Why Your Business Data Should Never Touch ChatGPT

When your employee pastes a client contract into ChatGPT and asks it to summarise the key terms, that contract leaves your control. It travels to OpenAI's servers, is processed by their models, and is stored in their systems. OpenAI says they do not train on API or business plan data, but they still log it, they still process it, and their privacy policy reserves the right to review conversations flagged for safety monitoring. The contract your client trusted you to protect is now on a server you do not control, processed by algorithms you cannot audit, subject to a privacy policy that can change at any time.

What ChatGPT's Privacy Policy Actually Says

OpenAI's privacy policy for ChatGPT Team and Enterprise states that they do not train models on your data. This is good. But it is not the same as your data staying private. Here is what still happens:

• Data is still processed on their servers: Every prompt and every response flows through OpenAI's infrastructure. They can read it if they need to for safety monitoring, abuse detection, or legal compliance.
• Data is still stored: Conversation history is stored on OpenAI's servers. It is encrypted at rest, but they hold the encryption keys, not you.
• Data is still subject to US law: OpenAI is a US company. Your data is subject to the US CLOUD Act, which allows US law enforcement to access data held by US companies regardless of where the data originated.
• The policy can change: Privacy policies are not contracts. They can be updated at any time. What is not trained on today could be trained on tomorrow with 30 days notice.

For a business handling client financial data, legal documents, medical records, or internal strategy discussions, these are not theoretical concerns. They are real risks that professional indemnity insurers and regulators increasingly ask about.

What Self-Hosted AI Actually Means for Privacy

With self-hosted AI, the model runs on your hardware. Your prompts are processed on your CPU or GPU. Your data never leaves your network. The model weights are downloaded once from the internet and then run entirely offline if you choose. There is no server to send data to. There is no privacy policy to trust. There is no third party that can access your conversations.

This is not just about privacy. It is about compliance and liability. If a client asks where their data was processed, you can point to the server in your office or your VPS in a data centre you control. If a regulator asks who has access to your AI conversations, you provide your access control logs. If your professional indemnity insurer asks about third-party data exposure, you can honestly say there is none.

What Self-Hosted AI Can Do Today

Open-source models have closed the gap with commercial AI significantly. Models like Mistral 7B and Llama 3.1 8B handle everyday business tasks: summarising documents, drafting emails, rewriting content, and answering questions from a knowledge base. They are not as capable as GPT-4 or Claude on complex reasoning, but for 80 percent of business AI use cases, the capability gap is no longer the deciding factor. Privacy is.

For the remaining 20 percent of use cases that genuinely require frontier-level reasoning, you can still use commercial AI intentionally and with clear policies: never paste client-confidential information, never upload sensitive documents, and always strip identifying details before querying. Treat commercial AI like you would treat a public forum. Assume anything you type could be read. Because technically, it can.

The Policy Your Business Needs

Every business using AI should have a straightforward policy:

• Self-hosted AI for internal and client work: Document summaries, email drafts, data analysis, and anything involving client data stays on your own hardware.
• Commercial AI for low-sensitivity tasks: General research, brainstorming, public-content generation that does not involve client or employee data.
• Never: Paste client contracts, financial data, medical records, or personally identifiable information into any commercial AI product.

A policy like this protects your business, satisfies your insurers, and gives your team clear rules to follow. The technology to implement it, self-hosted AI, is ready today.

VPS1 deploys self-hosted AI on your infrastructure. Ollama plus Open WebUI gives your team a private ChatGPT experience. Your data stays on your server. Your prompts stay confidential. Your business stays compliant.