On a work account your employer can often see your ChatGPT or Claude chats, and a managed laptop or office network shows more. What each layer reveals.
Quick answer
It depends on the account, the device and the network. On a personal account your employer has no admin access to your chats. On ChatGPT Business, workspace admins can view, export and delete conversations; ChatGPT Enterprise and Claude Enterprise let the organisation retrieve chats through a Compliance API. On a managed work laptop, security software can flag or log what you paste into ChatGPT, whatever the account. On the company network, IT can usually see that you use ChatGPT. Whether they may look is another question: the GDPR requires a purpose, necessity and advance notice.
01
On a personal ChatGPT or Claude account there is no employer admin above you, only the vendor
02
ChatGPT Business: colleagues cannot see your chats, but workspace admins can view, export and delete them
03
ChatGPT Enterprise, Claude Enterprise, Microsoft Copilot and Gemini in Workspace editions with Vault give the organisation access to chats
04
A managed work laptop or the office network can show your employer more, even when you use a personal account
05
Monitoring needs a purpose, necessity and advance notice; covert checks are allowed only on a specific suspicion of misuse
Henrik asks over coffee, half joking: "My employer can't actually see what I type into ChatGPT, right?" He is not sure. He regularly pastes chunks of customer text into an AI tool to reply faster, and now he is second-guessing it. The honest answer is neither a flat yes nor a flat no. It depends on the account he is signed in with, the laptop he types on and the network in between.
The account. On a personal account (ChatGPT Free, Go, Plus or Pro, Claude Free, Pro or Max, or consumer Gemini) there is no employer admin above you. The vendor processes your text under its own terms, but nobody in your organisation can open your chats through an admin console, because for your account that console does not exist. On a work account there is a workspace with an admin, and what that admin can reach depends on the tool and the plan. The table below sets it out.
The device. A work laptop that IT manages can show more than any admin console, whatever account you use in the browser. With Microsoft Purview, an organisation can see when sensitive data, such as a credit card number, is pasted into ChatGPT on its enrolled devices, and it can show a warning or block the action. The prompts themselves are only recorded if the organisation sets Purview to capture content. IT can also install browser extensions silently, and you cannot remove or switch those off. An extension with access to every site can read what happens on the pages you open, which is why browser extensions are AI tools too.
The network. On the office network, IT can usually see which sites your laptop connects to, and therefore that you use ChatGPT. What you type travels encrypted. That changes with TLS inspection, where a proxy decrypts the traffic, inspects it and encrypts it again. It only works on devices that trust the organisation's own certificate. An organisation on ChatGPT Enterprise can use it for Workspace Blocking: the network adds a ChatGPT-Allowed-Workspace-Id header, and ChatGPT then only opens the approved workspaces and filters out personal ones. How a proxy compares with an extension is covered in browser extension or network proxy.
Incognito and VPN. A private window only stops the browser from keeping your history on the laptop. Google itself notes that your employer may still be able to see what you do in Incognito, and on a managed browser IT can switch private browsing off altogether. A VPN hides your traffic from the office network, not from software running on the laptop itself. And on a work account neither makes a difference: the chat is stored in the workspace.
Your own phone on the office Wi-Fi. A phone that IT does not manage lacks the company certificate, so the network can see that it connects to ChatGPT, but not what you type. The ChatGPT app also pins its certificates: with inspection switched on, it only works if IT has added an exception through device management. An organisation can still block ChatGPT on its network altogether. If IT has enrolled your phone in device management, it counts as a managed device and the paragraphs above apply.
In ChatGPT Business, each member has their own chat history, and other members cannot see it unless you share a conversation through a shared link. Workspace admins are a different matter. According to OpenAI's enterprise privacy page, they can view, access, export and delete end-user conversations in the workspace, and the workspace owner can export a member's data from the Members page (OpenAI Help Center).
ChatGPT Enterprise goes further. Its Compliance API gives the organisation logs of conversations and other workspace data, which it can feed into eDiscovery, DLP or security tools from vendors such as Microsoft Purview, Netskope and Zscaler. The same applies to ChatGPT Edu.
On a personal Claude account (Free, Pro, Max) there is no employer admin above you. On Claude Team, the organisation's Primary Owner can export the organisation's data, and that export includes incognito chats. Claude Enterprise adds audit logs, which record activity but not chat content, and the Compliance API, which gives access to chats and files.
Microsoft Copilot, until recently called Microsoft 365 Copilot, stores your prompts and its responses with the rest of your organisation's Microsoft 365 content. A copy sits in a hidden folder in your mailbox that compliance admins can search with eDiscovery, and retention policies can set how long it stays. The audit log records who used Copilot, when, where and which files it accessed. In short: Copilot interactions are discoverable.
If Gemini runs on your work account, an admin can use Google Vault to retain, hold, search and export your prompts and Gemini's answers in the Gemini app, including chats you deleted while a hold applies. That requires an edition with Vault: it is included in Business Plus and in Enterprise and Education editions, among others, but not as standard in Business Starter or Business Standard. Audit logs show who used Gemini and when. The consumer version of Gemini runs outside the workspace and falls outside Vault and the organisation's audit logs. More on this in Gemini's privacy risks.
The fact that an admin can reach your chats does not mean they may look whenever they like. According to the Dutch Data Protection Authority, monitoring needs a legal basis and a purpose, it has to be necessary, meaning no less intrusive approach would do, and you have to be told in advance what is checked, how and why. Covert checks of email and internet use are only allowed on a suspicion of misuse, for a short period and targeted at the people concerned. If your organisation has a works council, it has to consent to a system that is aimed at or suitable for monitoring staff (Article 27(1)(l) of the Dutch Works Councils Act). The full picture is in our article on whether your employer can monitor your AI use.
Do not assume a conversation is private because it feels that way. On a work account the content is often discoverable, even when the chat sits in your own history, and on a managed laptop what you paste can be logged on the device. That need not be a worry: on a properly set-up account you know which tooling is in place, and what for.
The more practical lesson applies at the moment you type. What you do not put in a prompt cannot be retrieved by anyone later. A customer account number you leave out never appears in an eDiscovery export. For what stays behind in chat logs, read the hidden risks of AI chat logs.
BeeSensible takes a different route, and on a page like this it is fair to say that it runs on the device too, as a browser extension or desktop app. While you type in an AI tool, an account number or a customer name is highlighted in the text field, and you decide whether to mask or remove it before you send. Your organisation can also set masking to happen automatically when you paste or send.
The text is checked in memory on BeeSensible's servers in the EU and then discarded. What reaches the organisation is counts and patterns, never what someone typed. The dashboard has no breakdown per employee, and the figures on AI tool usage arrive without a user ID. Department figures only appear when the organisation switches them on, and by default only for departments of at least five people. What the organisation sees is on the See page, and what it means for HR teams on AI and HR.
Because the Works Councils Act also covers systems that are merely suitable for monitoring, it is up to the organisation to assess whether its works council has to consent. We advise involving the works council before rolling it out.
Detections over timeLast 30 days
12,438+18% vs the previous period
Detections by platform
ChatGPT
78% adjusted
8,124
Gmail
81% adjusted
3,210
Gemini
74% adjusted
812
Detected entity types
Name
4,212
Email address
2,930
Credit card number
1,486
Account number
1,104
Diagnosis
612
StandardCritical
The BeeSensible dashboard: detections in aggregate and where they occur most, without monitoring individuals.
And the question you ask from now on, before you paste, is not who can read this later but what you are actually putting in.
Checked on 20 October 2026 against OpenAI's enterprise privacy page and Help Center, Anthropic's support pages, Microsoft Learn, Google Workspace Help, Google Chrome Help, the Dutch Data Protection Authority and the Works Councils Act. Plans and menu names can change.
FAQ
Common questions
Can my employer read my ChatGPT conversations?
It depends on the account. On a free or personal ChatGPT account there is no employer admin above you. In ChatGPT Business, other members cannot see your private chats, but according to OpenAI workspace admins can view, access, export and delete conversations in the workspace. In ChatGPT Enterprise, the organisation can retrieve conversation logs through the Compliance API. On a managed work laptop, security software can also flag or log what you paste into ChatGPT, whatever account you use.
What can an admin see of my Microsoft Copilot interactions?
Microsoft stores your Copilot prompts and its responses with your organisation's other Microsoft 365 content, with a copy in a hidden folder in your mailbox. Admins can view and search that content with Content search or eDiscovery in Microsoft Purview, and set retention policies on it. The audit log records who used Copilot, when, where and which files it accessed. Source: Microsoft Learn, checked 20 October 2026.
Can an admin see my Gemini chats in Google Workspace?
If Gemini runs on your work account and your Workspace edition includes Google Vault, an admin can retain, hold, search and export your prompts and Gemini's answers in the Gemini app. Vault is included in Business Plus and in Enterprise and Education editions, among others, but not as standard in Business Starter or Business Standard. Audit logs show who used Gemini and when. Gemini on a personal Google account falls outside this. Source: Google Workspace Help, checked 20 October 2026.
Can my employer see chats I deleted?
Sometimes. A ChatGPT chat you delete disappears from your view at once, and OpenAI removes it from its systems within 30 days, unless it has to keep it longer for security or legal reasons. On a work account, OpenAI notes that authorised compliance tools may still reach eligible workspace data under the organisation's retention policy. In Google Workspace, a Vault hold or retention rule keeps Gemini chats that a user deleted, and they stay searchable for the admin. Source: OpenAI Help Center and Google Workspace Help, checked 20 October 2026.
Can my employer simply look through my AI conversations?
No, not freely and almost never covertly. An employer needs a legitimate purpose, the monitoring must be necessary and you must be told in advance what is checked, how and why. Covert checks are only allowed where there is a specific suspicion of misuse. In the Netherlands, the works council has to consent to a system that is aimed at or suitable for monitoring staff.
What is the difference between what the admin sees and what the vendor sees?
The vendor (OpenAI, Anthropic, Microsoft, Google) always processes your conversations, including on a personal account, under its own terms. An employer admin only sits in between on a business or enterprise account, and only as far as the chosen plan allows. Having no admin above you does not mean no one processes your text.
How do I know which account I am on?
Check whether you are signed in with a work email and whether a workspace or organisation name appears. A workspace with an admin points to a business or enterprise plan. If you are unsure, ask your IT team: they know which plan is in use and what comes with it.
