Loading
Every AI tool directory scores products; almost none score them on governance. This is a first pass at the question risk and compliance teams actually ask before approving a tool: what does the vendor itself document about data training defaults, retention, residency, certifications, admin controls, agent permissions, audit logging and transparency, and where does that documentation go quiet.
Last updated 27 July 2026 · Sourced from each vendor's own trust centre and product documentation, per cell.
This is deliberately not a single "safety score." Three statuses appear per cell: Documented means we found a clear, sourced vendor statement or feature. Partly documented means we found something, but with a real gap (for example, a control that exists but requires an NDA to verify). Not confirmed means this pass did not turn up a citation for that specific control on that specific tool, and nothing more. It is a gap in our research this pass, not a claim that the vendor lacks the control, several vendors below almost certainly have documented answers we simply have not sourced yet.
No tool here paid for placement or a better result, and there are no referral or affiliate links on this page. See editorial standards for how we verify what we publish. Spotted a gap or an error, or work at one of these companies and can point us to a better source? Tell us, corrections get investigated and published promptly.
| Governance axis | ChatGPT Enterprise OpenAI · as of 27 Jul 2026 | Microsoft 365 Copilot Microsoft · as of 27 Jul 2026 | Gemini Enterprise (Workspace) Google · as of 27 Jul 2026 | Claude Enterprise Anthropic · as of 27 Jul 2026 |
|---|---|---|---|---|
Trains on your data by default Whether customer prompts/content are used to train the vendor's models without an opt-in | Documented Not used to train OpenAI's models by default; customers must explicitly opt in to share data for training. OpenAI, Enterprise privacy | Documented Prompts, responses and data accessed through Microsoft Graph are not used to train the foundation LLMs behind Microsoft 365 Copilot. Microsoft Learn | Documented Enterprise data used within Gemini for Workspace is not used for model training and is not reviewed by humans, per the Google Workspace Trust Center. Google Workspace Blog | Documented Anthropic does not train Claude on inputs or outputs from any paid plan (Team or Enterprise) by default. Claude Help Center |
Data retention control Admin control over how long conversation data is kept, including any zero-retention option | Documented Workspace admins set data retention and can pull a full conversation/GPT audit log via the Enterprise Compliance API. OpenAI, Security and privacy | Documented Admins set retention policies specifically for Copilot chat interaction data through Microsoft Purview, and users can delete their own Copilot activity history from the My Account portal. Microsoft Learn, retention for Copilot | Documented Admins control whether Gemini conversations are saved and for how long (up to 36 months) and manage retention via Vault. Google Workspace Help | Documented Team defaults to 30-day retention; Enterprise customers can add a Zero-Data-Retention addendum so conversation data is never written to disk. Claude Help Center |
Data residency / sovereignty Documented options to keep data or inference within a chosen region | Documented Data residency has been expanded to business customers in multiple regions worldwide. OpenAI | Documented EU Data Boundary coverage for EU tenants, in-country processing being extended to 15 more countries, and an admin-controlled "Flex Routing" toggle to keep inferencing inside the EU boundary. Microsoft 365 Blog | Not confirmed A Gemini-specific data-residency citation was not sourced in this pass. Google Workspace Help | Not confirmed A Claude-specific data-residency citation was not sourced in this pass. Anthropic Trust Center |
Independent certifications SOC 2, ISO 27001, ISO 42001, HIPAA and similar third-party attestations | Documented SOC 2 Type II (report period Jan-Jun 2025), ISO/IEC 27001:2022 and ISO/IEC 27701:2019. OpenAI Trust Portal | Documented GDPR, ISO 27001, ISO 42001 and HIPAA supported through Microsoft's compliance framework; DPA published via the Microsoft Trust Center. Microsoft Learn | Documented SOC 1/2/3, ISO 27001, ISO 27701 and ISO 42001. Google Workspace Updates | Partly documented ISO 42001 certified; SOC 2 reports and other audit artefacts are available to enterprise customers on request via the Trust Center rather than published self-serve. Anthropic |
Admin identity & access controls SSO, SCIM provisioning, role-based access control | Partly documented Workspace admin roles are documented; specific SSO/SCIM provisioning detail was not confirmed in sources reviewed this pass. OpenAI, Work admin FAQ | Partly documented Flex Routing is an admin-level control; a Copilot-specific SSO/SCIM/RBAC citation (as distinct from Microsoft 365 generally) was not sourced this pass. Microsoft 365 Blog | Documented Admins can disable Gemini org-wide or per organisational unit, and apply DLP / Information Rights Management controls to restrict its access to sensitive files. Google Workspace Help | Documented Enterprise tier includes SSO with domain capture, SCIM provisioning, and role-based access with a designated workspace owner. Anthropic, Claude Enterprise |
Agent / tool-action permission model Whether admins can scope what an AI agent is allowed to do or access | Documented Admins set per-action rules on custom GPT/agent actions (allow all, read-only, or a custom allow-list) and can restrict actions to specific domains. OpenAI Help Center | Documented Admins review each agent's required permissions and data access in the Integrated apps section of the Microsoft 365 admin center and control which agents are allowed in the tenant; users can only use agents an admin has allowed. Microsoft Learn, Copilot privacy | Not confirmed A Gemini-specific agent/tool-action permission model citation was not sourced in this pass. Google Workspace Help | Documented Permission policies control whether each agent and MCP tool executes, with per-tool always_allow and always_ask settings and allow/deny confirmations. Claude Platform Docs, permission policies |
Audit logging of AI activity A reviewable log of prompts, actions or agent activity for compliance/security teams | Documented Enterprise Compliance API exposes an audit log of conversations, GPTs and agent use. OpenAI, Security and privacy | Documented Copilot prompts, responses and the citations returned with them are stored, and admins can view and manage that data through Content search or Microsoft Purview. Microsoft Learn, Purview for generative AI | Partly documented Drive inventory reporting gives visibility into data access; a dedicated Gemini activity audit log was not separately confirmed in this pass. Google Workspace Help | Documented Audit logs are included in the Enterprise tier for tracing system activity. Anthropic, Claude Enterprise |
Public trust-centre transparency Whether compliance documentation is published self-serve or requires a request/NDA | Documented Self-serve, live compliance documentation on the OpenAI Trust Portal (SafeBase). OpenAI Trust Portal | Documented DPA and compliance documentation published via the Microsoft Trust Center. Microsoft Learn | Documented Compliance reports available on request via Google Cloud's Compliance Reports Manager. Google Cloud | Partly documented A subprocessor list and security documentation are published; full SOC 2 reports require a request under NDA rather than self-serve download. Anthropic Trust Center |
General information, not procurement or legal advice. AI vendor documentation changes frequently; verify current detail against the linked primary source before relying on it in a vendor risk assessment.
No affiliate or referral links appear on this page, and none of the vendors compared have any commercial relationship with AIRiskAware. If that ever changes for a future version of this comparison, it will be disclosed per link, not buried in a footer.
This page is a pilot, published as at 27 July 2026, and will be revised as we source deeper primary documentation for each tool. It is general information, not legal or procurement advice, and not a certification or endorsement of any product.