Software vendor

OpenAI

OpenAI, whose for-profit OpenAI Group PBC is controlled by the OpenAI Foundation, sells ChatGPT Enterprise and workspace agents for businesses.

2 offerings in the directory Last verified October 21, 2026

Function

Across functions

Ownership: Not stated
The for-profit is OpenAI Group PBC, a public benefit corporation controlled by the nonprofit OpenAI Foundation, which holds a 26% equity stake, under the structure announced October 28, 2025.
Headquarters: Not stated
SEC reporting: No
Audit firm: No
Website: openai.com
Subprocessor list: Not stated
Contract terms: Not stated

Offering · Software

ChatGPT Enterprise

Directory recordLast verified October 21, 2026Compare with othersBuild questions for this vendor

ChatGPT Enterprise is OpenAI's enterprise plan for ChatGPT; OpenAI says its ChatGPT Work agent can plan, act across connected apps and files, and produce spreadsheets, slides and documents.

OpenAI says business data is not used for training by default, that admins control how long data is kept, and that deleted conversations are removed within 30 days unless the law requires otherwise.

Admins get SAML single sign-on, SCIM provisioning, custom roles by group and spend controls, and an audit log of conversations and agent activity through the Compliance API.

OpenAI's published pricing, October 2026, prices the plan per user per month on an annual contract, with no Enterprise figure shown and credits sold for additional use.

Where it fits

CoE analysis Fits organizations that want a general assistant and agent workspace independent of their productivity suite, with data residency choices across several regions.

CoE analysis The default-off training position depends on not opting in, so feedback settings belong in the rollout checklist, and agent work drawn from credits needs its own budget line.

Evidence

Independent outcomes: None found in the sources read.
Sources read: Vendor-stated 9
Independent market evidence None read
Independently verified outcomes None read
Pricing 1
Known limitations None read
Coverage: Directory record
Last verified: October 21, 2026

Security and control

Single sign-on: Supported
Protocols: SAML
SAML SSO is listed for ChatGPT Business and, by inclusion, Enterprise.
User provisioning: Some plans
Protocols: SCIM
SCIM provisioning and deprovisioning is listed for ChatGPT Enterprise, Edu and Healthcare, not Business.
Role-based access: Supported
Business has Member, Admin and Owner roles; Enterprise adds custom roles by group with permissions for ChatGPT Work, Codex, connected tools and workspace agents.
Administrator controls for AI: Per feature
Admins control which apps are enabled, who can use agents, connected tools and actions, who can build and share workspace agents (off by default for Enterprise), and can suspend agents.
Audit logs: Covers AI actions: Yes
Enterprise admins access an audit log of conversations and GPTs through the Enterprise Compliance API, which also shows each workspace agent's configuration, updates and runs. Export format and log retention are not stated on the pages read.
Certifications: SOC 2 Type 2
ChatGPT Enterprise, ChatGPT Edu and ChatGPT for Healthcare each completed a SOC 2 Type 2 audit; ChatGPT Business completed one.
Other
OpenAI says its data protection practices 'align with' CSA STAR, SOC 2 Type 2 criteria and ISO/IEC 27001, 27017, 27018 and 27701 certifications; product scope is not given.
Data retention: Prompts and outputs: Enterprise workspace admins control how long data is retained; deleted conversations are removed from OpenAI's systems within 30 days unless OpenAI is legally required to keep them.
Deletion follows deletion in the workspace; the 30-day removal is stated for deleted conversations.
Data residency: Regions: United States, Europe, United Kingdom, Japan, Canada, South Korea, Singapore, Australia, India, United Arab Emirates
At-rest storage of sensitive customer content in these regions for eligible Enterprise, Edu and Healthcare customers; eligible customers can opt into in-region GPU inference in the United States or Europe.
OpenAI's own models.
Training on customer data: Opt in
Scope: Vendor models
Where stated: FAQ
Business data is not used for training by default; if a customer explicitly opts in, for example through feedback mechanisms, OpenAI may use the shared data to train. Data accessed through apps is not used for training by default. A Data Processing Addendum is available for Business, Enterprise and the API; its text was not read.

AI features

As the vendor or firm describes them. Notes in small print record what the sources leave open.

ChatGPT (chat, GPTs, connected apps)
Chat with OpenAI models; workspace members build and share GPTs internally; apps send and retrieve information from connected internal sources, with admins controlling which apps are enabled.
Kind
General-purpose assistant
Suggests or acts
Suggests
Who controls it
Customer IT
Availability
Generally available
Control: Admins control enabled apps, GPT sharing and access through roles.
ChatGPT Work
Plans, takes action across apps and files, and creates finished materials such as spreadsheets, slides, documents and web apps.
Kind
Agents and automated actions
Suggests or acts
Acts
Who controls it
Customer IT
Availability
Not stated
Control: Admins manage who can use agents, connected tools and actions; role permissions and spend controls cover ChatGPT Work.

Questions to ask

For this offering

Which of our users or admins could opt us in to sharing data for training, and how would we know if that happened?
Which regions will hold our content at rest, and which processing still happens outside them?
What does the Compliance API record for an action ChatGPT Work takes in a connected app, and how long can we keep those records?
How are credits consumed by ChatGPT Work and Codex, and what happens when a group's limit is reached?
Does OpenAI's SOC 2 Type 2 report cover ChatGPT Work and connected apps, and for what period?

From the diligence question set

Build questions for this vendor

Offering · AI agent

ChatGPT workspace agents

Directory recordLast verified October 21, 2026Compare with othersBuild questions for this vendor

Workspace agents are OpenAI's shared, team-built agents in ChatGPT, introduced on April 22, 2026 as an evolution of GPTs, powered by Codex and running in the cloud so they keep working when the user is away.

They can write and run code, use connected apps, run on a schedule, work in Slack and be started through an API.

Write actions in connected apps default to asking the user first, builders can add action constraints, and admins can control who may build, share and use agents and can suspend them.

OpenAI's page calls them generally available in one place and a research preview in another, and said credit-based pricing would start on May 6, 2026.

Where it fits

CoE analysis Fits teams on ChatGPT Business or Enterprise that want to turn a repeatable workflow into a shared agent without a separate build platform.

CoE analysis An agent can run on a shared agent-owned account and on a schedule, so the account it uses, its write-approval setting and its Compliance API trail should be reviewed before it is published to the workspace.

What it does

Offering type: AI agent
Workflow areas: Agent platform
Process automation
Customer size: Not stated

AI

Kind of AI: Agents and automated actions
Suggests or acts: Suggests and acts
Availability: Not stated
OpenAI's announcement page gives two statements: generally available in Business, Enterprise and Edu (lead) and research preview in Business, Enterprise, Edu and Teachers (Availability and pricing section). Recorded under D-143 and not resolved. Off by default for Enterprise workspaces until an admin enables it.
Models named: OpenAI

Control

Who controls it: Customer IT
Individual user

Commercial

Pricing model: Usage-based
Public price: Not stated

Evidence

Independent outcomes: None found in the sources read.
Sources read: Vendor-stated 9
Independent market evidence None read
Independently verified outcomes None read
Pricing 1
Known limitations None read
Coverage: Directory record
Last verified: October 21, 2026

Security and control

Single sign-on: Supported
Protocols: SAML
SAML SSO is listed for ChatGPT Business and, by inclusion, Enterprise.
User provisioning: Some plans
Protocols: SCIM
SCIM provisioning and deprovisioning is listed for ChatGPT Enterprise, Edu and Healthcare, not Business.
Role-based access: Supported
Business has Member, Admin and Owner roles; Enterprise adds custom roles by group with permissions for ChatGPT Work, Codex, connected tools and workspace agents.
Administrator controls for AI: Per feature
Workspace agents are off by default for Enterprise workspaces until an admin enables them; write actions default to Always ask, which a builder can change for some apps.
Audit logs: Covers AI actions: Yes
Enterprise admins access an audit log of conversations and GPTs through the Enterprise Compliance API, which also shows each workspace agent's configuration, updates and runs. Export format and log retention are not stated on the pages read.
Certifications: SOC 2 Type 2
ChatGPT Enterprise, ChatGPT Edu and ChatGPT for Healthcare each completed a SOC 2 Type 2 audit; ChatGPT Business completed one.
Other
OpenAI says its data protection practices 'align with' CSA STAR, SOC 2 Type 2 criteria and ISO/IEC 27001, 27017, 27018 and 27701 certifications; product scope is not given.
Data retention: Prompts and outputs: Enterprise workspace admins control how long data is retained; deleted conversations are removed from OpenAI's systems within 30 days unless OpenAI is legally required to keep them.
Deletion follows deletion in the workspace; the 30-day removal is stated for deleted conversations.
Data residency: Regions: United States, Europe, United Kingdom, Japan, Canada, South Korea, Singapore, Australia, India, United Arab Emirates
At-rest storage of sensitive customer content in these regions for eligible Enterprise, Edu and Healthcare customers; eligible customers can opt into in-region GPU inference in the United States or Europe.
OpenAI's own models.
Training on customer data: Opt in
Scope: Vendor models
Where stated: FAQ
Business data is not used for training by default; if a customer explicitly opts in, for example through feedback mechanisms, OpenAI may use the shared data to train. Data accessed through apps is not used for training by default. A Data Processing Addendum is available for Business, Enterprise and the API; its text was not read.

AI features

As the vendor or firm describes them. Notes in small print record what the sources leave open.

Workspace agent builder
Create an agent, test it before publishing, choose model and reasoning effort, and add apps, custom MCPs, skills and files.
Kind
Agents and automated actions
Suggests or acts
Suggests and acts
Who controls it
Individual user, Customer IT
Availability
Not stated
Control: Builders configure agents and sharing (private, link, workspace directory); admins enable the feature and set role-based access.
Write-action approvals and action constraints
Write actions default to Always ask; for some apps builders can set Never ask or custom approvals, and add natural-language constraints that limit what an app can do.
Kind
Agents and automated actions
Suggests or acts
Acts
Who controls it
Individual user
Availability
Not stated
Control: Configured by the agent builder.
Schedules, Slack and API triggers
Agents run on a schedule, in Slack channels, or when triggered through an API with a Workspace Agent access token.
Kind
Agents and automated actions
Suggests or acts
Acts
Who controls it
Customer IT, Individual user
Availability
Not stated
Control: Workspace Agent access tokens are created in ChatGPT Admin.

Unclear or conflicting statements

Where the sources are unclear or disagree, both statements are shown with their links.

Availability of workspace agents

Statement A

Announcement lead: workspace agents are now generally available in ChatGPT Business, Enterprise, and Edu.

openai.com/index/introducing-workspace-agents-in-chatgpt/

Statement B

Availability and pricing section of the same page: workspace agents are available in research preview for ChatGPT Business, Enterprise, Edu, and Teachers plans.

openai.com/index/introducing-workspace-agents-in-chatgpt/

Recorded under D-143; not resolved.

Both statements are published as found; CoE draws no inference about which governs.

Questions to ask

For this offering

Is our use of workspace agents covered as a generally available service or as a research preview, and what terms apply to each?
Which agents in our workspace use an agent-owned account rather than each user's own, and who owns those accounts?
Which write actions have been set to Never ask, and can an admin see and override that setting?
What does the Compliance API show for each agent run, including the tools called and the approvals given?
At what credit rate are agent runs billed, and how do group and individual limits stop a scheduled agent?

From the diligence question set

Build questions for this vendor

ChatGPT Enterprise

What it does

AI

Control

Commercial

Evidence

Security and control

AI features

ChatGPT (chat, GPTs, connected apps)

ChatGPT Work

Questions to ask

ChatGPT workspace agents

What it does

AI

Control

Commercial

Evidence

Security and control

AI features

Workspace agent builder

Write-action approvals and action constraints

Schedules, Slack and API triggers

Unclear or conflicting statements

Questions to ask