Is It Safe to Put Financial Data Into ChatGPT? A Controller's Checklist

It can be, on the right plan with the right settings. OpenAI says it doesn't train on business plan data by default, while personal plans share data for training by default unless you opt out. Safe use also needs approved tools, a rule for what data goes in, and a person reviewing outputs before they reach the ledger.

Vendor policies checked October 23, 2026. This is general information, not legal advice.

What Is the Difference Between Consumer and Business Plans?

The biggest risk isn't the tool. It's a staff member pasting a trial balance into a personal account.

OpenAI's business page says its practices "align with" SOC 2 Type 2 criteria and lists ISO/IEC 27001 (OpenAI). "Align with" isn't an audit opinion, so ask for the report.

For Copilot web searches sent to Bing, Microsoft says it "acts as an independent data controller." Those queries aren't covered by the DPA, though Microsoft's Product Terms add some commitments for them (Microsoft Learn).

Can Deleted Chats Still Be Kept?

Yes, when a court orders it. In 2025, an order in the New York Times case required OpenAI to preserve user data. OpenAI says it covered Free, Plus, Pro and Team users, plus API customers without zero data retention (OpenAI).

Note that Team, renamed Business in August 2025, was covered (OpenAI). Only Enterprise, Edu and zero-retention API use were excluded.

OpenAI says those obligations ended on September 26, 2025. It still stores a limited set of April to September 2025 user data. Only "a small, audited OpenAI legal and security team" can access it, OpenAI says.

The lesson: legal process can override a retention promise, and your plan decides what's exposed.

The Controller's Checklist

1. Find out what people already use. Ask the team directly. Personal accounts are the usual gap.
2. Approve tools in writing. Name the approved plans and ban personal accounts for company data.
3. Confirm the training default. Use the table above and the vendor's current page.
4. Check retention. Know how long chats and files are kept, and whether admins can change it.
5. Read the data terms. Confirm there's a data processing agreement and the vendor acts as processor.
6. Ask for security evidence. Ask for a SOC 2 report or equivalent written security commitments. If a tool's output feeds the ledger, ask your auditor whether they also want a SOC 1 report.
7. Require SSO. On plans without SCIM, such as ChatGPT Business, also remove leavers from the workspace by hand.
8. Classify your data. Use the green, yellow and red rules below.
9. Strip what you don't need. Aggregate before you paste, and remove names, tax IDs and bank numbers.
10. Check your contracts. Some customer agreements and NDAs limit sharing with third-party processors.
11. Keep outputs out of the ledger until reviewed. A person checks every number against the source.

Which Data Should Never Go In?

Turning a Red File Into a Yellow One

All figures are sample numbers for illustration, not client data.

Sample Co. wants AI help explaining a March payroll variance. The source is a payroll register for 42 employees, with names, tax ID fragments and individual salaries. That's red.

The controller rolls it up to department totals before using the approved business plan.

The rolled-up table is yellow, as long as no group is small enough to reveal one person's pay. Roll any department under five people into a larger group. A three-person G&A line would show the CFO's salary to anyone who can subtract.

The register itself never leaves the payroll system.

What Will Your Auditor, Lender or Buyer Ask?

Most companies this size are private. The questions come from your auditor, your lender and, one day, a buyer.

• Your auditor. Under SAS 145, US private-company auditors must understand your journal entry controls and general IT controls (Journal of Accountancy). An approved AI tool with SSO and a review step is easy to describe. A personal account isn't.
• Your lender. Covenant certificates come from the same numbers, and an officer signs them. If AI drafted any part, keep the review trail.
• A buyer. In diligence, expect questions on where financial data went and under what terms. A written tool policy answers them in one page.

If you're a US-listed company, management assesses internal control under SOX 404(a). Only accelerated filers need the auditor's attestation under 404(b); smaller reporting companies under US$100M revenue and emerging growth companies don't (Cooley).

In Canada, venture issuers file a basic CEO and CFO certificate. It covers fair presentation but includes no representations on disclosure controls or ICFR (Form 52-109FV1).

What About Privacy Law?

Payroll is where financial data turns into personal data. In California, the CCPA has covered employee and job-applicant data since January 1, 2023 (California Attorney General). It applies to businesses above US$26,625,000 in annual revenue, among other tests (CPPA).

Other states and countries have their own rules. Ask counsel which apply to you, and aggregate personal data wherever you can.

What to Automate vs Keep With a Person

Automate:

• SSO provisioning, and removal for approved tools
• Admin-level training and retention settings
• Scripts that roll up or strip personal fields before upload
• Number checks that compare outputs to source data

Keep with a person:

• Approving tools and reading the vendor terms
• Deciding whether a file is green, yellow or red
• Reviewing every AI output before it reaches the ledger, lender or board
• Responding if data goes somewhere it shouldn't

For how this fits the wider close, see Can AI Do the Month-End Close?

FAQ

Does ChatGPT Plus train on my data? By default, yes. OpenAI says data sharing is enabled by default on Free, Plus and Pro. Turn off "Improve the model for everyone" to opt out.

Is Temporary Chat safe enough for company data? Temporary Chats aren't used for training but may be kept up to 30 days. They still sit in a personal account your company doesn't control.

Is Microsoft Copilot safer than ChatGPT? The plan matters more than the brand. Organizational Copilot Chat is covered by Microsoft's DPA, so check which account your team signs in with.

Do we need formal controls over AI tools if we're private? Your auditor will still ask how journal entries are produced and approved. Keep inputs, prompt versions, outputs and reviewer approval.