ChatGPT vs. innoGPT: data protection per plan

not publicly documented (the Enterprise privacy page mentions a DPA only for ChatGPT Business, Enterprise and API; Edu via Student Data Privacy Agreement)

not publicly documented (the Enterprise privacy page mentions a DPA only for ChatGPT Business, Enterprise and API; the Help Center article on Go refers on data protection only to the Privacy Policy, Terms of Use and Data Controls FAQ)

not publicly documented (the Enterprise privacy page mentions a DPA only for ChatGPT Business, Enterprise and API; the Help Center article on Plus refers on data protection only to the Privacy Policy, Terms of Use and Data Controls FAQ)

not publicly documented (the Enterprise privacy page mentions a DPA only for ChatGPT Business, Enterprise and API; Edu via Student Data Privacy Agreement)

yes: Enterprise privacy page: "we are able to execute a Data Processing Addendum (DPA) with customers for their use of ChatGPT Business, ChatGPT Enterprise, and the API"; concluded via the DPA form. OpenAI DPA (Effective 2026-01-01) published.

not publicly documented whether a DPA under Art. 28 GDPR can be concluded: Enterprise privacy page: "For ChatGPT Edu and for Teachers, we process your data pursuant to our Student Data Privacy Agreement." It covers ChatGPT For Teachers via the Education Terms and names only US law as "Privacy Laws" (FERPA, PPRA, supplemental state laws); the GDPR and Art. 28 are not mentioned. The offering is aimed only at US schools and school districts.

yes: Enterprise privacy page: "we are able to execute a Data Processing Addendum (DPA) with customers for their use of ChatGPT Business, ChatGPT Enterprise, and the API"; concluded via the DPA form. OpenAI DPA (Effective 2026-01-01) published.

not publicly documented whether a DPA under Art. 28 GDPR can be concluded: Enterprise privacy page: "For ChatGPT Edu and for Teachers, we process your data pursuant to our Student Data Privacy Agreement." The Student Data Privacy Agreement is a contract between OpenAI, LLC and the customer; in it, OpenAI is considered a FERPA "School Official", and "Privacy Laws" covers only US federal and state law (FERPA, PPRA, supplemental state laws); the GDPR and Art. 28 are not mentioned. The Enterprise privacy page mentions the OpenAI DPA only for Business, Enterprise and API.

yes: Enterprise privacy page: "we are able to execute a Data Processing Addendum (DPA) with customers for their use of ChatGPT Business, ChatGPT Enterprise, and the API"; concluded via the DPA form. OpenAI DPA (Effective 2026-01-01) published.

yes according to T&Cs § 9 (DPA under Art. 28 GDPR, can be concluded digitally in the back end where the customer processes personal data of third parties); whether this applies equally to private plans is not expressly documented (the app privacy policy refers to the DPA for workspaces of organisations)

yes according to T&Cs § 9 (DPA under Art. 28 GDPR, can be concluded digitally in the back end where the customer processes personal data of third parties); whether this applies equally to private plans is not expressly documented (the app privacy policy refers to the DPA for workspaces of organisations)

yes according to T&Cs § 9 (DPA under Art. 28 GDPR, can be concluded digitally in the back end where the customer processes personal data of third parties); whether this applies equally to private plans is not expressly documented (the app privacy policy refers to the DPA for workspaces of organisations)

yes according to T&Cs § 9 (DPA under Art. 28 GDPR, can be concluded digitally in the back end where the customer processes personal data of third parties); whether this applies equally to private plans is not expressly documented (the app privacy policy refers to the DPA for workspaces of organisations)

yes according to T&Cs § 9 (DPA under Art. 28 GDPR, can be concluded digitally in the back end where the customer processes personal data of third parties); security page: DPA can be concluded in the account settings, listed for download in the Trust Center; text of the DPA not publicly reviewed

yes (DPA under Art. 28 GDPR according to T&Cs § 9 and the page for persons bound by professional secrecy; in addition a confidentiality undertaking as a contributing person under § 203(4) StGB); contract texts not publicly reviewed

yes according to T&Cs § 9 (DPA under Art. 28 GDPR, can be concluded digitally in the back end where the customer processes personal data of third parties); security page: DPA can be concluded in the account settings, listed for download in the Trust Center; text of the DPA not publicly reviewed

Help Center (section Services for individuals): "When you use our services for individuals (Free, Plus, Pro), we may use your content to train our models. You can choose whether your conversations help improve our models. To opt out, turn off Improve the model for everyone under Settings > Data controls in ChatGPT, or select Do not train on my content in our Privacy Portal." Temporary chats: "are not used to improve OpenAI models while they remain temporary". Feedback exception: "If you choose to provide feedback, the entire conversation associated with that feedback may be used to train our models."

Help Center (section Services for individuals): "When you use our services for individuals (Free, Plus, Pro), we may use your content to train our models. You can choose whether your conversations help improve our models. To opt out, turn off Improve the model for everyone under Settings > Data controls in ChatGPT, or select Do not train on my content in our Privacy Portal." Temporary chats: "are not used to improve OpenAI models while they remain temporary". Feedback exception: "If you choose to provide feedback, the entire conversation associated with that feedback may be used to train our models." Help Center article on Go: "OpenAI may use conversations to improve model performance and safety. You can opt out of having your data used for training at any time."

Help Center (section Services for individuals): "When you use our services for individuals (Free, Plus, Pro), we may use your content to train our models. You can choose whether your conversations help improve our models. To opt out, turn off Improve the model for everyone under Settings > Data controls in ChatGPT, or select Do not train on my content in our Privacy Portal." Temporary chats: "are not used to improve OpenAI models while they remain temporary". Feedback exception: "If you choose to provide feedback, the entire conversation associated with that feedback may be used to train our models."

Help Center (section Services for individuals): "When you use our services for individuals (Free, Plus, Pro), we may use your content to train our models. You can choose whether your conversations help improve our models. To opt out, turn off Improve the model for everyone under Settings > Data controls in ChatGPT, or select Do not train on my content in our Privacy Portal." Temporary chats: "are not used to improve OpenAI models while they remain temporary". Feedback exception: "If you choose to provide feedback, the entire conversation associated with that feedback may be used to train our models."

Help Center: "By default, we don't use inputs or outputs from ChatGPT Business, ChatGPT Enterprise, ChatGPT Edu, or our API to improve our models." Enterprise privacy page: "We do not train our models on your data by default". Help Center (Business FAQ): "ChatGPT Business is governed by OpenAI Business Terms and the Enterprise Privacy commitments, and OpenAI does not train on your workspace data."

Help Center: "As with other Business customers, information shared with ChatGPT for Teachers is not used to train our models by default." In addition: "we may use automated systems to classify content for safety and quality."

Help Center: "By default, we don't use inputs or outputs from ChatGPT Business, ChatGPT Enterprise, ChatGPT Edu, or our API to improve our models." Enterprise privacy page: "We do not train our models on your data by default".

Help Center: "By default, we don't use inputs or outputs from ChatGPT Business, ChatGPT Enterprise, ChatGPT Edu, or our API to improve our models." Enterprise privacy page: "We do not train our models on your data by default".

Help Center: "By default, we don't use inputs or outputs from ChatGPT Business, ChatGPT Enterprise, ChatGPT Edu, or our API to improve our models." Enterprise privacy page: "We do not train our models on your data by default". API documentation: "data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us)". API organisation owners can enable data sharing (Help Center); only then can members share feedback and the current Playground chat.

T&Cs § 9: 'the provider does not use customer data to train the AI models' (translated). App privacy policy section 4: content is not used for training; all AI providers are used under enterprise or API contracts that exclude training on customer data. Security page: neither innoGPT nor technology partners (named: Microsoft) use inputs or outputs for training. Documentation does not differentiate by plan.

T&Cs § 9: 'the provider does not use customer data to train the AI models' (translated). App privacy policy section 4: content is not used for training; all AI providers are used under enterprise or API contracts that exclude training on customer data. Security page: neither innoGPT nor technology partners (named: Microsoft) use inputs or outputs for training. Documentation does not differentiate by plan.

T&Cs § 9: 'the provider does not use customer data to train the AI models' (translated). App privacy policy section 4: content is not used for training; all AI providers are used under enterprise or API contracts that exclude training on customer data. Security page: neither innoGPT nor technology partners (named: Microsoft) use inputs or outputs for training. Documentation does not differentiate by plan.

T&Cs § 9: 'the provider does not use customer data to train the AI models' (translated). App privacy policy section 4: content is not used for training; all AI providers are used under enterprise or API contracts that exclude training on customer data. Security page: neither innoGPT nor technology partners (named: Microsoft) use inputs or outputs for training. Documentation does not differentiate by plan.

T&Cs § 9: 'the provider does not use customer data to train the AI models' (translated). App privacy policy section 4: content is not used for training; all AI providers are used under enterprise or API contracts that exclude training on customer data. Security page: neither innoGPT nor technology partners (named: Microsoft) use inputs or outputs for training. Documentation does not differentiate by plan.

Pricing page: 'Vertraglich zugesicherter Verzicht auf Modelltraining' (translated: contractually assured waiver of model training). T&Cs § 9 and app privacy policy section 4: no use of customer data or content for training; AI providers under contracts that exclude training on customer data.

T&Cs § 9: 'the provider does not use customer data to train the AI models' (translated). App privacy policy section 4: content is not used for training; all AI providers are used under enterprise or API contracts that exclude training on customer data. Security page: neither innoGPT nor technology partners (named: Microsoft) use inputs or outputs for training. Documentation does not differentiate by plan.

Privacy policy (Europe, 2026-08-24), section 10: "OpenAI processes your Personal Data on servers located outside of the EEA, Switzerland and the UK ... This includes processing and storing your Personal Data in our facilities and servers in the United States or in countries or territories where our affiliates and partners or our vendors and service providers are located." Pricing page: row "Data residency in US, EU, UK, JP, CA, KR, SG, IN, AU, UAE" = No for Free, Go, Plus, Pro.

Privacy policy (Europe, 2026-08-24), section 10: "OpenAI processes your Personal Data on servers located outside of the EEA, Switzerland and the UK ... This includes processing and storing your Personal Data in our facilities and servers in the United States or in countries or territories where our affiliates and partners or our vendors and service providers are located." Pricing page: row "Data residency in US, EU, UK, JP, CA, KR, SG, IN, AU, UAE" = No for Free, Go, Plus, Pro.

Privacy policy (Europe, 2026-08-24), section 10: "OpenAI processes your Personal Data on servers located outside of the EEA, Switzerland and the UK ... This includes processing and storing your Personal Data in our facilities and servers in the United States or in countries or territories where our affiliates and partners or our vendors and service providers are located." Pricing page: row "Data residency in US, EU, UK, JP, CA, KR, SG, IN, AU, UAE" = No for Free, Go, Plus, Pro.

Privacy policy (Europe, 2026-08-24), section 10: "OpenAI processes your Personal Data on servers located outside of the EEA, Switzerland and the UK ... This includes processing and storing your Personal Data in our facilities and servers in the United States or in countries or territories where our affiliates and partners or our vendors and service providers are located." Pricing page: row "Data residency in US, EU, UK, JP, CA, KR, SG, IN, AU, UAE" = No for Free, Go, Plus, Pro.

not publicly documented for Business: the residency page in the Help Center (as of 2026-10-18) names as eligible "Eligible API customers and new ChatGPT Enterprise/Edu customers" (q5), the business data page "Eligible ChatGPT Enterprise, ChatGPT Edu, ChatGPT for Healthcare, and API platform customers" (q11); ChatGPT Business is not named in either. The pricing page lists data residency in ten regions only for the Enterprise plan. The sub-processor list (as of 2026-10-14) names processing locations for Business in the USA and other countries (including EU Member States), without a choice.

not publicly documented: the Help Center refers to sales for data residency and EKM ("You require advanced enterprise features (for example, data residency or EKM)"); the residency page does not name Teachers.

Help Center Data residency (as of 2026-10-18): "Eligible API customers and new ChatGPT Enterprise/Edu customers can choose to have in-scope customer content stored at rest in supported countries." Regions: Australia, Canada, Europe (EEA + Switzerland), India, Japan, Singapore, South Korea, UAE, UK, USA. Inference residency (GPU execution in the region) only for Europe (EEA + Switzerland), USA and UAE, and only with data residency activated in the same region. In scope: Memory, Code Interpreter/Data Analysis artefacts, conversations (text, image, voice), Custom GPTs, files, image generation inputs/outputs, incl. backups/replicas; new features only if listed. Outside the region, data from external integrations (Apps & MCP, Web Search), transient processing steps, workspace metadata and name, billing information and logins, among others, may be stored ("Certain categories of data may be stored outside the chosen data region"); CPU processing such as authentication, routing and analytics may run outside the region. Applies to newly provisioned workspaces; eligibility via sales; at no additional cost for Enterprise and Education.

Help Center Data residency (as of 2026-10-18): "new ChatGPT Enterprise/Edu customers can choose to have in-scope customer content stored at rest in supported countries"; Europe (EEA + Switzerland) is a supported region; inference residency for Enterprise/Edu with data residency activated (Europe, USA, UAE). Exceptions as for Enterprise (including external integrations, workspace metadata, billing information, logins). Eligibility via sales; at no additional cost for Education.

Help Center Data residency: "Eligible API customers ... can choose to have in-scope customer content stored at rest in supported countries". API documentation (Data controls, as of 2026-10-18): data residency is a project setting; "Contact our sales team to see if you're eligible for using data residency controls." Regions with their own endpoints: USA, Europe (EEA + Switzerland, eu.api.openai.com), Australia, Canada, Japan, India, Singapore, South Korea, UK, UAE; inference in the region only for the USA, Europe and the UAE, the other regions storage only; all regions except the USA require Modified Abuse Monitoring or Zero Data Retention. System data (account data, metadata, usage data without customer content) may be processed and stored outside the region. For models released from 2026-03-05, a 10% uplift applies on residency endpoints.

T&Cs § 9: processing generally on servers in the EU; where the customer expressly selects models hosted outside the EU, the customer consents to the transfer (configurable in the settings). App privacy policy section 5: hosting location per model shown in the model selection, automatic model selection prefers EU models, administrators can switch off non-EU models. Models page: 98 models, of which 68 'EU-hosted', the rest 'Global'. Security page: servers in Frankfurt am Main (including AWS); 'the software and (most) AI models are hosted in Europe' (translated).

T&Cs § 9: processing generally on servers in the EU; where the customer expressly selects models hosted outside the EU, the customer consents to the transfer (configurable in the settings). App privacy policy section 5: hosting location per model shown in the model selection, automatic model selection prefers EU models, administrators can switch off non-EU models. Models page: 98 models, of which 68 'EU-hosted', the rest 'Global'. Security page: servers in Frankfurt am Main (including AWS); 'the software and (most) AI models are hosted in Europe' (translated).

T&Cs § 9: processing generally on servers in the EU; where the customer expressly selects models hosted outside the EU, the customer consents to the transfer (configurable in the settings). App privacy policy section 5: hosting location per model shown in the model selection, automatic model selection prefers EU models, administrators can switch off non-EU models. Models page: 98 models, of which 68 'EU-hosted', the rest 'Global'. Security page: servers in Frankfurt am Main (including AWS); 'the software and (most) AI models are hosted in Europe' (translated).

T&Cs § 9: processing generally on servers in the EU; where the customer expressly selects models hosted outside the EU, the customer consents to the transfer (configurable in the settings). App privacy policy section 5: hosting location per model shown in the model selection, automatic model selection prefers EU models, administrators can switch off non-EU models. Models page: 98 models, of which 68 'EU-hosted', the rest 'Global'. Security page: servers in Frankfurt am Main (including AWS); 'the software and (most) AI models are hosted in Europe' (translated).

T&Cs § 9: processing generally on servers in the EU; where the customer expressly selects models hosted outside the EU, the customer consents to the transfer (configurable in the settings). App privacy policy section 5: hosting location per model shown in the model selection, automatic model selection prefers EU models, administrators can switch off non-EU models. Models page: 98 models, of which 68 'EU-hosted', the rest 'Global'. Security page: servers in Frankfurt am Main (including AWS); 'the software and (most) AI models are hosted in Europe' (translated).

As Business; in addition, according to the pricing page and the page for persons bound by professional secrecy, 'EU-Hosting in Berlin' (ISO 27001 certified) with the § 203 licence; the customer controls which models are enabled. T&Cs § 9: processing generally on servers in the EU; non-EU models only where expressly selected.

As Business; in addition, according to the pricing page, self-hosting/on-premises possible (scope not publicly documented).

• not publicly documented for consumer plans (the sub-processor list, as of 2026-10-14, names API, ChatGPT Enterprise, Edu and Business as its scope; for Plus and Pro it states only for ChatGPT Sites that the listed sub-processors may provide web hosting, infrastructure, moderation and support; reference: https://openai.com/policies/sub-processor-list/)

• not publicly documented for consumer plans (the sub-processor list, as of 2026-10-14, names API, ChatGPT Enterprise, Edu and Business as its scope; for Plus and Pro it states only for ChatGPT Sites that the listed sub-processors may provide web hosting, infrastructure, moderation and support; reference: https://openai.com/policies/sub-processor-list/)

• not publicly documented for consumer plans (the sub-processor list, as of 2026-10-14, names API, ChatGPT Enterprise, Edu and Business as its scope; for Plus and Pro it states only for ChatGPT Sites that the listed sub-processors may provide web hosting, infrastructure, moderation and support; reference: https://openai.com/policies/sub-processor-list/)

• not publicly documented for consumer plans (the sub-processor list, as of 2026-10-14, names API, ChatGPT Enterprise, Edu and Business as its scope; for Plus and Pro it states only for ChatGPT Sites that the listed sub-processors may provide web hosting, infrastructure, moderation and support; reference: https://openai.com/policies/sub-processor-list/)

• According to the list (as of 2026-10-14, applies to API, ChatGPT Enterprise, Edu, Business): OpenAI companies OpenAI, OpCo, LLC and OAI International, Inc. (USA), OpenAI Ireland Ltd. (Ireland), OpenAI UK Ltd., OpenAI Japan Ltd. (standard contractual clauses between group companies)
• Cloudflare, Ltd. (CDN; data centre closest to the end user; for requests to us.api.openai.com or eu.api.openai.com, TLS termination in the selected region via Cloudflare Regional Services; also web hosting for ChatGPT Sites in the USA for Enterprise, Edu, Business)
• Microsoft Corporation (cloud infrastructure; including Belgium, Denmark, Germany, France, Ireland, Italy, the Netherlands, Norway, Poland, Sweden, Switzerland, Spain, the UK, the USA and others)
• CoreWeave, Inc. (cloud infrastructure; Norway, Spain, Sweden, UK, USA)
• Oracle Cloud Infrastructure (cloud infrastructure; Brazil, Japan, Malaysia, the Netherlands, the UK, the USA)
• Google Cloud Platform (cloud infrastructure; Finland, Japan, the Netherlands, Norway, Singapore, the UK, the USA)
• Amazon Web Services, Inc. (cloud infrastructure; USA)
• Cerebras (cloud infrastructure; USA, Canada)
• Snowflake, Inc. (data warehousing; USA; for the API except with Zero Data Retention)
• TaskUs, LLC (customer support; for API and Business moderation of content; for Enterprise, Edu and Business moderation of GPTs; Philippines)
• Salesforce (customer support; including Germany, France, Ireland, Italy, the Netherlands, Sweden, Switzerland, the UK, the USA and others)
• Pylon Labs (customer support; USA; API, Enterprise, Edu only; at the customer's choice, premium support only)
• Accenture International Limited (customer support; for API/Business also moderation of content; USA, Canada, Philippines)
• Fivetran, Inc. (ETL; USA)
• Cinder Technologies, Inc. (platform for content or GPT moderation; USA; for API except where Zero Data Retention is used)
• WorkOS, Inc. (cross-domain identity management; USA; at the customer's choice; Enterprise, Edu, Business)
• Merge API, Inc. (infrastructure management, only with activated Connectors; including France, Ireland, Sweden, the UK, the USA and others; at the customer's choice)

• not publicly documented (the sub-processor list, as of 2026-10-14, does not name ChatGPT for Teachers; according to the Help Center, authorised employees and "specialized third-party contractors" have access to stored conversations to review for abuse)

• According to the list (as of 2026-10-14, applies to API, ChatGPT Enterprise, Edu, Business): OpenAI companies OpenAI, OpCo, LLC and OAI International, Inc. (USA), OpenAI Ireland Ltd. (Ireland), OpenAI UK Ltd., OpenAI Japan Ltd. (standard contractual clauses between group companies)
• Cloudflare, Ltd. (CDN; data centre closest to the end user; for requests to us.api.openai.com or eu.api.openai.com, TLS termination in the selected region via Cloudflare Regional Services; also web hosting for ChatGPT Sites in the USA for Enterprise, Edu, Business)
• Microsoft Corporation (cloud infrastructure; including Belgium, Denmark, Germany, France, Ireland, Italy, the Netherlands, Norway, Poland, Sweden, Switzerland, Spain, the UK, the USA and others)
• CoreWeave, Inc. (cloud infrastructure; Norway, Spain, Sweden, UK, USA)
• Oracle Cloud Infrastructure (cloud infrastructure; Brazil, Japan, Malaysia, the Netherlands, the UK, the USA)
• Google Cloud Platform (cloud infrastructure; Finland, Japan, the Netherlands, Norway, Singapore, the UK, the USA)
• Amazon Web Services, Inc. (cloud infrastructure; USA)
• Cerebras (cloud infrastructure; USA, Canada)
• Snowflake, Inc. (data warehousing; USA; for the API except with Zero Data Retention)
• TaskUs, LLC (customer support; for API and Business moderation of content; for Enterprise, Edu and Business moderation of GPTs; Philippines)
• Salesforce (customer support; including Germany, France, Ireland, Italy, the Netherlands, Sweden, Switzerland, the UK, the USA and others)
• Pylon Labs (customer support; USA; API, Enterprise, Edu only; at the customer's choice, premium support only)
• Accenture International Limited (customer support; for API/Business also moderation of content; USA, Canada, Philippines)
• Fivetran, Inc. (ETL; USA)
• Cinder Technologies, Inc. (platform for content or GPT moderation; USA; for API except where Zero Data Retention is used)
• WorkOS, Inc. (cross-domain identity management; USA; at the customer's choice; Enterprise, Edu, Business)
• Merge API, Inc. (infrastructure management, only with activated Connectors; including France, Ireland, Sweden, the UK, the USA and others; at the customer's choice)

• According to the list (as of 2026-10-14, applies to API, ChatGPT Enterprise, Edu, Business): OpenAI companies OpenAI, OpCo, LLC and OAI International, Inc. (USA), OpenAI Ireland Ltd. (Ireland), OpenAI UK Ltd., OpenAI Japan Ltd. (standard contractual clauses between group companies)
• Cloudflare, Ltd. (CDN; data centre closest to the end user; for requests to us.api.openai.com or eu.api.openai.com, TLS termination in the selected region via Cloudflare Regional Services; also web hosting for ChatGPT Sites in the USA for Enterprise, Edu, Business)
• Microsoft Corporation (cloud infrastructure; including Belgium, Denmark, Germany, France, Ireland, Italy, the Netherlands, Norway, Poland, Sweden, Switzerland, Spain, the UK, the USA and others)
• CoreWeave, Inc. (cloud infrastructure; Norway, Spain, Sweden, UK, USA)
• Oracle Cloud Infrastructure (cloud infrastructure; Brazil, Japan, Malaysia, the Netherlands, the UK, the USA)
• Google Cloud Platform (cloud infrastructure; Finland, Japan, the Netherlands, Norway, Singapore, the UK, the USA)
• Amazon Web Services, Inc. (cloud infrastructure; USA)
• Cerebras (cloud infrastructure; USA, Canada)
• Snowflake, Inc. (data warehousing; USA; for the API except with Zero Data Retention)
• TaskUs, LLC (customer support; for API and Business moderation of content; for Enterprise, Edu and Business moderation of GPTs; Philippines)
• Salesforce (customer support; including Germany, France, Ireland, Italy, the Netherlands, Sweden, Switzerland, the UK, the USA and others)
• Pylon Labs (customer support; USA; API, Enterprise, Edu only; at the customer's choice, premium support only)
• Accenture International Limited (customer support; for API/Business also moderation of content; USA, Canada, Philippines)
• Fivetran, Inc. (ETL; USA)
• Cinder Technologies, Inc. (platform for content or GPT moderation; USA; for API except where Zero Data Retention is used)
• WorkOS, Inc. (cross-domain identity management; USA; at the customer's choice; Enterprise, Edu, Business)
• Merge API, Inc. (infrastructure management, only with activated Connectors; including France, Ireland, Sweden, the UK, the USA and others; at the customer's choice)

• According to the list (as of 2026-10-14, applies to API, ChatGPT Enterprise, Edu, Business): OpenAI companies OpenAI, OpCo, LLC and OAI International, Inc. (USA), OpenAI Ireland Ltd. (Ireland), OpenAI UK Ltd., OpenAI Japan Ltd. (standard contractual clauses between group companies)
• Cloudflare, Ltd. (CDN; data centre closest to the end user; for requests to us.api.openai.com or eu.api.openai.com, TLS termination in the selected region via Cloudflare Regional Services; also web hosting for ChatGPT Sites in the USA for Enterprise, Edu, Business)
• Microsoft Corporation (cloud infrastructure; including Belgium, Denmark, Germany, France, Ireland, Italy, the Netherlands, Norway, Poland, Sweden, Switzerland, Spain, the UK, the USA and others)
• CoreWeave, Inc. (cloud infrastructure; Norway, Spain, Sweden, UK, USA)
• Oracle Cloud Infrastructure (cloud infrastructure; Brazil, Japan, Malaysia, the Netherlands, the UK, the USA)
• Google Cloud Platform (cloud infrastructure; Finland, Japan, the Netherlands, Norway, Singapore, the UK, the USA)
• Amazon Web Services, Inc. (cloud infrastructure; USA)
• Cerebras (cloud infrastructure; USA, Canada)
• Snowflake, Inc. (data warehousing; USA; for the API except with Zero Data Retention)
• TaskUs, LLC (customer support; for API and Business moderation of content; for Enterprise, Edu and Business moderation of GPTs; Philippines)
• Salesforce (customer support; including Germany, France, Ireland, Italy, the Netherlands, Sweden, Switzerland, the UK, the USA and others)
• Pylon Labs (customer support; USA; API, Enterprise, Edu only; at the customer's choice, premium support only)
• Accenture International Limited (customer support; for API/Business also moderation of content; USA, Canada, Philippines)
• Fivetran, Inc. (ETL; USA)
• Cinder Technologies, Inc. (platform for content or GPT moderation; USA; for API except where Zero Data Retention is used)
• WorkOS, Inc. (cross-domain identity management; USA; at the customer's choice; Enterprise, Edu, Business)
• Merge API, Inc. (infrastructure management, only with activated Connectors; including France, Ireland, Sweden, the UK, the USA and others; at the customer's choice)

• Vercel Inc. (USA): hosting and running the application; processing Frankfurt am Main (EU)
• Supabase Pte. Ltd. (Singapore, on AWS): database and file storage; processing Frankfurt am Main (EU)
• Hetzner Online GmbH (Germany): backups and redaction of personal data; processing Falkenstein (EU)
• Clerk Inc. (USA): sign-in and user management; processing USA
• API Hero Ltd (Trigger.dev, United Kingdom): background jobs; processing Frankfurt am Main (EU)
• Upstash Inc. (USA): rate limiting; processing Frankfurt am Main (EU)
• Stripe Payments Europe, Limited (Ireland): payment processing; processing EU
• Functional Software Inc. (Sentry, USA): error analysis; processing Frankfurt am Main (EU)
• PostHog Inc. (USA): product analytics; processing Frankfurt am Main (EU)
• Astrodon Inc. (USA): sending e-mail; processing USA
• LlamaIndex Inc. (USA): file processing; processing EU
• Amazon Web Services EMEA SARL: AI models; processing EU
• Google Ireland Limited (Ireland): AI models; processing EU
• Microsoft Ireland Operations, Ltd. (Ireland): AI models; processing EU (Sweden), actively selected 'global' models worldwide
• Mistral AI (France): AI models; processing EU (France)
• OpenAI Ireland Ltd (Ireland): AI models; processing EU
• Perplexity AI, Inc. (USA): AI models; processing USA
• Replicate, Inc. (USA): AI models (image generation); processing USA
• Exa Labs Inc. (USA): web search; processing USA
• Sideguide Technologies Inc. (USA): fetching web pages; processing USA
• Eleven Labs Inc. (USA): voice input and output; processing EU (Brussels)
• Pipedream Inc. (USA): third-party integrations; processing USA
• Cordnet OÜ (Featurebase, Estonia): feedback portal; processing EU
• Rewardful Inc. (Canada): affiliate programme; processing Canada
• For add-on features the customer activates (e.g. meeting assistant, code execution, learning videos), further specialised service providers, named only on request; the Trust Center counts 31 sub-processors (including Cohere, E2B, ElevenLabs)

• Vercel Inc. (USA): hosting and running the application; processing Frankfurt am Main (EU)
• Supabase Pte. Ltd. (Singapore, on AWS): database and file storage; processing Frankfurt am Main (EU)
• Hetzner Online GmbH (Germany): backups and redaction of personal data; processing Falkenstein (EU)
• Clerk Inc. (USA): sign-in and user management; processing USA
• API Hero Ltd (Trigger.dev, United Kingdom): background jobs; processing Frankfurt am Main (EU)
• Upstash Inc. (USA): rate limiting; processing Frankfurt am Main (EU)
• Stripe Payments Europe, Limited (Ireland): payment processing; processing EU
• Functional Software Inc. (Sentry, USA): error analysis; processing Frankfurt am Main (EU)
• PostHog Inc. (USA): product analytics; processing Frankfurt am Main (EU)
• Astrodon Inc. (USA): sending e-mail; processing USA
• LlamaIndex Inc. (USA): file processing; processing EU
• Amazon Web Services EMEA SARL: AI models; processing EU
• Google Ireland Limited (Ireland): AI models; processing EU
• Microsoft Ireland Operations, Ltd. (Ireland): AI models; processing EU (Sweden), actively selected 'global' models worldwide
• Mistral AI (France): AI models; processing EU (France)
• OpenAI Ireland Ltd (Ireland): AI models; processing EU
• Perplexity AI, Inc. (USA): AI models; processing USA
• Replicate, Inc. (USA): AI models (image generation); processing USA
• Exa Labs Inc. (USA): web search; processing USA
• Sideguide Technologies Inc. (USA): fetching web pages; processing USA
• Eleven Labs Inc. (USA): voice input and output; processing EU (Brussels)
• Pipedream Inc. (USA): third-party integrations; processing USA
• Cordnet OÜ (Featurebase, Estonia): feedback portal; processing EU
• Rewardful Inc. (Canada): affiliate programme; processing Canada
• For add-on features the customer activates (e.g. meeting assistant, code execution, learning videos), further specialised service providers, named only on request; the Trust Center counts 31 sub-processors (including Cohere, E2B, ElevenLabs)

• Vercel Inc. (USA): hosting and running the application; processing Frankfurt am Main (EU)
• Supabase Pte. Ltd. (Singapore, on AWS): database and file storage; processing Frankfurt am Main (EU)
• Hetzner Online GmbH (Germany): backups and redaction of personal data; processing Falkenstein (EU)
• Clerk Inc. (USA): sign-in and user management; processing USA
• API Hero Ltd (Trigger.dev, United Kingdom): background jobs; processing Frankfurt am Main (EU)
• Upstash Inc. (USA): rate limiting; processing Frankfurt am Main (EU)
• Stripe Payments Europe, Limited (Ireland): payment processing; processing EU
• Functional Software Inc. (Sentry, USA): error analysis; processing Frankfurt am Main (EU)
• PostHog Inc. (USA): product analytics; processing Frankfurt am Main (EU)
• Astrodon Inc. (USA): sending e-mail; processing USA
• LlamaIndex Inc. (USA): file processing; processing EU
• Amazon Web Services EMEA SARL: AI models; processing EU
• Google Ireland Limited (Ireland): AI models; processing EU
• Microsoft Ireland Operations, Ltd. (Ireland): AI models; processing EU (Sweden), actively selected 'global' models worldwide
• Mistral AI (France): AI models; processing EU (France)
• OpenAI Ireland Ltd (Ireland): AI models; processing EU
• Perplexity AI, Inc. (USA): AI models; processing USA
• Replicate, Inc. (USA): AI models (image generation); processing USA
• Exa Labs Inc. (USA): web search; processing USA
• Sideguide Technologies Inc. (USA): fetching web pages; processing USA
• Eleven Labs Inc. (USA): voice input and output; processing EU (Brussels)
• Pipedream Inc. (USA): third-party integrations; processing USA
• Cordnet OÜ (Featurebase, Estonia): feedback portal; processing EU
• Rewardful Inc. (Canada): affiliate programme; processing Canada
• For add-on features the customer activates (e.g. meeting assistant, code execution, learning videos), further specialised service providers, named only on request; the Trust Center counts 31 sub-processors (including Cohere, E2B, ElevenLabs)

• Vercel Inc. (USA): hosting and running the application; processing Frankfurt am Main (EU)
• Supabase Pte. Ltd. (Singapore, on AWS): database and file storage; processing Frankfurt am Main (EU)
• Hetzner Online GmbH (Germany): backups and redaction of personal data; processing Falkenstein (EU)
• Clerk Inc. (USA): sign-in and user management; processing USA
• API Hero Ltd (Trigger.dev, United Kingdom): background jobs; processing Frankfurt am Main (EU)
• Upstash Inc. (USA): rate limiting; processing Frankfurt am Main (EU)
• Stripe Payments Europe, Limited (Ireland): payment processing; processing EU
• Functional Software Inc. (Sentry, USA): error analysis; processing Frankfurt am Main (EU)
• PostHog Inc. (USA): product analytics; processing Frankfurt am Main (EU)
• Astrodon Inc. (USA): sending e-mail; processing USA
• LlamaIndex Inc. (USA): file processing; processing EU
• Amazon Web Services EMEA SARL: AI models; processing EU
• Google Ireland Limited (Ireland): AI models; processing EU
• Microsoft Ireland Operations, Ltd. (Ireland): AI models; processing EU (Sweden), actively selected 'global' models worldwide
• Mistral AI (France): AI models; processing EU (France)
• OpenAI Ireland Ltd (Ireland): AI models; processing EU
• Perplexity AI, Inc. (USA): AI models; processing USA
• Replicate, Inc. (USA): AI models (image generation); processing USA
• Exa Labs Inc. (USA): web search; processing USA
• Sideguide Technologies Inc. (USA): fetching web pages; processing USA
• Eleven Labs Inc. (USA): voice input and output; processing EU (Brussels)
• Pipedream Inc. (USA): third-party integrations; processing USA
• Cordnet OÜ (Featurebase, Estonia): feedback portal; processing EU
• Rewardful Inc. (Canada): affiliate programme; processing Canada
• For add-on features the customer activates (e.g. meeting assistant, code execution, learning videos), further specialised service providers, named only on request; the Trust Center counts 31 sub-processors (including Cohere, E2B, ElevenLabs)

• Vercel Inc. (USA): hosting and running the application; processing Frankfurt am Main (EU)
• Supabase Pte. Ltd. (Singapore, on AWS): database and file storage; processing Frankfurt am Main (EU)
• Hetzner Online GmbH (Germany): backups and redaction of personal data; processing Falkenstein (EU)
• Clerk Inc. (USA): sign-in and user management; processing USA
• API Hero Ltd (Trigger.dev, United Kingdom): background jobs; processing Frankfurt am Main (EU)
• Upstash Inc. (USA): rate limiting; processing Frankfurt am Main (EU)
• Stripe Payments Europe, Limited (Ireland): payment processing; processing EU
• Functional Software Inc. (Sentry, USA): error analysis; processing Frankfurt am Main (EU)
• PostHog Inc. (USA): product analytics; processing Frankfurt am Main (EU)
• Astrodon Inc. (USA): sending e-mail; processing USA
• LlamaIndex Inc. (USA): file processing; processing EU
• Amazon Web Services EMEA SARL: AI models; processing EU
• Google Ireland Limited (Ireland): AI models; processing EU
• Microsoft Ireland Operations, Ltd. (Ireland): AI models; processing EU (Sweden), actively selected 'global' models worldwide
• Mistral AI (France): AI models; processing EU (France)
• OpenAI Ireland Ltd (Ireland): AI models; processing EU
• Perplexity AI, Inc. (USA): AI models; processing USA
• Replicate, Inc. (USA): AI models (image generation); processing USA
• Exa Labs Inc. (USA): web search; processing USA
• Sideguide Technologies Inc. (USA): fetching web pages; processing USA
• Eleven Labs Inc. (USA): voice input and output; processing EU (Brussels)
• Pipedream Inc. (USA): third-party integrations; processing USA
• Cordnet OÜ (Featurebase, Estonia): feedback portal; processing EU
• Rewardful Inc. (Canada): affiliate programme; processing Canada
• For add-on features the customer activates (e.g. meeting assistant, code execution, learning videos), further specialised service providers, named only on request; the Trust Center counts 31 sub-processors (including Cohere, E2B, ElevenLabs)

• Vercel Inc. (USA): hosting and running the application; processing Frankfurt am Main (EU)
• Supabase Pte. Ltd. (Singapore, on AWS): database and file storage; processing Frankfurt am Main (EU)
• Hetzner Online GmbH (Germany): backups and redaction of personal data; processing Falkenstein (EU)
• Clerk Inc. (USA): sign-in and user management; processing USA
• API Hero Ltd (Trigger.dev, United Kingdom): background jobs; processing Frankfurt am Main (EU)
• Upstash Inc. (USA): rate limiting; processing Frankfurt am Main (EU)
• Stripe Payments Europe, Limited (Ireland): payment processing; processing EU
• Functional Software Inc. (Sentry, USA): error analysis; processing Frankfurt am Main (EU)
• PostHog Inc. (USA): product analytics; processing Frankfurt am Main (EU)
• Astrodon Inc. (USA): sending e-mail; processing USA
• LlamaIndex Inc. (USA): file processing; processing EU
• Amazon Web Services EMEA SARL: AI models; processing EU
• Google Ireland Limited (Ireland): AI models; processing EU
• Microsoft Ireland Operations, Ltd. (Ireland): AI models; processing EU (Sweden), actively selected 'global' models worldwide
• Mistral AI (France): AI models; processing EU (France)
• OpenAI Ireland Ltd (Ireland): AI models; processing EU
• Perplexity AI, Inc. (USA): AI models; processing USA
• Replicate, Inc. (USA): AI models (image generation); processing USA
• Exa Labs Inc. (USA): web search; processing USA
• Sideguide Technologies Inc. (USA): fetching web pages; processing USA
• Eleven Labs Inc. (USA): voice input and output; processing EU (Brussels)
• Pipedream Inc. (USA): third-party integrations; processing USA
• Cordnet OÜ (Featurebase, Estonia): feedback portal; processing EU
• Rewardful Inc. (Canada): affiliate programme; processing Canada
• For add-on features the customer activates (e.g. meeting assistant, code execution, learning videos), further specialised service providers, named only on request; the Trust Center counts 31 sub-processors (including Cohere, E2B, ElevenLabs)

• Vercel Inc. (USA): hosting and running the application; processing Frankfurt am Main (EU)
• Supabase Pte. Ltd. (Singapore, on AWS): database and file storage; processing Frankfurt am Main (EU)
• Hetzner Online GmbH (Germany): backups and redaction of personal data; processing Falkenstein (EU)
• Clerk Inc. (USA): sign-in and user management; processing USA
• API Hero Ltd (Trigger.dev, United Kingdom): background jobs; processing Frankfurt am Main (EU)
• Upstash Inc. (USA): rate limiting; processing Frankfurt am Main (EU)
• Stripe Payments Europe, Limited (Ireland): payment processing; processing EU
• Functional Software Inc. (Sentry, USA): error analysis; processing Frankfurt am Main (EU)
• PostHog Inc. (USA): product analytics; processing Frankfurt am Main (EU)
• Astrodon Inc. (USA): sending e-mail; processing USA
• LlamaIndex Inc. (USA): file processing; processing EU
• Amazon Web Services EMEA SARL: AI models; processing EU
• Google Ireland Limited (Ireland): AI models; processing EU
• Microsoft Ireland Operations, Ltd. (Ireland): AI models; processing EU (Sweden), actively selected 'global' models worldwide
• Mistral AI (France): AI models; processing EU (France)
• OpenAI Ireland Ltd (Ireland): AI models; processing EU
• Perplexity AI, Inc. (USA): AI models; processing USA
• Replicate, Inc. (USA): AI models (image generation); processing USA
• Exa Labs Inc. (USA): web search; processing USA
• Sideguide Technologies Inc. (USA): fetching web pages; processing USA
• Eleven Labs Inc. (USA): voice input and output; processing EU (Brussels)
• Pipedream Inc. (USA): third-party integrations; processing USA
• Cordnet OÜ (Featurebase, Estonia): feedback portal; processing EU
• Rewardful Inc. (Canada): affiliate programme; processing Canada
• For add-on features the customer activates (e.g. meeting assistant, code execution, learning videos), further specialised service providers, named only on request; the Trust Center counts 31 sub-processors (including Cohere, E2B, ElevenLabs)

€0 per month (pricing page, de-DE rendered in the browser; according to the FAQ, Free is available to everyone) (as of 2026-10-18)

€8 per month (pricing page, de-DE rendered in the browser; no statement whether incl. VAT). Help Center: purchases in USD, local-currency billing only in some countries; monthly billing only, no annual plan; no USD amount is stated there (as of 2026-10-18)

€23 per month (pricing page, de-DE rendered in the browser; no statement whether incl. VAT). Help Center: "$20/month (billed monthly)"; no annual plan (as of 2026-10-18)

Pro 100: USD 100, Pro 200: USD 200, Pro 500: USD 500 per month (Help Center; Ultrafast models only in Pro 500; monthly billing only, no annual plan). Pricing page, de-DE rendered in the browser: from €103 per month; euro amounts for Pro 200 and Pro 500 are not shown there (as of 2026-10-18)

Standard seat €21 per user per month billed annually, €26 billed monthly; Premium seat (5x usage, no five-hour limit) €105 or €130 respectively (pricing page, de-DE rendered in the browser). Help Center: Standard USD 20 annually or USD 25 monthly, Premium USD 100 or USD 125 per user per month; "Prices listed here are in USD and may vary by country and currency". At least 2, at most 200 paid seats (as of 2026-10-18)

free for verified US K–12 teachers until June 2028 (Help Center, as of 2026-10-18); pricing possible thereafter with advance notice. The FAQ on the pricing page (de-DE) states June 2027 instead.

Price on request (pricing page: custom pricing via sales; annual plan; billing by credits or by tokens available) (as of 2026-10-18)

not publicly documented (the pricing page describes ChatGPT Edu as a low-cost plan for universities, without an amount; contact via sales) (as of 2026-10-18)

Price not publicly documented (usage-based API prices not evaluated from a primary source)

EUR 9.90 per month incl. VAT; with annual billing ('1 Monat gratis', one month free) EUR 9.08 per month; 7-day free trial without payment details (pricing page, as of 2026-10-18)

EUR 19 per month incl. VAT; with annual billing EUR 17.42 per month (pricing page, as of 2026-10-18)

EUR 34.90 per month incl. VAT for up to 5 people in a household; with annual billing EUR 31.99 per month (pricing page, as of 2026-10-18)

EUR 49.90 per month incl. VAT; with annual billing EUR 45.74 per month (pricing page, as of 2026-10-18)

Pricing page (as of 2026-10-18, excl. VAT): Business EUR 25 per user/month, with annual billing EUR 22.92; Business Max licence (higher individual premium budget, can be combined with Business licences) EUR 109 per user/month, annually EUR 99. One-off top-up packs EUR 5 to 1,000. Add-ons: PII filter from EUR 69/month, video generation per generation, audio overview 3 generations/month free, external API per token (token prices per model on the models page, e.g. gpt-5 EUR 1.29 input / EUR 10.29 output per million tokens; VAT not stated there). 7-day free trial (standard models only).

EUR 25 per user/month excl. VAT, from 20 licences, on request only (pricing page, as of 2026-10-18); according to the pricing page the trial is not yet § 203 compliant

Custom, contact sales; possible from 1,000+ users; pilot programme 3 months from EUR 8,500 (pricing page, as of 2026-10-18)

yes (according to the pricing page: unlimited text chats with GPT-6, limited uploads, image creation, voice chats)

yes (Free plus more messages with tools, uploads, image creation, voice chats, longer Memory; according to the pricing page "This plan may include ads")

yes (Go plus advanced GPT-6 reasoning models, more messages/uploads, Deep Research, Projects, Codex, ChatGPT Work)

yes (Plus plus three usage tiers, Pro reasoning with GPT-6 Astra, Codex/Work sessions, Dot, maximum Deep Research)

yes (Business workspace with workspace admin control of retention according to the Enterprise privacy page; feature scope not evaluated in the retrieved pricing text)

yes (according to the Help Center, a self-serve workspace for verified US K–12 teachers and school staff, not for students; including file uploads, deep research, voice mode, image generation, memory, Custom GPTs, admin features with SSO and RBAC)

yes (according to Enterprise Privacy: SAML SSO, Compliance API/audit logs, RBAC, data residency)

yes (according to the Enterprise privacy page part of the business products; feature scope not evaluated in the retrieved page text)

API (models via Platform); feature scope not the subject of this entry

yes (unlimited standard messages with the 'innoGPT Standard' model; scope of premium models for this plan not stated on the pricing page)

yes (unlimited standard messages; all AI models, premium models included within a monthly budget)

yes (unlimited standard messages; all AI models within the monthly budget)

yes (everything in Personal; according to the pricing page 'Rund 3× mehr Premium als Personal' (translated: around 3× more premium than Personal); image generation, Deep Research)

yes (all features, team collaboration, SSO/SAML at extra cost, up to 1,000 users; premium models via a shared team budget; add-ons: PII filter, video generation, audio overview, external OpenAI-compatible API)

yes (main Business features according to the pricing page, 'scope growing continuously' (translated); confidentiality undertaking under § 203(4) of the German Criminal Code (StGB); activation only on request after review)

yes (organisation-wide rollout with own governance; § 203 licence possible; self-hosting/on-premises; dedicated support manager; custom SLAs)