Honest comparison
How we stack up, factually.
We are not claiming to beat enterprise-tier privacy at the model layer — we're claiming to match it, with a different ownership model and architecture. Every cell below is cited.
| Dimension | PurposeMapped | ChatGPT (consumer / dots) | ChatGPT Team/Enterprise & Claude API/Enterprise | Microsoft 365 Copilot |
|---|---|---|---|---|
| Where memory / files live | Dedicated server assigned to the individual user; no shared multi-tenant store1 | OpenAI's consumer product cloud, shared multi-tenant infrastructure2 | Provider's enterprise/API tenancy — tenant-isolated but still provider-hosted3,6 | Microsoft 365 service boundary / EU Data Boundary7 |
| Training default | No training; API terms with providers configured for no training by default1,3 | May be used to improve models by default, with opt-out available2 | No training by default on Team/Enterprise/API data3; Claude consumer plans train by default, Claude API/Enterprise do not5,6 | Not used to train foundation models per Microsoft's enterprise commitments7,8 |
| Retention window | ~30-day provider abuse-monitoring baseline for API traffic; Anthropic zero-retention available on commercial keys4,6 | ~30-day deletion baseline for deleted/unsaved chats, subject to legal holds4 | Zero Data Retention available for eligible Anthropic API/Enterprise/Commercial-org traffic6; OpenAI Enterprise/API follows contractual terms3 | Retention governed by the org's own M365 retention policies7 |
| Org visibility of individual conversations | Company deployments include company-defined HR/management oversight — policy rules with severity-graded violation flags via the admin dashboard — while preserving per-employee instance isolation1 | Not applicable (no org tier in base consumer product) | Admin console access depends on enterprise configuration and tenant admin policy (provider-specific; not independently verified in this pass) | Inherits the org's own permissions, sensitivity labels, and admin controls — admin-configurable visibility7 |
| Model choice / flexibility | Not locked to one AI company — we continuously test and select models for reliability, performance, and security, routing only to vetted, enterprise-grade providers under commercial (no-training) API terms | Single-vendor (OpenAI) product | Single-vendor per product, configurable by API | Single-vendor (Microsoft/OpenAI-backed) product |
| Data location control | Deployed in a region the user or company chooses (dedicated AWS instance) | Determined by provider, not user-selectable | Enterprise-tier regional options vary by provider agreement | EU Data Boundary by default, but a "Flex Routing" admin toggle can route inference outside the EU boundary under capacity pressure unless explicitly disabled8 |
| Export | Full conversation and profile export available via dashboard or support request (see privacy policy §7) | Data export available through account settings | Enterprise data export per tenant admin tooling | Export governed by M365 compliance/eDiscovery tooling |
| Personal alignment at setup | A values & work-style assessment at onboarding configures your assistant to how you actually think and work from day one | No structured profiling; adapts loosely from chat history | No onboarding assessment; personalization via custom instructions/memory only | Grounded in your M365 data; no values or work-style profiling |
| Capability growth over time | A managed, expanding set of skills and tools is delivered to your instance — the service gets more capable over time | Capabilities change only when the vendor ships product updates | Vendor-shipped features; custom tools require your own build | Capabilities tied to Microsoft's release cadence and licensing |
| Assistant autonomy to build its own tools | Within policy, your assistant can author its own tools and integrations as your needs change | No; limited to built-in tools | Tool use constrained to pre-built connectors/functions you configure | No; cannot author its own tools |
| Memory consolidation (“Dreaming”) | A nightly “dreaming” process consolidates memory and strengthens continuity over time | Session and saved memory; no autonomous consolidation | Memory per tenant/config; no autonomous consolidation process | No persistent self-directed cross-session consolidation |
The honest bottom line
At the model layer, PurposeMapped's privacy posture is equal to, not better than, the enterprise tiers of ChatGPT and Claude — because we use those same providers' API terms. What's different is the architecture: a dedicated instance per user instead of a seat on a shared platform, and an ownership model where you (or your company) hold the infrastructure.
- PurposeMapped architecture: dedicated per-user AWS instance, no multi-tenant content store (internal architecture, verified 2026-09-30).
- OpenAI, "Data controls in ChatGPT" — https://help.openai.com/articles/7730893-data-controls-in-chatgpt (Sept 2026)
- OpenAI, "How your data is used" (business data) — https://openai.com/business-data/ (current as fetched 2026-09-30)
- OpenAI, "Enterprise privacy" — https://openai.com/enterprise-privacy/ (Jan 8, 2026 cached version; 30-day deletion baseline)
- Anthropic, "Updates to our Consumer Terms" — https://www.anthropic.com/news/updates-to-our-consumer-terms (Aug 28, 2025)
- Anthropic / Claude Support, "Data retention practices for covered models" — https://support.claude.com/en/articles/15425996-data-retention-practices-for-covered-models (June 9, 2026) — ZDR applies to eligible APIs, Commercial-org API keys, and Claude Code for Enterprise; consumer plans are unaffected.
- Microsoft Learn, "Data, Privacy, and Security for Microsoft 365 Copilot" — https://learn.microsoft.com/en-us/microsoft-365/copilot/enterprise-data-protection (Aug 18, 2026)
- Eyal Marcus, "Microsoft Copilot GDPR / EU Data Residency" — https://eyalmarcus.com/microsoft-copilot-gdpr-eu-data-residency/ (Aug 10, 2026) — describes the Flex Routing admin toggle.