Is ChatGPT Enterprise safe for privileged or classified data?

ChatGPT Enterprise is not a defensible home for legally privileged or classified data, because a zero data retention promise is a contractual commitment and not a technical guarantee. Zero retention stops the provider persisting your prompts and using them for training, but the data still leaves your control, still transits a third party you cannot inspect, and still sits within reach of the US CLOUD Act. For material that carries legal privilege, a government classification, or a lawful-basis bar on third-party processing, the only defensible answer is a system that never sends the data off your own hardware.

In 2026 this stopped being an academic question. Regulated buyers in law, defence, finance and healthcare are being pushed to run their most sensitive material through cloud AI services, and their auditors are asking three plain questions: who can read it, where does it go, and how is a claim of confidentiality proven. A retention promise answers none of them. The market is now separating general productivity work, where cloud AI is fine, from privileged and classified work, where it is not.

What does a zero data retention promise actually cover?

Zero data retention is a contractual setting, not a wall. When enabled, the provider commits not to persist your inputs and outputs beyond the life of the request and not to use them for training. That is a genuine and useful control for ordinary business content, and it shrinks the window in which your data rests on someone else's servers. What it does not do is change where the processing happens. Your data is still decrypted and computed on infrastructure you do not own, cannot inspect, and cannot prove the behaviour of after the fact.

What does zero retention not cure?

Retention is one risk among several, and the controls that matter for privileged and classified data sit upstream of it.

• Legal privilege: disclosing privileged material to a third-party processor can waive privilege, and a retention setting does not restore it.
• Classification handling: classified data carries caveats that forbid processing on uncleared commercial infrastructure, and a contract clause does not clear the infrastructure.
• Lawful basis: under GDPR, some categories of data have no lawful basis to be transferred to an external processor at all, whatever the processor promises.
• Jurisdiction: the US CLOUD Act lets US authorities compel a US provider to hand over data it holds, wherever that data physically sits.
• Egress: the data still crosses your perimeter, and once it has left, your assurance is only as good as the counterparty.

Which rules make an offline substrate necessary?

Several regimes point the same way. The US CLOUD Act reaches data held by US providers regardless of storage location, which is the single hardest fact for a cloud retention promise to survive. GDPR restricts third-country and third-party processing of personal data. DORA, in force across EU financial entities since January 2025, holds firms accountable for the resilience and control of their critical ICT third parties. NIS2 extends security and accountability duties across essential and important entities. ISO/IEC 42001 sets an auditable management standard for AI systems. On the EU AI Act, the high-risk Annex III obligations once due on 2 August 2026 were deferred by the Digital Omnibus to 2 December 2027, with embedded Annex I high-risk duties moving to 2 August 2028 and Article 50 transparency largely unchanged. We read that as a build window, not a reprieve.

What can an auditor actually check?

This is where the two models diverge hardest. With a cloud service, an auditor can read a contract clause and a third-party assurance report, but cannot independently verify that a specific prompt was never retained, never copied, and never seen. The evidence is the provider's word. With an offline substrate that seals every action to a tamper-evident ledger, the auditor checks a signature, not a promise. The question shifts from do you trust the vendor to can the mathematics be forged, and the second question has a definite answer.

How does a Sovereign Intelligence Operating System answer this?

Mickai is a Sovereign Intelligence Operating System, a SIOS. It runs offline on operator-owned hardware, so privileged and classified data is never sent to a third party and never crosses a jurisdictional line. A zero-egress inbound perimeter means data can enter to be worked on while the substrate initiates no outbound connection. Identity is hardware-attested and bound to the audit chain, so every action is tied to an accountable operator. That audit ledger is sealed with post-quantum signatures, FIPS 204 as the primary digital signature standard and FIPS 205 alongside it, so the record stays verifiable even against a future quantum adversary. Sensitive answers can be checked by cross-model consensus rather than a single opaque model. The design and its methods sit within 104 filed UK patent applications, approximately 2,340 claims, owned by Mickai LTD, filed and patent pending, never granted.

“A retention promise tells you what a provider intends to do with your data, while an offline substrate tells you what is technically possible, and only the second survives a subpoena.”

What should a buyer test before trusting any vendor?

Use the unplugged test. Disconnect the system from the network and ask whether it still does the work. If it stops, the data was leaving, and no retention clause changes that. Then ask three checkable things: can you prove, with a signature you hold, that a given item was processed and never egressed; does any third party hold decryption keys or plaintext at any moment; and can a court order in another jurisdiction compel disclosure of your data by compelling your vendor. For privileged and classified work, the only safe answers are yes, no, and no.

Frequently asked questions

Does zero data retention mean your data is never stored?

No. Zero data retention means the provider commits not to persist your inputs and outputs beyond the request and not to train on them. The data is still transmitted to and processed on the provider's infrastructure during the request. It is a limit on storage, not a guarantee that your data never leaves your control.

Can ChatGPT Enterprise be used for legally privileged documents?

For privileged material this is high risk. Disclosing privileged content to a third-party processor can waive privilege, and a retention setting does not cure that. The more defensible practice keeps privileged documents on infrastructure the firm controls and can prove was never exposed to an outside party.

Does the US CLOUD Act apply to ChatGPT Enterprise?

Yes, as a matter of jurisdiction. The CLOUD Act allows US authorities to compel a US provider to produce data it holds, regardless of where that data is physically stored. A retention promise does not remove the provider's exposure to a lawful order, which is why data location alone is not a sufficient control.

Is any public cloud AI service cleared for classified data?

General commercial tiers of ChatGPT, Claude and Gemini are not appropriate for classified data, because classification caveats forbid processing on uncleared commercial infrastructure. Specialised government-accredited environments exist for some workloads, but they are separate from the standard enterprise offering and carry their own accreditation boundaries.

What is the alternative for privileged and classified work?

An offline substrate that runs on your own hardware and never sends the data out. It should provide a zero-egress perimeter, hardware-attested identity, and an audit ledger sealed with post-quantum signatures so confidentiality is proven cryptographically rather than promised contractually. This is the model a Sovereign Intelligence Operating System is built to deliver.