Can my employer see my ChatGPT? What each work account and work laptop shows
The Morse teamPublished 8 min read
Yes, your employer can see your ChatGPT chats if you use a work ChatGPT account, and on a work laptop it may see some of what you type into a personal one too. As of October 2026, OpenAI says admins of a ChatGPT Business workspace "can view, access, export, and delete end user conversations in the workspace" (OpenAI), and Enterprise and Edu workspaces can pull conversation logs into eDiscovery and security tools. On a managed laptop, tools like Microsoft Purview can log each visit to chatgpt.com and flag sensitive text you paste into it, whichever account you're signed in to.
We read the admin documentation from OpenAI, Microsoft, Google, and Anthropic, plus Microsoft Intune, Chrome Enterprise, and Palo Alto Networks pages on device and network monitoring, on October 20, 2026. Two layers decide the answer: the account you sign in with, and the device and network you use. To their credit, the vendors publish what an admin can turn on in plain detail, so you can check it yourself instead of guessing.
Can my employer see my ChatGPT history on a work account?
On ChatGPT Business, yes, in full. A top Google result for this question on October 20, 2026 was an OpenAI community thread from 2025 quoting the line "only end users can view their conversations." OpenAI's current page says otherwise for Business: workspace admins "can view, access, export, and delete end user conversations" and "can control how long your data is retained" (OpenAI, updated January 8, 2026).
On ChatGPT Enterprise and Edu, the access runs through an API instead of a screen. OpenAI says end users view their own conversations, while "workspace admins can access an audit log of conversations and GPTs through the Enterprise Compliance API" (OpenAI). OpenAI's help page, updated October 19, 2026, says the Compliance Platform feeds "your eDiscovery, DLP, or SIEM tools," and that only a workspace owner can grant the Conversation messages permission (OpenAI). Its logs are "immutable, append-only" and kept for 30 days, so OpenAI tells companies to download them continuously if they want them longer. The eDiscovery, DLP, and security partners OpenAI lists for these logs include Microsoft Purview, Palo Alto Networks, and Relativity (OpenAI).
OpenAI's own staff have narrower access. For Enterprise, it says "Authorized OpenAI employees will only ever access your conversations for the purposes of resolving incidents, recovering end user conversations with your explicit permission, or where required by applicable law." For Business, it lists authorized employees for engineering support, abuse investigations, and legal compliance, plus "specialized third-party contractors" who review "solely to review for abuse and misuse." On both, "we do not use your business data for training our models" by default (OpenAI).
Does the Copilot audit log show my prompts?
No, but your prompts are still reachable. On a work or school account, IT can see your Microsoft 365 Copilot activity, and our guide to whether Copilot is private covers what Microsoft logs and how the personal app differs. The Purview audit log records "which user interacted with Copilot, when the interaction took place, and where it occurred," plus the files, sites, and emails Copilot read to answer (Microsoft Learn, August 26, 2026).
It leaves out the words. Microsoft says the log captures the activity "but not the actual user prompt or response. For this information, use eDiscovery" (Microsoft Learn). So someone who can only open the audit log sees that you asked Copilot something and which files it opened, and the text itself goes to whoever your company gives eDiscovery rights.
Can my employer see my Gemini chats?
Yes, if you use Gemini with a Google Workspace account and your company uses Google Vault. Google's Vault help says admins can retain, hold, search, and export Gemini conversations "comprising user prompts and Gemini app responses" (Google Workspace, updated October 13, 2026).
Since June 11, 2026, Vault retention rules and litigation holds also cover the Gemini app on web and mobile, and they "will always take precedence over Admin console settings, user deletion settings, or user activity settings" (Google Workspace Updates). A chat you delete under a hold stays preserved. Google lists Business Plus, Enterprise Standard and Plus, and the Education editions among those with the feature. Separately, Gemini log events show admins when someone used Gemini in Docs, Sheets, or Slides (Google Workspace). Our Gemini privacy guide covers the personal account.
Can a Claude Team or Enterprise admin read my chats?
Yes. On both Team and Enterprise, the Primary Owner can export the organization's data, and Anthropic says exports "include conversation data and the user data for your organization" (Anthropic). Incognito chats are in those exports (Anthropic). Deleted messages are left out of exports made after you delete them.
Enterprise adds two more tools. Its audit log covers 180 days but excludes "title and content of chats" (Anthropic, June 15, 2026). The Compliance API reaches the content: chats, files, and projects, plus transcripts of sessions in Claude Code, Cowork, and Claude in Chrome on users' own machines, "captured while users are signed in with their Claude Enterprise account" (Anthropic).
Who can see what: work AI tools and work laptops, by layer
Every cell comes from the vendor's own page, read October 20, 2026, and "not stated" means the pages we read didn't say. For the last three rows, the deletion column is our reading: those records sit in your company's systems, not in your AI account.
| Tool or layer | What your employer can get | Chat text? | After you delete |
|---|---|---|---|
| ChatGPT Business | Admins view, export, and delete members' chats (OpenAI) | Yes | Admins set retention |
| ChatGPT Enterprise and Edu | Conversation logs through the Compliance Platform (OpenAI) | Yes, with the owner-granted permission | Logs are append-only; companies keep their own downloads |
| Microsoft 365 Copilot (work account) | Audit record of who, when, where, and which files (Microsoft Learn) | Through eDiscovery | Not stated |
| Gemini app on Workspace | Vault retention, holds, search, and export (Google) | Yes | Kept under a Vault rule or hold |
| Claude Team | Primary Owner's organization export (Anthropic) | Yes, incognito included | Left out of later exports |
| Claude Enterprise | Export, 180-day audit log, Compliance API (Anthropic) | Yes, including Claude Code and Claude in Chrome sessions | Left out of later exports |
| Any AI site on a managed laptop (Purview) | Visits to AI sites, sensitive text pasted or uploaded (Microsoft Learn) | Prompts, if a content-capture policy is on | Deleting the chat doesn't reach them |
| Managed Chrome browser | Security events; data-transfer events with Chrome Enterprise Premium (Google) | Not stated | Not stated |
| Office network with TLS inspection | Decrypted web traffic (Palo Alto Networks) | Depends on the company's setup | Not stated |
Can my employer see my personal ChatGPT on a work laptop?
It can see some of it. Using a personal account takes your chats out of the admin console, but the laptop and the network are still your employer's.
Microsoft Purview is one example, and its docs name ChatGPT. With laptops onboarded and its browser extension installed, a company can log an "AI website visit" and run a policy that "discovers sensitive content pasted or uploaded in Microsoft Edge, Chrome, and Firefox to AI sites." Microsoft's own example is "a user pastes credit card numbers into ChatGPT" (Microsoft Learn, updated June 25, 2026). The "AI interaction" event can include the prompt text when the company turns on a policy with content capture. Purview's list of supported AI sites includes chatgpt.com, claude.ai, gemini.google.com, perplexity.ai, and character.ai (Microsoft Learn).
The browser and the network add their own layers. A Chrome browser managed by the company reports events such as extension installs and unsafe site visits, and with Chrome Enterprise Premium, "content transfer" and "sensitive data transfer" (Google, updated October 13, 2026). On the network, a firewall doing TLS inspection "decrypts SSL/TLS traffic to plaintext for inspection" (Palo Alto Networks).
Device management on its own collects less. Microsoft says Intune, its device management service, doesn't collect "an end users' calling or web browsing history," personal email, texts, or photos (Microsoft Learn). But that management is how a company installs the other tools on the laptop. You usually can't tell from the screen which ones are running.
Should you use a personal AI account at work?
For work data, no. Your employer's AI policy decides which tools may see company information, and pasting it into a personal account is what the DLP policies above are built to catch. Use the approved tool, under its rules. This isn't legal advice: if you're unsure what your contract allows, ask HR or a lawyer, not a chatbot.
For personal questions, the answer is the reverse. Keep them off the work account and off the work laptop, because no setting on either one is yours to change.
How to keep personal AI chats off your employer's systems
On a work laptop, every layer in the table belongs to your employer: the account, the browser, the device, and the network. No app can change that from inside the browser, Morse included. Our end-to-end encryption seals a message on your device, but a monitoring agent on that device can see the page and your typing before anything is sealed. So the fix is your own device, and Morse is built so your chat history lives only there.
- E2EE, for personal questions no server should read. On your own phone or computer, your browser checks the secure enclave's hardware attestation, then encrypts the message so only that enclave can read it. Morse's servers relay ciphertext they can't read, and the reply is decrypted only in your browser. This rests on the enclave hardware and attestation working as designed, and third-party providers run the enclaves, not Morse.
- Private, for everyday chats you'd rather no host keep. New chats start here, with open-weight models like DeepSeek, Kimi, and GLM, plus Grok. Morse has zero data retention agreements with its inference, search, and other providers, so they keep nothing. Where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't.
- Anonymous, for GPT, Claude, or Gemini without the provider knowing it's you. Our proxy removes your account, email, and IP address and sends the message under Morse's own account. The provider may keep the message for a limited time to check for abuse, under its own policy, so leave your name and your employer's name out of it.
Wherever you use it, your chat history is stored in your browser, encrypted, not on Morse's servers, and our servers don't keep your messages or log what you write. It locks when you sign out, and unlocking takes two keys, one of which never leaves your device. Sign in with a personal email, not your work one, since sign-in is a code sent to that inbox. Morse doesn't train AI on your chats, sell your data, or show ads (privacy policy). Clearing your browser or losing the device deletes your chats for good, and Morse can't recover them, so save anything you need. For the wider set of threats beyond your employer, see how to use AI privately.
Open the Morse home page on your own phone and send a message without an account, or start free. End-to-end encrypted chats come with Pro, at $19 a month.
Common questions
Can my employer see my ChatGPT on my phone?
Not through any of the tools above if the phone is yours, isn't enrolled in your company's device management, isn't on the office network, and you're signed in to a personal account. If you enrolled it for work email, ask IT what that profile covers before you assume it covers nothing.
If I delete a chat in my work ChatGPT, is it gone from my employer's records?
Not necessarily. On ChatGPT Business, admins set how long data is kept, and on Enterprise the Compliance Platform's logs are append-only, so a copy your company already downloaded stays with your company. Anything a tool like Purview captured on the laptop sits in your company's systems, and deleting the chat doesn't reach it.
Can OpenAI staff read my ChatGPT Enterprise chats?
Only in narrow cases. OpenAI says authorized employees will only access Enterprise conversations to resolve incidents, to recover conversations with your explicit permission, or where the law requires it. For ChatGPT Business, it also lists specialized third-party contractors who review solely for abuse and misuse, and it says it doesn't train its models on business data by default.
I signed in to my personal ChatGPT on a work computer once. Can my employer now see my history?
Your history is stored in your OpenAI account. What the laptop's monitoring could record is what happened while you used it there, and a browser that stays signed in keeps that window open, so sign out when you're done.