Executive Summary

• What it is: ChatGPT and Claude are already in use at most organizations, whether or not IT approved them. A security assessment shows how they are used today and what needs to happen before a company-wide rollout.
• The risk: When employees paste client data, financial records, source code, or internal strategy into personal ChatGPT or Claude accounts, that data is outside your control. Nothing is logged, and you have no easy way to delete it if the employee leaves.
• Why it matters: Informal AI use can conflict with your compliance obligations, client contracts, and industry regulations. An “Enterprise” subscription does not make AI use secure by itself. Most of the protection has to be configured, and the right plan depends on what your organization needs.
• What GreenLoop does: Our ChatGPT and Claude security posture review gives you a snapshot of your current state and helps you choose the right plan tier. Depending on what you decide, we can then configure identity enforcement, usage constraints, data retention, logging, and app governance.
• Who this applies to: Every organization that uses or is considering ChatGPT or Claude, of any size. Smaller organizations often have the least visibility into how far these tools have spread. For the difference between personal-email and company-email accounts, see Shadow AI: Personal Email vs. Company Email Accounts.

Why Compliance and Privacy Are at Risk

ChatGPT and Claude affect your compliance position. Free and personal-tier accounts can use submitted content to train the vendor’s models unless the user opts out, and your organization cannot enforce or check that opt-out on every employee’s personal account. You also cannot see or control personal accounts, and they stay with the employee after they leave your organization. If your business has contractual data-handling obligations to clients, industry compliance requirements, or an expectation of confidentiality for internal data, personal AI accounts are a significant business risk.

Business and Enterprise plans on both platforms close most of that gap, but only when you are on the right plan and it is configured correctly. Identity enforcement, audit logging, data retention, and access controls all have to be set up. The default configuration also differs between plan tiers on both platforms.

Data Leakage Through Unmanaged Personal Accounts

The situation we see most often starts when an employee pastes a client contract, source code, financial data, or internal strategy notes into a personal ChatGPT or Claude account to get a quick answer. That data is now on a platform your organization does not own. You cannot review it in any log, and no agreement your company has covers it. If the employee leaves, you cannot easily delete it.

There are two kinds of “personal account,” and they carry different levels of risk:

• Accounts tied to a personal email address. Your organization cannot see these accounts. GreenLoop and your IT team have no way to know they exist or what was shared through them. This is the larger blind spot.
• Accounts registered with a company email address but never brought under central management. Because these accounts use your domain, they can be found. If they were never set up through single sign-on (SSO) or added to a managed workspace, they are still outside your policy controls, logging, and retention settings.

This is often called “shadow AI.” It is the AI version of shadow IT (technology employees use without IT approval), and the data involved is usually more sensitive.

A company ChatGPT or Claude subscription does not fix this on its own. On both platforms, enforcing SSO for your official workspace does not stop an employee from opening a personal account in another browser tab or on a personal device. Closing that gap takes configuration at the identity and device level in addition to the right license.

Why an Assessment Comes First

A security assessment shows you and us where your organization stands before you make a rollout decision. It covers the following:

• Which employees or departments already use ChatGPT or Claude, and on what type of account.
• Whether your Microsoft 365 and Entra ID (Microsoft’s identity service) environment is ready to enforce identity controls for ChatGPT or Claude.
• Which data retention, logging, and compliance requirements apply to your business or to your client contracts.
• Which plan tier fits your goals (Claude Team or Claude Enterprise, ChatGPT Business or ChatGPT Enterprise), based on the features you need.
• What to do about personal accounts already tied to your company email domain.

Without an assessment, you may configure a platform before you understand how it is used, or leave a gap open because nobody looked for it.

Choosing the Right Plan

Plan selection is one of the most important decisions in this process, and the right answer depends on your goals. On both platforms, the top-tier plan adds features that the mid-tier plan does not have:

• Claude Team and Claude Enterprise. Team covers many needs for smaller teams. Enterprise adds directory sync, custom roles, audit logging, IP allowlisting, and other governance features that larger or more regulated organizations usually need.
• ChatGPT Business and ChatGPT Enterprise. Business is self-serve and does not include directory sync, custom-role permissions, audit logging, or IP restriction. Enterprise includes all of them, but it has a much higher seat minimum and a custom contract.

How we implement the platform depends on your plan and your goals. A small professional-services firm with light compliance requirements needs a different setup from a healthcare or financial services organization with contractual audit obligations. Choosing the plan that fits your organization is one of the main outcomes of the assessment.

What GreenLoop’s ChatGPT and Claude Hardening Includes

After the assessment shows what your organization needs, our hardening engagement puts the applicable controls in place. Which controls apply, and how we configure them, depends on your plan tier and the goals we agree on:

1. Identity and access control. We connect ChatGPT or Claude to your Microsoft 365 and Entra ID identity system and enforce SSO, so provisioned users cannot sign in with personal or social logins. We also set up user provisioning and deprovisioning based on your existing employee groups. When someone leaves the company, their access to the company AI workspace is removed in the same way as their email access.
2. A plan for existing personal accounts. GreenLoop does not clean up personal accounts directly, because we do not have account-level access to them. We identify which accounts are tied to your company email domain and map out how your organization can migrate or retire them, using the platform’s own account-migration tools where they exist.
3. Role-based access and least-privilege defaults. We set up role-based permissions so the default access level is conservative. Higher-risk features, such as custom AI agents, third-party integrations, and developer features, are limited to specific approved roles.
4. Usage constraints on approved platforms. We make sure your company-approved AI workspace is reachable only through approved platforms and devices. We also bring any AI account tied to a company email address under central policy management, with SSO enforcement, provisioning, and admin visibility.
5. Network-level blocking of personal accounts (advanced, optional). Personal ChatGPT or Claude accounts can be blocked at the network level. This requires TLS inspection (decrypting and checking encrypted web traffic) and an enterprise-grade firewall or SASE (secure access service edge) platform that can filter on request headers. It is an effective control, but it is a larger project than the other items in this list. We scope it as a separate project if your environment supports it and your risk profile needs it.
6. Data retention, logging, and compliance controls. Where your plan supports it, we configure how long conversations and files are kept, and we turn on audit logging and compliance export so activity can be reviewed or given to your compliance and legal teams. We also configure data residency settings where your contracts or regulations require it.
7. App and connector governance. Both platforms can connect AI to other tools, such as email, calendars, SharePoint, and Google Drive. We review what is enabled by default, which is often more than expected, and turn off anything that is not approved. We limit the remaining integrations to read-only or restricted actions, so the AI cannot act on your data unless a person approves it.
8. Ongoing review. AI vendors change their admin controls often, sometimes every month. We review your configuration on a recurring schedule so that new features, changed defaults, and new risks are addressed.

What This Looks Like for Your Team

Most employees will not notice a change in how they use ChatGPT or Claude for approved work. The changes are behind the scenes. Accounts tied to your company email are provisioned and managed centrally, and access to the approved workspace is enforced through your identity system. If you choose the network-level control, the approved company workspace is the only one that company devices can reach.

GreenLoop handles the identity connection, account provisioning, app approvals, and ongoing review. Your team gets the productivity benefit of these tools while the data stays under your organization’s control.

Frequently Asked Questions

Does buying ChatGPT Enterprise or Claude Enterprise automatically make our AI use secure?
No, most of the security features must be configured. Both platforms include strong security features, but SSO enforcement, audit logging, and data retention policy all need setup. An Enterprise subscription with default settings also leaves the personal-account gap open until you address it.

Do we need Enterprise, or is the mid-tier plan (Claude Team or ChatGPT Business) enough for us?
It depends on what you need. If you need directory sync, custom-role permissions, audit logging, or IP restriction, you probably need the Enterprise tier of the platform you choose. If your compliance requirements are lighter, the mid-tier plan may be enough, with a lower seat minimum and cost. We go through this decision with you during the assessment.

We think our employees already use ChatGPT or Claude informally. Is that a problem?
It can be, especially if anyone has pasted client data, financial information, source code, or internal documents into a personal account. The risk is highest for accounts tied to a personal email address, because your organization cannot see them at all. Accounts registered with a company email address are easier to deal with, because we can identify them and help you plan how to bring them under management. A security assessment is the fastest way to find out how widespread this is.

Will GreenLoop migrate or delete our employees’ personal AI accounts?
No, because that requires access to individual accounts that we do not have. We identify accounts tied to your company email domain and map out a practical plan for your organization to migrate or retire them, using the platform’s built-in account-migration tools where they exist.

Can you block personal ChatGPT or Claude accounts on our network?
Yes, but it requires TLS inspection and an enterprise-grade firewall or SASE platform, which is a larger project than the other controls here. Without that investment, we can make sure your approved AI workspace is reachable only through approved platforms and that any account tied to your company email is under central policy management. We scope full network-level blocking separately if it fits your environment and risk tolerance.

Is the process the same for ChatGPT and Claude?
Mostly, yes. The two platforms have similar security controls, so the process is similar for both. Some details differ, such as seat minimums and mobile device management options, so the assessment includes a recommendation on which platform, or both, suits your organization.

What’s the first step if we want to move forward?
Contact your Account Manager to schedule a ChatGPT or Claude security assessment for your organization.