Internal ChatGPT vs. a True Company Brain (And What to Use Instead)

The choice is not ChatGPT or a company brain. It is which accounts your people use today and what each tool is allowed to read. We recommend three steps, in this order: put people on a sanctioned business account, so personal-account use stops being the default; audit what your files already share before you connect any assistant to them; and add retrieval with permission filters for the gaps the sanctioned tool leaves. The risk is a public model on a personal account. Consumer plans may train on what employees paste, and the model has never seen your deployment pipeline, so it answers with generic best practice.

Where the risk sits

Employees paste proprietary code, customer details and strategy documents into whichever tool is open. OpenAI's help center says its consumer plans (Free, Plus and Pro) may use conversations to train models unless the user opts out, while ChatGPT Business, Enterprise and its API do not use inputs or outputs to improve models by default. The Samsung ban after a data leak shows how quickly well-meaning employees can share intellectual property.

The second problem is context. A public model cannot know your deployment pipeline, your internal API rate limits or the history of your architecture decisions. Asked how to reset the staging database, it guesses or offers generic practice, and an engineer who applies a generic fix can break an internal dependency.

Start with a sanctioned account

A ban without an alternative leaves the need in place and moves it to personal accounts, where you cannot see it. We recommend licensing a business plan this month. OpenAI says ChatGPT Business and Enterprise do not train on workspace data by default, and Anthropic says the same for Claude Team content. Write down what may be pasted into it, and build your own retrieval only for the gap that remains: permission-aware answers over your own sources, with citations and an audit trail. That reorders the usual plan. Retrieval becomes a second phase that solves a defined problem, not the first response to a leak.

Retrieval fixes context, and permissions need separate work

A retrieval-augmented system does not rely on the model's weights for facts. It takes the employee's question, searches your internal sources, gives the retrieved passages to the model as context, and has the model answer from that context only. Because retrieval touches your systems, it can enforce permissions. Connect it to your identity provider and filter inside the search query, so the index returns only documents the user may read:

def retrieve_documents(query, user_id):
    groups = get_user_groups(user_id)
    return vector_database.search(
        query,
        filter={"allowed_groups": {"any_of": groups}},
        top_k=8,
    )

Filtering inside the query matters. Filtering the top results afterwards returns nothing useful when the best matches are restricted, and it moves restricted text into your application first.

Audit oversharing before the first connection. An assistant makes every over-broad permission searchable. Microsoft says Copilot only surfaces organizational data to which a user has at least view permission, and tells customers to use the permission models in services such as SharePoint to make sure the right people have access. A salary-band spreadsheet in a folder shared with the whole company is already readable by every employee, and an assistant turns "technically accessible" into "answered in one question". Before you connect a source, list the HR, finance and legal folders shared company-wide or by link and fix those first. Then test with an ordinary employee account and ask the questions you hope nobody asks.

Pick the parts

Self-hosted open-weight models such as Llama or Mistral give the most control over data but need engineering time and GPUs. Managed enterprise APIs such as Azure OpenAI or AWS Bedrock run the model for you under contractual data terms, on the provider's infrastructure and not inside your own VPC. On Bedrock, for example, the model deployment accounts are operated by AWS, model providers have no access to them or to customer prompts and completions, and AWS PrivateLink can give your VPC a private connection to the service.

Retention terms vary by model, even on one platform. When Claude Fable 5 launched on Bedrock, the announcement said the provider required 30-day retention and human review, which drew a long Hacker News thread about zero-retention compliance. Bedrock's data retention documentation now says that sharing content with model providers is not supported today. A model that requires human review is available only when the account lets AWS retain inputs and outputs for up to 30 days and review them within the AWS boundary, an account set to zero retention is blocked from calling such a model, and most models do not require review. If your policy is zero retention, check each model's allowed modes before you build on it.

For the vector database, Pinecone, Weaviate, Milvus and pgvector are popular choices. The feature that matters most for a company brain is metadata filtering, because the permission filter above depends on it. Check that you can filter on access level, document type and author at query time and not afterwards.

Retrieval quality

Keep the index current with events and not a nightly scrape. Subscribe to webhooks from your main sources so that merging a pull request that updates the deployment documentation triggers ingestion: the pipeline fetches the file, chunks it, embeds it and updates the vector database within seconds. Chunk by structure and not by character count, using markdown headers and paragraph breaks, and AST parsers for code, so an API endpoint stays in one chunk with its description and example.

Add keyword search beside vector search. Vector search can miss an exact error code or product identifier, so run BM25 and vector search in parallel and merge the results with reciprocal rank fusion. Then re-rank the top 50 or so candidates with a cross-encoder, which is too slow for the whole database and good at ordering a small set.

Handle internal names with a maintained alias table before you fine-tune anything. Employees call one initiative "Project Phoenix" and "the new billing migration", and a common answer is to fine-tune an embedding model so both reach the same pages. A plain alias list, mapping each internal name to the others and expanding the query with them, fixes that case, can be edited and reviewed by the page owners, and shows up in a diff when someone changes it. Fine-tuning is the last resort, after a golden set shows that aliases and hybrid search are not enough.

Logging and redaction

In regulated industries, knowing what the assistant said matters as much as what it knows. Log centrally every query, the retrieved chunks, the final prompt and the response, so you can debug failures, see usage patterns and investigate incidents. When a wrong instruction causes an outage, the log shows whether a document or the retriever was at fault. Pass retrieved text through a redaction layer before it reaches the model: a user who may open a document does not need its social security numbers, API keys or customer data in the prompt. Automated PII detection, with regular expressions or specialized tools such as Microsoft Presidio, can mask them.

Keep it honest after launch

Measure the system. Build a golden dataset of common employee queries with ideal answers, score it with metrics such as context precision, context recall and answer relevance (the RAGAS framework offers these), and rerun it whenever the architecture or model changes. Content decay is the main long-term threat. Query logs and feedback show topics where the system keeps failing to find anything, and ingestion metadata can alert owners when a policy or architecture decision record has not been updated in over a year.

When retrieval finds nothing relevant, the system should say that it does not know from internal data, and it should not fall back to the model's public knowledge, which reintroduces the hallucination risk. Offer a next step instead, such as "I couldn't find internal documentation on resetting the staging database. Would you like me to ping the DevOps channel in Slack?" When two documents contradict each other, weight official documentation repositories above informal chat, and archive outdated pages based on feedback. A thumbs-up or thumbs-down on each answer shows which queries need better documentation. Track query volume, the share of queries resolved without human intervention, and the time saved against searching several systems or interrupting colleagues.

Where to start

Pick one high-value use case, such as engineering onboarding or IT support, and pilot it with the sanctioned account already in place. Run the oversharing audit on the sources it needs, write the golden set from real questions, and expand when employees trust the answers enough to stop asking colleagues first.