Security guide · Vendor terms checked October 21, 2026
Is it safe to put CRE deal documents into ChatGPT, Claude or Copilot?
Whether each plan trains on, keeps or lets staff review your OMs, rent rolls and data-room files, from each vendor's own published terms. Then the two documents that decide what you may upload at all.
The short answer
It depends on the plan, not the brand. On the business plans and APIs of ChatGPT, Claude and Microsoft Copilot, your content is not used for training by default and a data-processing agreement is available. On personal plans, training is on by default or is your choice, and staff review is possible, so an OM, rent roll or NDA-covered data room does not belong there. Even on a business plan, two documents decide what you may upload: the NDA you signed and your data licenses.
Disclosure
Pacific Software Ventures (PSV) builds AI systems for commercial real estate firms, mostly on Claude by Anthropic, and also works in ChatGPT and Microsoft Copilot environments. This page is a summary of each vendor's published terms as we read them on the date shown. It is not legal advice; your agreements with the vendor and with your counterparties control.
Checked October 21, 2026
Plan by plan, from each vendor's own terms
Each row links the vendor pages it comes from. Terms change; check the source before you rely on a row.
Personal plans
Keep deal documents out of these.
| Plan | Trains on your content? | Retention | Human review | Contract | Sources |
|---|---|---|---|---|---|
| OpenAIChatGPT Free, Plus, Pro | May train on your content by default. You can turn it off under Settings, Data controls. Rating a reply with a thumb can still send that conversation to training. Temporary chats are not used for training. | Saved chats stay until you delete them; deleted chats are removed within 30 days. Temporary chats can be kept up to 30 days for safety. | Authorized OpenAI staff and service providers may access content. OpenAI asks users not to enter sensitive information they would not want reviewed or used. | Consumer terms only. | |
| AnthropicClaude Free, Pro, Max | Your choice since Anthropic's 2025 consumer-terms update; Anthropic's plan comparison lists model training as "opt-out" for these plans. Turn it off under Help improve our AI models. Incognito chats are not used. | With training off, the 30-day retention period applies. With training on, data can be kept de-identified for up to 5 years. | By default staff cannot access conversations, except for feedback you send or Usage Policy enforcement. | Consumer terms only. Anthropic's own help page advises caution with confidential business documents. | |
| MicrosoftMicrosoft Copilot (consumer app) | In the app released August 18, 2026, prompts, responses and files are not used to train foundation models. The earlier app trained on conversations unless you opted out. | The earlier app stored conversation activity for 18 months by default. Not stated for the new app. | The earlier app's conversations could get human review, with no opt-out. Not stated for the new app. | Consumer terms only. |
Business plans
Built for firm data; set them up before you upload.
| Plan | Trains on your content? | Retention | Human review | Contract | Sources |
|---|---|---|---|---|---|
| OpenAIChatGPT Business and Enterprise | Not used for training by default, and thumb ratings do not change that. | Workspace admins control retention; deleted conversations are removed within 30 days. Enterprise can choose a data-storage region. | Staff access is limited to abuse investigation and incidents (Enterprise: incidents, recovery with your permission, or law). | Data Processing Addendum available. Enterprise adds an audit log through the Compliance API. | |
| AnthropicClaude Team and Enterprise | Not used for training by default; the exception is feedback you explicitly send. | Chats stay in the product until deleted; deleted chats are removed within 30 days. Enterprise can set a custom retention period of 30 days or more. | For Anthropic's most capable models, no personnel can read retained conversations by default, and every access is logged. | Commercial Terms: Anthropic may not train models on customer content. Data Processing Addendum incorporated. Enterprise adds audit logs and a Compliance API. | |
| MicrosoftMicrosoft 365 Copilot (now "Microsoft Copilot") for work | Prompts, responses and data reached through Microsoft Graph are not used to train foundation models. | Admins set retention in Microsoft Purview. | Microsoft Copilot services have opted out of abuse monitoring that includes human review. | Microsoft's Data Protection Addendum, with Microsoft as processor. Inherits your sensitivity labels and permissions. Web searches go to Bing under different terms. |
APIs
What a firm-built system or a partner like PSV runs on.
| Plan | Trains on your content? | Retention | Human review | Contract | Sources |
|---|---|---|---|---|---|
| OpenAIOpenAI API | Not used for training unless you opt in. | Abuse-monitoring logs kept up to 30 days. Zero data retention exists but needs OpenAI's approval. Files and stored conversations persist until you delete them. | Abuse review by authorized staff and contractors. | Data Processing Addendum available. | |
| AnthropicClaude API | Not used for training. | Deleted within 30 days by default. Zero data retention by agreement, except for Anthropic's most capable models, which since June 9, 2026 require 30-day retention unless expressly authorized. | Content flagged for a policy violation can be kept up to 2 years, even under zero retention. | Commercial Terms and Data Processing Addendum. |
Checklist
Before you upload a deal document
- 01Check the plan, not the logoA personal ChatGPT, Claude or Copilot account is a different product from the business plan of the same name. Ask IT which one your login is on.
- 02Confirm training is offOn business plans it is off by default. On personal plans, find the setting yourself, and know that rating a reply can send that chat to training on ChatGPT.
- 03Know the retentionDeleted is usually gone within 30 days, but some products keep files until you delete them, and flagged content can be kept longer.
- 04Read the NDA you signedMany confidentiality agreements limit disclosure to named parties and their representatives. Whether an AI vendor acting as your processor counts is a question for the agreement and your counsel.
- 05Check your data licensesUse comp data your license lets you use with AI tools; your signed agreement controls.
- 06Start with what is already sharedTemplates, closed-deal files and published research are the safe first material. Live deal rooms and counterparty documents come last, behind permissions you set.
To sort your own documents into what AI can safely read first, use the CRE AI data and security audit or the free twelve-question assessment. How PSV handles client data is on the security page.
Questions
What people ask
- Is ChatGPT safe for confidential CRE documents?
- ChatGPT Business, ChatGPT Enterprise and the OpenAI API do not use your content for training by default, and OpenAI offers a data-processing addendum. Personal ChatGPT plans may use your content for training unless you turn it off, and OpenAI asks personal users not to enter sensitive information.
- Does Claude train on my deal documents?
- Not on Claude Team, Claude Enterprise or the Claude API: Anthropic's Commercial Terms say it may not train models on customer content. On personal Claude plans, training is your choice, set under Help improve our AI models.
- Is Microsoft 365 Copilot safer than the free Copilot app?
- For work data, yes in one important way: the business version runs under Microsoft's data-protection addendum, inherits your permissions and sensitivity labels, and does not use your data to train foundation models. Its web searches still go to Bing under different terms.
- Can I upload an OM or rent roll I received under an NDA?
- Only if the NDA allows it. The AI plan's privacy terms decide what the vendor does with the file; the NDA decides whether you may share it at all. Read the confidentiality clause, and ask counsel if it is unclear.
Next step
Find out which of your documents are ready for AI.
Ten minutes. An honest read on where you stand, what to connect first, and which engagement fits, if any.