CompanyGPT vs. ChatGPT for enterprises: what data residency really covers

“But we do have a DPA with OpenAI” is one of the most common sentences in our initial conversations. It is correct — but it does not answer the question your data protection officer is asking.

This page explains the difference between what a data processing agreement governs and what a product feature called data residency delivers. And, in fairness, it also says what has recently improved at OpenAI.

First: ChatGPT for enterprises is not one product, but three

Most misunderstandings arise because people talk about “ChatGPT in the enterprise” without clarifying which offering they mean. For a data protection assessment, the difference is substantial:

What the DPA assures — and what it does not

This is the actual point, and it can be substantiated cleanly.

In clause 4.1, OpenAI’s data processing agreement expressly governs the case in which OpenAI Ireland Limited transfers data from the EEA and Switzerland to other OpenAI companies or to third parties outside the EEA — safeguarded by standard contractual clauses.

Put differently: the DPA does not prevent third-country transfers, it governs them. Anyone who wants geographically limited processing needs the data residency product feature in addition. That is not a criticism of OpenAI — this is simply how data processing agreements work in general. It is just not what many people assume when they say “we have a DPA”.

In fairness: what improved in January 2026

A widespread claim in the market is that OpenAI may store data in the EU but processes it globally as a matter of principle. That is no longer accurate.

Since 16 January 2026, OpenAI has offered inference residency: for eligible customers, model execution on the GPU takes place exclusively in the chosen region — Europe (EEA and Switzerland) is supported. This applies to ChatGPT Enterprise, Edu and ChatGPT for Healthcare.

Anyone still claiming today that every request to OpenAI necessarily leaves the EU is arguing from an outdated position. We say this explicitly, because a decision made on a false basis helps nobody.

What can remain outside the region even with inference residency

Just as important is the limitation that OpenAI itself documents. Paraphrasing its help documentation:

Inference residency guarantees GPU execution on the covered content within the chosen region. Other processing steps — such as authentication, routing, indexing and logging without content — can still take place outside the region. Asked whether inference residency guarantees that all processing stays within the region, the documentation expressly answers “No”. For stricter requirements, OpenAI points to a roadmap under development for more comprehensive compute residency.

Also not covered by residency, according to the documentation, is data processed through external integrations — for example apps, MCP connections and web search, where enabled.

The point you should know about ChatGPT Business

For ChatGPT Business, OpenAI documents an arrangement that regularly causes surprise in compliance conversations: the chosen region controls the storage of primary content at rest, but does not include inference residency. And where a region outside the US is chosen, the documentation states that a copy of every request and every response is additionally stored in the US for a limited period — for security and abuse monitoring purposes, even if the workspace is configured to a different region.

So if you work with ChatGPT Business and assume that European processing is thereby settled, you should be aware of this passage. According to OpenAI, ChatGPT Enterprise and Edu are expressly subject to their own, different arrangements.

On the Codex question: yes, your own endpoints are possible

Because we are asked this frequently: according to OpenAI’s documentation, the Codex CLI can be pointed at other endpoints. Via openai_base_url, the built-in provider can be directed at an LLM proxy, a router or a project with data residency enabled; alternatively, custom model providers with their own base_url can be defined. There is a built-in Amazon Bedrock provider with region selection, and via --oss the CLI can be run against local models through Ollama or LM Studio. The Codex CLI is licensed under Apache 2.0.

Microsoft additionally documents running the Codex CLI against Azure — with the express aim of operating the coding agent entirely on Azure infrastructure within your own compliance boundary. Worth noting: according to Microsoft’s documentation, Entra ID support is currently not available for Codex, so it remains API key authentication.

Two limitations belong here so that the picture is complete:

• No Codex model appears in OpenAI’s list of residency-capable models. You can point the CLI at the EU endpoint — but then not with a Codex model.
• According to the reference, the administrative enforcement setting enforce_residency in the managed configuration currently accepts only the value us.

On Azure, EU-limited processing of a Codex model is achievable via Data Zone Provisioned according to Microsoft’s current region overview, although not with the latest Codex models there. Microsoft expressly lists global deployments as a transfer out of the EU Data Boundary — prompts and outputs can be processed in any Azure region worldwide there. The Global Standard SKU can be blocked via Azure Policy.

How CompanyGPT frames the question differently

CompanyGPT shifts the question from “which residency tier have I booked?” to “which tenant and which region is this running in?”. The platform is built inside your own cloud — Azure, Google Cloud or sovereign on STACKIT. You choose the region and the model access, and the chat and knowledge data stay in your tenant.

You can use GPT models within it through your Azure subscription — alongside Claude, Gemini and open models, routed by use case.

When ChatGPT is the right choice

• When you can deploy ChatGPT Enterprise and inference residency for Europe covers your requirements.
• When OpenAI’s interface and ecosystem are exactly what your users need.
• When you need no model variety beyond OpenAI.
• When you do not want to set up your own operation.

When CompanyGPT is the better choice

• When the place of processing should sit entirely within your own tenant instead of being controlled through residency tiers.
• When you need several model families in parallel — not least to control cost per use case.
• When the knowledge base has to mirror existing permissions, particularly from SharePoint.
• When costs should not grow with headcount.
• When you want to bring automation through n8n and MCP into your business processes.

Conclusion

The most important sentence on this page is not “OpenAI is insecure” — that would simply be wrong, and inference residency since January 2026 is genuine progress.

The most important sentence is: a DPA is not an assurance about the place of processing. Anyone who needs geographic control has to book the appropriate product and know its limits — or bring the processing into their own tenant from the outset. Which of the three routes is right for you depends on your compliance situation, and we will also tell you when ChatGPT Enterprise is enough for it.

Sources

All statements about OpenAI are taken from OpenAI’s and Microsoft’s documentation, retrieved on 23 August 2026:

• Data residency and inference residency for ChatGPT — https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt
• Where your ChatGPT Business content is stored — https://help.openai.com/en/articles/20001418-where-your-chatgpt-business-content-is-stored
• Introducing data residency in Europe — https://openai.com/index/introducing-data-residency-in-europe/ — update of 16 January 2026
• OpenAI Data Processing Addendum — https://openai.com/policies/data-processing-addendum/ — clause 4.1
• Your data — OpenAI Platform — https://platform.openai.com/docs/guides/your-data
• Codex config reference — https://developers.openai.com/codex/config-reference
• Codex on Azure — https://learn.microsoft.com/en-us/azure/ai-foundry/openai/how-to/codex
• Azure deployment types — https://learn.microsoft.com/en-us/azure/foundry/foundry-models/concepts/deployment-types

Note on the information given: All statements about other vendors’ products are based on their publicly available documentation as of the date stated. Vendors continuously develop their products, features and terms — the vendor’s current information is always authoritative. If any statement appears outdated or inaccurate to you, drop us a line at info@innfactory.ai; we will check and correct it promptly. This comparison is not a substitute for legal or data protection advice in an individual case.

Further reading

• ChatGPT in the enterprise: GDPR-compliant private GPTs – the foundational article
• GDPR-compliant AI platforms compared 2026 – the market overview
• CompanyGPT vs. Claude – the comparison against Anthropic
• CompanyGPT at a glance – platform, add-ons and operating model