Private Deployment Versus Privacy Mode How to Tell the Difference

A privacy-focused alternative to ChatGPT can mean an assistant that does not train on your conversations or a model that runs entirely inside infrastructure you control. Those are different protections. Privacy mode governs a vendor’s use of your data, while private deployment keeps that data within infrastructure you control. The right choice depends on which exposure you need to prevent.

Why "private" in AI means two entirely different things

A sales page offers “privacy mode,” while an IT memo proposes “private deployment.” Encountering both in the same procurement cycle, a reader could reasonably but incorrectly assume they describe different strengths of the same protection. One changes the rules governing a vendor’s handling of data, while the other changes the infrastructure through which that data moves.

That difference changes the question a buyer must answer. Is the concern “how does the vendor use my data?” or “does the vendor ever see my data at all?” An organization can negotiate a satisfactory answer to the first question without resolving the second. If it confuses the two, it can mistake a revised contract for the removal of an exposure.

What does privacy mode actually do to keep your ChatGPT data private?

Privacy mode is a legal and contractual instrument. It typically works through Data Processing Addendums and no-training clauses, which restrict what a vendor may do after data arrives. Those restrictions have genuine value. A commitment not to use conversations for model improvement addresses a specific concern about their reuse. It does not, however, stop those conversations from traveling to and being processed on the vendor’s infrastructure.

Retention is a separate question from training. Standard storage windows for abuse monitoring can persist even when training opt-out is active, and only Zero Data Retention eliminates that storage window. Feedback creates another distinction between plans. On personal plans, namely Free, Plus, and Pro, thumbs-up or thumbs-down feedback can return a particular conversation to the training pool despite an enabled training opt-out. OpenAI states clearly that response feedback on Business, Enterprise, and Edu plans does not allow it to train on that conversation.

The enterprise label also needs closer examination. HIPAA compliance requires a Business Associate Agreement that names a specific eligible product, and a self-serve or unconfigured enterprise plan alone does not meet that requirement. Eligible arrangements include the API with Modified Retention, ChatGPT for Healthcare, ChatGPT Enterprise with Regulated Workspace, or Claude Enterprise with HIPAA activated. The named product and its configuration determine the protection.

Vendor commitments have nevertheless become stronger. OpenAI reaffirmed full zero data retention for enterprise customers in August 2026 and previewed Private Safety Processing. Anthropic followed in September 2026 with Enterprise Frontier Safeguards, offering privacy on par with zero data retention and a choice to store monitoring data inside businesses’ own cloud accounts, with zero data retention for eligible customers until their turn in the phased rollout. These changes narrow the practical gap between the two approaches. Yet inference still transits vendor infrastructure, so stronger handling commitments do not by themselves create private deployment.

What private deployment actually means across its three main forms

Private deployment starts with a different condition. The model runs inside an infrastructure boundary the organization controls, and data stays within that boundary during inference or fine-tuning regardless of a vendor’s policy decisions.

The three main forms offer different degrees of isolation. A private-cloud or VPC deployment places the model on dedicated, isolated infrastructure inside a cloud account the organization controls, with data logically segregated rather than processed on the provider’s shared infrastructure. An on-premises deployment runs on hardware the organization owns in its data center, giving it control of the full stack without public-internet transit for inference. An air-gapped deployment has no external network connections, so it offers the strongest isolation for the most sensitive workloads.

“Private” also means something broader than “local.” A local LLM runs on a single machine, while a private LLM can run on one laptop, an on-premises GPU cluster, or a private-cloud VPC serving an organization. Most practical private deployments use open-weight models such as Llama, Mistral, Qwen, and Gemma, whose weights can be downloaded and hosted within that boundary. The model name alone proves nothing about the deployment. The same model accessed through a hyperscaler’s shared API is not private, while running it on an on-premises server can be. In a genuinely private deployment, conversations do not feed a vendor’s improvement pipeline because that pipeline is absent from the data path.

The Samsung arc: what happens when the distinction is missed, and what it takes to correct it

Samsung’s experience between 2023 and 2026 shows how an organization can move from uncontrolled public-tool use toward a deliberate mix of deployment models. It already had policies against sharing confidential information externally. The exposure incident was therefore not simply an absence of rules. The public tool’s interface made it easiest to share data outside the organization, and the ban that followed blocked access but did not yet give staff a private alternative.

The next step changed the available architecture. Samsung Research unveiled Samsung Gauss on 8 November 2023, with language, code, and image models that employees were already using to help them work. Internal model development provided a route toward private deployment rather than relying solely on restrictions around public tools. That distinction is central to the story.

The destination was not a permanent external-AI ban. Samsung’s DX division announced official use of ChatGPT, Gemini Enterprise, and Claude on 11 June 2026, under managed enterprise tiers, while retaining Gauss because of its integration with internal systems. The resulting arrangement paired a private internal model for sensitive, integrated workflows with external tools for appropriate use cases. Samsung was not alone in recognizing the initial exposure, as Bank of America, Citi, Deutsche Bank, Goldman Sachs, Wells Fargo, and JPMorgan had all restricted staff ChatGPT use before May 2023. Samsung’s later configuration shows what can follow that restriction when data sensitivity, rather than a blanket position on external AI, guides the decision.

The real objection: private deployment can fail too, just differently

An infrastructure boundary is not automatically an effective one. “Private” on an architecture diagram cannot establish that every component handling sensitive information stays inside it. A self-hosted model may still send telemetry to the vendor of the model or the vendor of its serving software. A VPC-isolated endpoint may also call an external embedding API, reintroducing third-party exposure through the retrieval layer.

Prompts, uploaded documents, logs, vector databases, and third-party integrations can all become leakage paths. Misconfiguration, excessive permissions, and weak logging can undermine an otherwise suitable architecture. Who controls those components, and where do they send information?

The strongest objection is therefore a practical one. A well-governed enterprise API contract may be safer than a misconfigured on-premises GPU cluster, because the former has a vendor’s security team behind it while the latter depends on the organization’s operational discipline. That is not a minor qualification. Private deployment transfers responsibility as well as control. Its failures are operational problems the organization can audit and fix, whereas a privacy-mode gap leaves it dependent on vendor decisions, tier structures, and policy interpretations it cannot directly control or verify.

How to map the distinction to an actual deployment decision

A team choosing between models described as “private” should start with its data classification and acceptable risk. A useful decision test examines five things, including data sensitivity, the inference boundary, contractual coverage, operational control, and workload economics.

The first question concerns what the assistant will receive. For non-sensitive data, prototyping, and low-volume experimentation, public APIs with appropriate enterprise tiers are reasonable and often cheaper. Privacy mode can provide the right protection for that risk. Confidential business information, regulated data, and proprietary intellectual property need a different kind of protection when the data cannot be exposed at all. In those cases, private deployment removes dependence on contractual promises for keeping the data away from a vendor.

The second question concerns where inference happens. Does the model run in a controlled VPC, on owned hardware, or in an air-gapped environment, or does a hosted service process the request? This identifies the actual deployment category. It also directs attention to embedding services, telemetry, and integrations that could cross an otherwise private boundary. For a buyer seeking an assistant without surrendering personal data to a hosted model provider, locally running an open-weight model belongs to a different category from choosing a hosted assistant with training disabled.

A team accepting vendor-side processing needs to distinguish training exclusion from retention, understand the treatment of feedback, and identify the product and configuration named in any required agreement. The EU AI Act adds rules to consider, but teams still need to check the product itself. Rules for General-Purpose AI providers applied from 2 August 2025, with transparency obligations and GPAI enforcement from 2 August 2026. The Digital Omnibus on AI deferred high-risk obligations to 2 December 2027 for Annex III and 2 August 2028 for Annex I. Teams therefore need to check both the obligations that apply and the named product or tier, even with a broad promise of enterprise compliance.

Can it audit the leakage paths, control permissions, and correct misconfiguration? Ownership alone does not answer that question. A private deployment is appropriate only when its operational demands are considered as seriously as the vendor dependencies it removes. Conversely, a managed API deserves credit for the security capability behind it alongside scrutiny of its contractual limitations.

The fifth decision test weighs whether utilization is high enough or compliance requirements are strict enough for private deployment to be worth its cost compared with managed APIs. Below that threshold, provider APIs are usually cheaper than idle GPU capacity, and low utilization can substantially increase cost per token. A private deployment can serve sensitive, regulated, high-volume work while a public API supports non-sensitive prototyping, as the logic of Samsung’s 2026 configuration illustrates.

The durable principle: architecture outlasts policy

Contract terms can change, tiers can be restructured, and training-exclusion settings can differ after renewal. An architectural boundary has no such renewal date, though it still needs to be run well. For non-sensitive work, a vetted vendor and a fully understood tier may be sufficient. When the data itself is the asset and exposure is unacceptable, the decisive question is not “does the vendor promise privacy?” but “where does inference happen, and who controls that environment?”