Snapshot 218060
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Trust Portal Start your security review View & download sensitive information Overview Welcome to our Trust Portal for OpenAI's ChatGPT services, including ChatGPT Enterprise and ChatGPT Edu. Here, you can access our comprehensive compliance documentation, find answers to frequently asked questions related to security and privacy, and explore our robust security practices. We believe in maintaining transparency and building trust with our customers, and this portal is designed to provide you with the information and assurance you need to feel confident in our ability to protect your data. Our products are covered in our SOC 2 Type 2 report and have been evaluated by an independent third-party auditor to confirm that our controls align with industry standards for security, confidentiality, privacy and availability. Our products are also ISO 27001, 27017, 27018, and 27701 certified. Request access to our SOC 2 Report below to learn more about our security controls and compliance activities. OpenAI invites security researchers, ethical hackers, and technology enthusiasts to report security issues via our Bug Bounty Program. The program offers safe harbor for good faith security testing and cash rewards for vulnerabilities based on their severity and impact. Refer to our blog to read more about the program and visit Bugcrowd to participate. Compliance SOC 2 Type 2 SOC 3 PCI DSS v4.0.1 ISO/IEC 27001:2022 ISO/IEC 27017:2015 ISO/IEC 27018:2019 ISO/IEC 27701:2019 ISO/IEC 42001:2023 CCPA CSA STAR GDPR TX-RAMP FedRAMP 20x OpenAI is trusted by Morgan Stanley PwC Robinhood Square Zendesk Amgen Bain & Company Datadog JetBlue Airways University of Oxford Moderna Documents DOCUMENTSISO SoA REPORTSData Flow Diagram REPORTSOpenAI System Cards REPORTSPentest Report REPORTSSecurity Threat Report REPORTSSecurity Whitepaper REPORTSSOC 3 Report REPORTSVoluntary Product Accessibility Template® (VPAT®) COMPLIANCECSA STAR COMPLIANCEFedRAMP 20x COMPLIANCEISO/IEC 27001:2022 COMPLIANCEISO/IEC 27017:2015 Frontier Model Safety & Security Model Evaluations, Fairness & Bias AI Security Model Pretraining View more ChatGPT Security Features ChatGPT Mobile and Desktop Applications Enterprise Key Management ChatGPT Gov View more Endpoint Security Disk Encryption DNS Filtering Endpoint Detection & Response View more Product Security Audit Logging Data Security Integrations View more Data Security Data Backups Data Deletion / Data Retention Encryption-at-rest View more Risk Profile Third Party DependenceYes HostingMajor Cloud Provider Reports Data Flow Diagram SOC 3 Report Network Diagram View more Access Control Access Log Management Bring Your Own Device (BYOD) Data Access View more Self-Assessments CAIQ HECVAT Full HECVAT Lite View more App Security Responsible Disclosure Application Penetration Testing Code Analysis View more ESG ESG Commitment Supplier Code of Conduct Legal Subprocessors Cyber Insurance Data Processing Agreement View more Data Privacy Cookies Data Breach Notifications Data Privacy Officer View more Infrastructure Status Monitoring Cloud Infrastructure BC/DR View more Network Security Data Exfiltration Monitoring DMARC Firewall View more Corporate Security Asset Management Practices Email Protection Employee Training View more Policies Acceptable Use Policy Access Control Policy Business Continuity/Disaster Recovery (BC/DR) Policy View more Incident Response Incident Response Plan Risk Management Risk Assessments Supply Chain Risk Management FedRAMP 20x OpenAI FedRAMP 20x OpenAI FedRAMP 20x Trust Center and Documentation FedRAMP Certification Package Overview (JSON) View more Trust Portal Updates OpenAI's ISO/IEC 27001 Certificate is now available at trust.openai.com Compliance We are excited to announce that OpenAI has received an ISO/IEC 27001 Certificate, available for public viewing at trust.openai.com under "Documents." This certificate documents OpenAI's operation an Information Security Management System that conforms to the requirements of ISO/IEC 27001:2022 for OpenAI’s API, ChatGPT Enterprise, and ChatGPT Edu services. Control implementation also conforms to additional control sets of ISO/IEC 27017:2015 and ISO/IEC 27018:2019 and extends to include the PIMS requirements, control implementation guidance, and additional control set of ISO/IEC 27701:2019. The 2025 SOC2 Report for OpenAI's ChatGPT Business Products and API is now available to customers at trust.openai.com Compliance OpenAI's most recent SOC2 Report covers the period of January 1, 2025 to June 30, 2025 and is now available for viewing on the ChatGPT Business Products and API Trust Portal pages. We are proud to share that this report covered controls relevant to the Security, Availability, Confidentiality, and Privacy Trust Services Criteria for the API Platform, ChatGPT Enterprise, ChatGPT Edu, and ChatGPT Team. Customers with active trust.openai.com accounts can access the latest report under "Documents." OpenAI's 2026 SOC 2 Type 2 Report is now available to customers at trust.openai.com. Compliance OpenAI's most recent SOC2 Report covers the period of July 1, 2025 to June 30, 2026 and is now available to authenticated users on the OpenAI Trust Portal. This report covered controls relevant to the Security, Availability, Confidentiality, and Privacy Trust Services Criteria. View OpenAI products and services in scope at the OpenAI Product Compliance Status page. Customers with active trust.openai.com accounts can access the latest report under "Compliance" > "SOC 2 Type 2." PCI DSS Compliance OpenAI now maintains PCI-DSS compliance for the components of ChatGPT that support delegated payment processing, ensuring secure handling of payment information for supported merchant transactions. Customers may view relevant documentation at trust.openai.com. Read our latest LLM safety and security publication: "Detecting misbehavior in frontier reasoning models" General Frontier reasoning models exploit loopholes when given the chance. We show we can detect exploits using an LLM to monitor their chains-of-thought. Penalizing their “bad thoughts” doesn’t stop the majority of misbehavior—it makes them hide their intent. Read more on our blog! If you think you may have discovered a vulnerability, please send us a note. Report issue