LLM Data Privacy FAQ
Consumer ChatGPT is not a confidential channel. APIs, Enterprise, and a VPC still leave traces, subprocessors, and limits on unlearning.
Consumer ChatGPT is not private enough for company data: chats can be used to improve models unless you are on a plan and setting that says otherwise. The API and ChatGPT Enterprise offer training opt-out and retention controls you must still verify in the contract. Even then, prompts, logs, embeddings, and retrieval corpora remain personal data under GDPR if they contain PII — and a model cannot reliably erase a person the way a database can.
What “private” actually means
If you only need one line: the consumer product, the API, and a system in your VPC are three different privacy stories. Do not mix them.
Is ChatGPT private?
Not in the way people mean when they paste a customer dump into the free or consumer Plus product. Those surfaces can use content to improve models depending on settings and era of the terms. ChatGPT Enterprise and the API are built for business controls — training opt-out, admin, retention — but they are still a vendor processing your prompts. Private means “we read the current DPA and configured the workspace,” not “OpenAI cannot see bytes in transit.”
Can I put company data in ChatGPT?
Not in consumer ChatGPT. Use the API, ChatGPT Enterprise, or a system that calls a model under your DPA, with minimisation and a place the data is allowed to live. Source code, HR files, health, and unpublished financials do not belong in a personal chatgpt.com tab. If your company has already done that, treat it as an incident class, not a productivity hack. We implement the controlled path; we do not bless the tab.
Does OpenAI train on our prompts?
On consumer ChatGPT, assume yes unless you have turned off training and trust that setting. On API and Enterprise, OpenAI’s current business terms generally say they do not train on your business data by default — confirm in the contract you signed, not in a tweet. Other providers differ. “Zero training” is not “zero logging.” We set the flags the vendor offers and still treat prompts as data in your stores.
What is zero data retention?
A provider setting or contract that says they do not keep your prompts and outputs for abuse review or training beyond a short processing window. It is not available on every SKU, and abuse exceptions often still exist. Zero retention at the API does not delete the copies in your app, your traces, or your employees’ laptops. We default to ZDR where the vendor offers it and document the exception list rather than pretending it is absolute.
How does GDPR apply to LLMs?
If you process personal data in prompts, retrieval, logs, or fine-tunes, you need a lawful basis, a purpose, minimisation, a processor agreement, and a way to answer access and erasure for the stores you control. A model in the US is a transfer. Automated decisions with legal effects have extra rules. The EU AI Act does not replace GDPR. We implement technical measures; we do not pick your lawful basis or write your DPIA.
What is a VPC or private deployment for LLMs?
The model runtime, indexes, and logs sit in your cloud network, reached through your identity provider, with no copy on the implementer’s disks. That can be a hosted model in your region, a private endpoint, or self-hosted open weights. It reduces who holds a replica. It does not remove GPU subprocessors or the need to redact traces. For regulated work, VPC is our default, not an upgrade SKU.
Can embeddings or logs still leak PII?
Yes. Chunk stores keep the raw text unless you redact. Logs keep utterances. Embeddings have inversion research behind them and, more often, a neighbouring chunk that still has the name. Treat those stores as in-scope. Access control, retention, and redaction matter more than hoping a vector is anonymous. We will not claim “the embedding is hashed PII.”
What we actually put in place
The work is minimisation, keys in your manager, and a trace store you can delete — not a promise the frontier model forgot someone.
How do you keep PII out of prompts?
Minimise at the source: send the fields the task needs, not the whole CRM row. Redact known patterns before the model, knowing you will miss some. Prefer retrieving a permissioned snippet over pasting a document into a system prompt. Evaluators see realistic PII in a locked set, not in Slack. Perfect stripping is not achievable; reducing blast radius is. We measure leftover PII on a sample rather than declaring zero.
Is training opt-out enough?
No. Opt-out stops one use (improving the provider’s models) if the contract is real. It does not stop your own logs, a support engineer’s screenshot, a browser plugin, or an employee on the consumer site. It does not grant erasure inside weights you do not train. Treat opt-out as necessary for API/Enterprise and insufficient as a programme. DLP and an approved work surface are the rest.
Do you use our data to train your models?
No. ReinforcedX does not train a shared model on client data. Fine-tunes and eval sets stay in your tenancy and are yours at handover. Providers are called with your keys and the retention flags you approve. If a future product ever needed aggregated telemetry, that would be a separate, opt-in contract — it is not the default implementation.
Can we run entirely in our VPC with no external model API?
Yes, with self-hosted open-source or a provider’s private endpoint in your region. Quality, ops, and GPU cost change; privacy improves because the prompt does not leave the perimeter you defined. We are model-agnostic and will recommend that path when residency requires it. “Entirely” still includes your IdP, your logging stack, and whoever patches the GPUs.
What about subprocessors and model providers?
They are your processors (or sub-processors) once you call them. We help you list them — STT, TTS, model, tracing — and keep the list short. We are not a silent extra cloud that holds the corpus. Your DPA programme has to include the names that actually see tokens. A mystery “AI layer” with undocumented vendors is how reviews die in week two.
Can we honour GDPR erasure if we fine-tuned on customer data?
You can delete the row, the index, the logs, and, if the person is in a fine-tune set, you can exclude them from the next training run. You cannot guarantee a frontier model or even your last adapter has fully forgotten a rare string. That is the honest limit. Design fine-tunes on minimised, aggregated, or synthetic stand-ins when erasure must be strict. We will say if a proposed train set makes erasure theatre.
How is a production agent different from consumer ChatGPT on privacy?
Your tenant, your IdP, per-user retrieval ACL, traces you retain on your schedule, tools you allow, and a provider contract you chose. Consumer ChatGPT is a shared product with consumer terms and a paste box. A custom agent is not “ChatGPT with a logo”; it is software in your stack. We implement that software. We do not resell ChatGPT seats.
Traces, regions, and limits
Production privacy is retention you can execute, not a slide that says “encrypted.”
Where do traces live?
In your observability store, in your region, with access control and a retention job. We default to redacting known PII in logs. Traces are how you debug and how you fail an audit if they live forever in a US SaaS you forgot to list. Thirty days of on-call includes that pipeline after handover. You own the data.
How do we stop staff pasting secrets into chatgpt.com?
Give them an approved agent that actually answers work questions, plus DLP and CASB controls on the consumer domains. A ban without a replacement is how paste happens at midnight. We cannot install your DLP. We can make the sanctioned system faster than the tab, with SSO and an audit trail. That is usually the first internal workflow, not the fifth.
Can prompts go to a US model if our users are in the EU?
Only with a transfer mechanism your DPO accepts — SCCs, a regional endpoint, or self-hosting. The AI Act does not decide this; GDPR does. We will not invent adequacy. If the answer is “EU only,” we route to EU regions or open weights in your VPC. If the answer is “US is fine with SCCs,” we document that and still minimise.
How do you redact PII in logs?
Detectors for known patterns (IDs, emails, cards), field allowlists, and dropping raw retrieval text from the default trace view. Detectors miss novel strings; that is a limit, not a footnote. High-sensitivity programmes keep a sealed raw trace with tighter ACL and shorter retention. We implement the scheme you sign off; we do not claim 100% redaction.
What honest privacy limits should we accept?
You cannot fully unlearn a person from a model you do not train. Embeddings and logs can leak. Zero-retention APIs still have abuse exceptions. Employees bypass tools. Judges and eval vendors may see samples. Design for minimisation, perimeter, and deletion of the stores you own. Anyone promising “GDPR-complete AI” without those limits is selling a sentence.
Who owns the data and artefacts?
You do: corpora, indexes, traces, fine-tunes, eval sets, and runbooks. Client data is not used to train shared ReinforcedX models. Handover includes 30 days of on-call. If an auditor needs us to fetch the only copy, the design failed — those files live in your tenancy.
Sector constraints and this week
Health, finance, and EU residency change the default architecture. They do not change the honesty about unlearning.
Can we put PHI or health data into an LLM?
Only in a HIPAA-aware (or local equivalent) architecture: BAA with the provider if they see PHI, VPC, minimum necessary, no improvised medical advice. Consumer ChatGPT is a no. Admin intents (scheduling, benefits) are the usual start; diagnosis is not. These programmes typically run 10–14 weeks to a governed pilot, not the four-week default.
What about banking and insurance data?
Same perimeter rule, plus reconstructable decisions and human checkpoints on anything that moves money or changes a customer record. Consumer paste is an incident. We deploy in your cloud and log for audit. Bank and insurer pilots often run 8–12 weeks because the review layer is heavier. We will not claim a certification we do not have.
Should we prefer EU-hosted or open-source models for privacy?
When your DPO says transfers are the issue, yes — EU regions or self-hosted weights. When the issue is training on your data, a US Enterprise API with a real DPA may be enough. Quality still has to pass the eval. We will not pick a worse model only for marketing “sovereignty” if you have not asked for it in writing.
Is fine-tuning on customer conversations a privacy problem?
Yes, unless you minimise, get a basis, and accept the erasure limit on the resulting weights. Prefer tools and RAG for knowledge that must stay current and deletable. Fine-tune on style and non-identifying traces when you must. Synthetic stand-ins help; they can still leak seeds. This is a design choice in week one, not a later ethics review.
What should we do this week?
Block or DLP the consumer ChatGPT domain for company accounts, write down where prompts already go, pick one sanctioned path (Enterprise, API, or VPC agent), and start a DPIA if you process personal data. Then call for a four-week implementation on one workflow in your cloud. Do not wait for a perfect policy. Do not keep pasting in the meantime.
Privacy for LLMs is a stack: product surface (consumer vs API vs Enterprise), provider terms (training, retention, region), your perimeter (VPC, keys, subprocessors), and the data in prompts, indexes, traces, and fine-tunes. ReinforcedX does not train shared models on client data, deploys in your cloud, and defaults to zero-retention provider settings where they exist. We cannot promise inversion-proof embeddings or a right-to-erasure that rewrites a frontier model. Honest limits belong in the design. Four weeks includes the controls; it does not replace a DPIA.
Keep reading
Ready to refine
your workflow?
Share your current process. We’ll help you identify what can be automated — and where efficiency can be reclaimed.