Is ChatGPT Enterprise data used for training?

Commercial enterprise tiers generally exclude business data from training by contract, which is one of the main things you are buying over the consumer product. The question to press in procurement is not whether training is excluded but what retention applies, where processing happens, who can access data during an incident, and what survives contract termination. Read the executed agreement rather than the marketing page.

What does a private LLM give you that an enterprise API tier does not?

Three things contract terms cannot provide: the data never physically leaves your boundary, you control model versioning so you can reproduce an output months later for audit, and you are not exposed to a provider changing pricing, terms or model availability on their schedule. Everything else, including training exclusion and residency, can usually be obtained contractually.

It depends almost entirely on volume and utilisation, and the crossover is real. A commercial tier is priced per seat or per token and starts near zero, so it wins at low and moderate volume. Self-hosting has high fixed cost that barely moves with usage, so it wins above a crossover point. Owned hardware costs the same when idle, so a spiky daytime-only workload reaches that crossover much later than a continuous one.

Most large organizations end up doing exactly that, applying different tiers to different workload classes rather than picking one for everything. Sensitive or regulated work on private infrastructure, general knowledge work on a commercial enterprise tier, experimental work on public APIs with non-sensitive data. The requirement this creates is a written classification rule telling developers which tier a workload belongs in.

How long does each take to deploy?

A commercial enterprise tier can be live for a pilot group in days, and the work is mostly identity integration and policy. Self-hosting inside your own cloud is typically weeks. On-premise runs from procurement through installation and is commonly six to twelve months, longer if facilities work is needed for power or cooling.

Private LLM vs ChatGPT Enterprise: How to Choose

This decision gets framed as a cost comparison. It usually is not one.

For most large organizations the deployment model is settled by a compliance or contractual constraint, and the cost analysis then either confirms or complicates a decision that was already made. Work the constraints first. If none of them bind, the economics decide, and the economics depend almost entirely on volume and utilisation.

What you are actually comparing

These are not two points on a line. They differ on control, not just price.

ChatGPT Enterprise and equivalent commercial tiers give you a managed service: a frontier-class model, a maintained interface, identity integration, admin controls, and contractual terms on retention and training exclusion. You are buying capability and speed, and accepting that the infrastructure and the model lifecycle belong to someone else.

A private LLM runs on infrastructure you control, either on-premise or inside your own cloud tenancy. Prompts, retrieved documents and generated output stay inside your boundary. You are buying control, and accepting that you now own the operational burden.

Where they genuinely differ

| | Commercial enterprise tier | Private LLM | |---|---|---| | Where data goes | Third-party infrastructure under contract | Stays inside your boundary | | Training exclusion | Contractual | Structural, there is nothing to exclude | | Model versioning | Provider controls deprecation | You control it | | Capability | Frontier-class, updated for you | Strong and improving, you own upgrades | | Time to first value | Days | Weeks to months | | Cost shape | Per seat or per token, scales with use | High fixed, flat with use | | Operational burden | Minimal | Real and ongoing | | Works offline | No | Yes, if deployed for it |

The row people underweight is model versioning. If you need to explain to a regulator why a system produced a particular output last March, and the provider has since retired that model version, you cannot reproduce it. Version pinning helps, but hosted providers deprecate on their schedule. In regulated decisioning this alone often forces self-hosting, and it is the requirement organizations discover last.

The constraint test

Work these in order. The first one that binds determines your floor, and no cost analysis overrides it.

Does any law, regulation or accreditation prohibit the data leaving a defined physical or jurisdictional boundary?
Do customer or partner contracts restrict processing to named infrastructure, or prohibit third-party processors? Check the executed agreements, not the standard template.
Would exposure breach legal privilege, trade secret protection or a confidentiality undertaking?
Must the workload function during a network outage or in an isolated environment?
Is there a latency requirement a round trip to an external provider cannot meet?
Do you need to reproduce a specific output months later for audit?

Any yes points at private deployment. All no means the decision is economics.

If it comes down to economics

Model both options over the same three-year window with the same adoption assumptions. The most common error is comparing steady-state self-hosted economics against first-year commercial consumption, which is not a like for like comparison.

For the commercial tier, model seats or tokens against a realistic adoption curve, and add the evaluation traffic you will run continuously in production. Consumption pricing means cost tracks success, so a tool that works well costs more, not less.

For self-hosting, include accelerators, host systems, networking, facilities power and cooling, redundancy appropriate to your availability target, the serving and observability stack, and staffing. Staffing is the line most often understated. Someone has to patch, monitor, tune, manage capacity and respond outside business hours, and that capability is scarce and expensive to retain.

Then apply the factor that decides everything: utilisation. Owned hardware costs the same idle. If your workload is spiky and daytime-only, effective utilisation may be well under a third, and the per-request economics change accordingly.

Plot both as annual cost against volume, find the crossover, then ask two questions. How confident are you in reaching that volume, and by when? And what does the comparison look like at half that volume, because that is where you will be for the first year.

The answer most large organizations reach

Not one model, but a tier applied per workload class:

Sensitive or regulated workloads on private infrastructure, sized for that subset only rather than for everything.
General knowledge work on a commercial enterprise tier, which is usually the majority of volume and the minority of risk.
Frontier or experimental work on public APIs with synthetic or non-sensitive data.

This costs more to operate than a single choice and is usually still correct, because it matches control to actual exposure instead of applying the strictest requirement to everything.

The governance requirement it creates is a clear, enforced classification rule that tells a developer which tier a given workload belongs in. Without that rule, everything drifts to whichever tier is easiest to reach, which is exactly the shadow AI problem in a new form.

Where to go next

The constraint test and TCO structure are worked through in full in the readiness playbook. If you want the definitional groundwork first, start with what a private LLM actually is, and for the cost modelling in more depth see Private LLM vs Cloud API: Total Cost.