech Policy Lab co-director noted that this court order preventing ChatGPT from honoring deletion requests should spark broader conversation about data control.

This is the part of the "is ChatGPT secure" analysis that matters most for business users. Your vendor's retention policy is a promise. A subpoena is an order. The order wins.

What Security Certifications Does ChatGPT Have?

Enterprise-tier deployments carry real compliance credentials. Business versions are independently audited to SOC 2 Type 2 and CSA STAR, and align with ISO/IEC 27001, 27017, 27018, and 27701. The infrastructure includes a bug bounty program, regular penetration testing, and 24/7 incident response. Business customers can enforce SSO via SAML and manage users through an admin console.

OpenAI received ISO/IEC 27001 certification in January 2026, formalizing what had previously been alignment-only. This is meaningful. It means an external auditor reviewed their information security management system and signed off.

None of these certifications apply to free consumer usage. The free tier has the same transport encryption but none of the governance, audit, or access-control infrastructure. If your employees are using the free tier for work, they are operating outside every compliance framework your organization likely requires.

Has ChatGPT Had Security Vulnerabilities?

Yes, and the recent ones are instructive.

In February 2026, Check Point Research discovered a hidden outbound communication path from ChatGPT's isolated code execution runtime to the public internet. A single malicious prompt could turn an ordinary conversation into a covert exfiltration channel, leaking user messages, uploaded files, and other sensitive content via DNS queries. The sandbox was supposed to be air-gapped. It wasn't, because DNS resolution was permitted. OpenAI patched the issue on February 20, 2026 following responsible disclosure, with no indication of exploitation in the wild.

Within the same week, a separate Codex bug exposed GitHub tokens, risking access to private repositories. Also patched in February 2026.

These aren't exotic theoretical attacks. They're the kind of bugs that appear when you bolt code-execution capabilities, tool use, and internet access onto a chat interface. Every new capability is new attack surface. Check Point's own analysis stated it plainly: enterprises cannot rely solely on AI vendor security controls to protect sensitive data.

What About Shadow AI and Employee Usage?

The biggest risk vector for most organizations is not a zero-day exploit. It's an employee on a free-tier account pasting a customer list into a prompt to "quickly summarize" it.

An IBM report found organizations with high levels of shadow AI saw an average of $670,000 in additional breach costs, and 97% of organizations that reported an AI-related breach lacked proper AI access controls. The tool is not the vulnerability here. The lack of governance around the tool is.

If your employees are using ChatGPT for work, you have exactly two options: govern it (enterprise tier, SSO, data-loss prevention policies, acceptable-use training) or replace it with something whose architecture limits exposure by design. Ignoring it is a third option, but it's the $670,000 option.

What Is OpenAI Doing About These Risks?

Credit where it's due: they're iterating.

OpenAI introduced an optional Lockdown Mode that tightly restricts how ChatGPT interacts with external systems, aimed at reducing prompt-injection-based data exfiltration risk for high-risk users. The certifications are getting more rigorous. The patching cadence on the February 2026 disclosures was fast.

But "the vendor is getting better at security" is a description of a moving target, not a destination. New features (code execution, file uploads, browsing, agentic tools) create new attack surface continuously. The vendor is simultaneously expanding what ChatGPT can do and trying to lock down what it can leak. Those two goals are in tension by definition.

Policy Controls vs. Architectural Controls: Why the Distinction Matters

Most "is ChatGPT secure" guides tell you to toggle off training, review your privacy settings, and use the enterprise tier. That's all correct and all insufficient.

A training opt-out is a policy control. It changes what a vendor does with data after they already have it. It's a promise backed by contract, audits, and regulation. Those are real enforcement mechanisms. But they failed, visibly, when a federal court ordered log preservation and production regardless of user settings.

Architectural controls are different. They change whether the vendor ever receives the real data. If you redact, tokenize, or localize sensitive content before it leaves your device, a court order against the vendor is irrelevant because the vendor never had the plaintext. A zero-day in the vendor's sandbox can't exfiltrate data that was never in the sandbox.

This is not a hypothetical distinction. It is the structural difference between "we trust the vendor" and "we don't need to trust the vendor." Both are valid postures. But they have radically different failure modes, and you should know which one you're choosing.

What Should You Actually Do?

If you're an individual professional using the consumer tier: go to Settings > Data Controls and disable model training. Understand that your data is still retained for 30 days, still accessible to the vendor, and still subject to potential legal process. Do not paste anything into the interface that you would not want produced in discovery. This is not paranoia. It is a thing that has already happened, to 20 million conversations, in a real federal case.

If you're running a team or a company: the consumer tier is not appropriate for business use. Full stop. Either deploy the enterprise tier with SSO, admin controls, and the no-training-by-default policy, or adopt a tool whose architecture minimizes what data reaches the provider in the first place.

If you're evaluating AI assistants for sensitive workflows: ask three questions. First, is the data encrypted in transit and at rest? (Baseline; everyone does this.) Second, what is the retention window, and can it be overridden by legal process? (The honest answer for any cloud service is "yes, it can.") Third, does the architecture require the provider to see the plaintext of your sensitive data at all?

The first two questions are about the vendor's policies. The third question is about the system's design. Only the third question survives a subpoena, a vulnerability, or a policy change.

Where This Leaves You

ChatGPT's transport encryption is standard and adequate. Its enterprise compliance posture is genuine and improving. Its consumer-tier defaults are bad for sensitive data, and its data is subject to legal process that can override any retention policy, which is not unique to this vendor but has been concretely demonstrated against this vendor in particular.

The real answer to "is ChatGPT secure" is: secure enough depends entirely on what you're pasting into it, which tier you're on, and what your actual threat model is. For casual use, it's fine. For anything involving customer data, proprietary code, legal communications, or regulated information, you need either the enterprise tier with proper governance or an architecture that doesn't require trusting the AI provider with your plaintext.

We built Selina around that third question. It runs on a stack of frontier models, routed per task, accessed via API. Memory is encrypted at rest (not end-to-end encrypted, since a slice of each request reaches a provider at inference). Files and transfers via SelinaSEND are end-to-end encrypted. Non-content operational metadata is kept for a short retention window. The account is protected; the content is encrypted. We designed it so that the sensitive parts of your data are handled with architectural controls, not just policy promises.

If that distinction matters to you: start a free 7-day trial, no card required.

Michael C.

Founder & Principal Engineer, Selina Labs

Michael builds Selina, a privacy-first AI that remembers you across conversations. He ships security-sensitive AI in production — real attacks, real fixes, measured in minutes and dollars — and writes about privacy, security, and LLMs from that seat. Top Rated Plus and expert-verified on Upwork.

• www.upwork.com
• x.com
• medium.com
• selinalabs.io