How to export your data from ChatGPT Enterprise

How to export your data from ChatGPT Enterprise: what leaves and what stays

If you are facing a renewal, an exit decision or a residency requirement, the answer to the export question is this: the documented path is the Enterprise Compliance API, which gives workspace admins an audit log of conversations and GPTs. Admins can also view, export and delete end user conversations from the workspace itself. That is the starting point for any move, but it is not a full backup of everything OpenAI holds. Treat the Compliance API as the record you can pull for your own governance, and confirm with OpenAI in writing exactly which objects, fields and time ranges your plan returns before you plan a cutover.

Before you start, map what you actually need to keep. Conversation records and GPT definitions are the objects the Compliance API is documented to cover, so check whether your audit trail, file attachments, uploaded knowledge files, workspace memberships and admin settings come out in a usable form. Ask OpenAI which of these are included, in what format, and whether deleted conversations are retrievable during the window before OpenAI's stated 30-day removal of deleted conversations. Also confirm what happens to data under legal hold, since OpenAI's privacy page notes that retention can be overridden where the law requires it. Anything your team needs but the export leaves out should be recorded from your own side, such as prompts saved in internal tickets or documents in your file stores.

Exporting data is a separate project from running a replacement. An export gives you records to store, search and review, but it does not give you a working assistant, a login system or a model. Once the records are in hand, you still need to decide where conversation history will live, who can read it, how long it is kept and which model endpoints will answer new questions. Check the OpenAI enterprise privacy page for the current retention and training statements, and confirm the residency terms in the OpenAI help center article on data residency if your requirement is regional. Plan the replacement and the export together, so that the imported history lands in a system that already has your access and retention rules in place.

Which ChatGPT Enterprise data you can export and how

This table compares each category of ChatGPT Enterprise data by export method, format and known limits, so you can see what the documented paths cover. Where the supplied documentation is silent on format, row limits or pagination, the table tells you what to confirm before you start. The main takeaway is that conversations and GPT records come out through the Enterprise Compliance API, while format and paging details must be checked in your own workspace.

Data type	Export method	Format and limits
End user conversations	Admins view, export and delete through the workspace admin tools and the Enterprise Compliance API audit log	Confirm the file format, field set and any row or pagination limits with OpenAI before a full export
GPT records	Admin audit log of GPTs through the Enterprise Compliance API	Confirm whether instructions, uploaded knowledge files and action settings are included, since these may need separate handling
Admin-initiated conversation export	Workspace admin exports end user conversations, which OpenAI documents as an admin capability	Confirm who can trigger it, whether users are notified and how long a job takes in your workspace
Deleted conversations	Removed from OpenAI systems within 30 days unless legally required to keep them	Export deleted items before the window closes if you need them, since they may not be recoverable afterward
Uploaded files and attachments	Not described in the documented export paths reviewed for this page	Ask OpenAI whether files attached to conversations are included in any export and in what form
Workspace settings and member lists	Handled through admin settings and SAML SSO records rather than a conversation export	Export identity and group mappings from your identity provider, not from ChatGPT

What the export does not cover and how teams work around each gap

The Compliance API gives admins a documented path for conversations and GPT records, but it does not return everything a workspace generates. The cards below cover the gaps that matter most when you plan an exit, and the copies, records and written confirmations your team should hold before cutover.

Uploaded files and attachments

Files users upload into a conversation or project are a separate asset from the chat text around them. Confirm with OpenAI whether the audit and export path returns the original file bytes or only references to them. Keep your own copies of any file that a team relies on, with its owner, source location and date, so the knowledge does not depend on a link that may stop resolving after cancellation.

Custom GPT instructions and tool settings

The instructions, knowledge files, action definitions and sharing settings of each custom GPT live in the workspace, and conversation exports do not recreate them. Before exit, record each GPT's system prompt, attached files, connected actions and the groups allowed to use it in a version-controlled document. These records become the specification for the LibreChat agents or Open WebUI presets that replace them.

Deleted conversations past the retention window

OpenAI states that deleted conversations are removed from its systems within 30 days unless legally required. Anything deleted before the export ran, or deleted by a user and purged on schedule, is outside what you can retrieve later. Ask your admins to export before changing retention settings, and document the date each retention policy took effect so you can explain gaps to auditors.

OpenAI-side system and abuse data

Logs that OpenAI keeps for security, abuse monitoring and service operation are not the workspace conversation record, and the Compliance API does not expose them. Model weights and training behavior are also outside your reach. Ask OpenAI in writing what it retains about your workspace, for how long and under which legal basis, and file the answer with your data processing records. Do not assume that a clean export means nothing remains with the vendor.

Data outside the workspace scope

Personal accounts, unmanaged workspaces and conversations started before a user joined the Enterprise workspace may sit outside the admin export. Check which accounts were ever linked to the company domain, and ask users to report personal chats that contain company material. Include these accounts in your access review and state in the migration plan which sources were searched and which were out of reach.

Model behavior and prompt context

Exported conversations show what was asked and answered, but not the hidden system instructions, model version or retrieval state that shaped each reply. A migrated history will read differently from the original sessions when replayed on another model. Record the model names used by each team and the date of the switch, so reviewers can separate the original answers from any answers generated after cutover.

The export sequence, from access to verified copy

This sequence moves ChatGPT Enterprise conversations and GPT records into a copy you control, with checks at each stage so nothing is deleted or cancelled before the copy is proven complete. It produces an encrypted raw export, a counts and checksum record, and a sampled comparison against the source.

Confirm admin roles and Compliance API access
A workspace owner or admin confirms who will run the export and that Compliance API access is enabled for the workspace, since OpenAI documents the Compliance API as the export path for Enterprise data. Ask your OpenAI account contact to confirm the exact access settings and any required enablement for your plan, and record the named admins and their roles. Done means you have a written list of exporting admins and a successful test call that returns workspace data without errors.
Freeze retention changes during the export
Before pulling data, the admin team agrees in writing to stop changing retention settings, bulk deletions and user offboarding until the export is verified. OpenAI's enterprise privacy page says admins control retention and that deleted conversations are removed within 30 days unless legally required, so a deletion made mid-export could remove records you still need. Record the current retention configuration and the time of the freeze. Done means the settings snapshot is saved and the change freeze is communicated to every admin.
Pull conversations and GPT records
An admin runs the export through the Compliance API for conversations and GPT records, scoped to the full workspace or to the user and date ranges your policy requires. Keep the request logs, since they show what was requested and when. Confirm with OpenAI what the export includes, such as attachments, file contents, shared links and deleted items, because the documentation available to us does not settle every object type. Done means each request has finished and returned a response you can account for.
Store the raw export encrypted under your control
Write the raw output to storage your organization controls, such as an encrypted volume or object store in your own cloud account or data center, with access limited to a named group. Do not edit, reformat or convert the files at this stage, so the raw copy stays a faithful record. Encrypt at rest and restrict access logging to the same group. Done means the files are in the controlled location, the access list is recorded, and a second admin can open the files.
Record counts and checksums
Generate a manifest that lists every exported file with its size and a SHA-256 checksum, plus record counts for conversations, messages, GPT records and users. Compare the counts with the figures shown in the admin console for the same scope and date range, and explain any gap in writing. Store the manifest beside the export and give a copy to the reviewer. Done means the counts reconcile or each difference has a documented reason, and the checksums can be recomputed later to show the files have not changed.
Sample conversations against the source
Select a random set of conversations across several users, including long threads, conversations with uploaded files and any that were shared or moved between workspaces, then open each one in ChatGPT Enterprise and compare it with the exported record. Check message order, timestamps, speaker roles and attachment references. Note any mismatch and rerun the export for that scope if needed. Done means every sampled conversation matches the source, with the sample list and the reviewer's sign-off kept with the manifest.
Confirm completeness before any deletion or cancellation
The admin lead and the data owner sign a completion record that lists the export scope, the manifest, the checksum verification, the sampling results and the location of the controlled copy. Only after this sign-off should anyone delete conversations, remove users, change retention or cancel the subscription. Confirm with your legal and records teams whether any hold applies, since OpenAI's retention commitment allows exceptions where the law requires them. Done means the signed record exists and a second copy of the export is stored in a separate location.

Where the exported history can land, by target

LibreChat is the target most directly aligned with a ChatGPT export, because its README lists conversation import and export among its features. Teams can keep a familiar chat layout while moving history into a store they operate. Confirm how the importer handles the export file layout in the release you deploy, since the importer is the part most likely to change between versions.

What it imports: Conversation history from a ChatGPT export, as a documented feature. Check in a test run which message content, attachments and timestamps survive.
What it does not import: Custom GPT definitions, uploaded knowledge files and admin-side audit records do not convert into LibreChat agents automatically. Rebuild agents by hand and keep the original export as the record.
How users sign in: OAuth2, LDAP and email login, with an admin panel for user and configuration management.
Who holds the database: The reference docker-compose file runs MongoDB, Meilisearch for search and a separate RAG API. Conversations sit in MongoDB on your servers, so backup, retention and deletion are your responsibility.

Check message counts, dates and user mapping in a sample import built from your own export before committing to this target.

How to verify the export is complete before you delete anything

Do not delete anything from the ChatGPT Enterprise workspace until the self-hosted copy has passed a reconciliation you can document. Start with record counts by date range and by user. Pull the number of conversations per user per week or month from the Compliance API export, then count the same records after import into your chat interface, using the user identifiers and timestamps that survive the import. Any gap in a bucket is a finding to explain before proceeding, not a rounding issue. Confirm with OpenAI which fields the export carries (titles, timestamps, model names, deleted flags) because those determine which counts you can match exactly.

Next, sample conversations at random and compare them message by message against the imported copy. Check that message order, roles, edits and file references match, and that long threads were not truncated. Then check GPT records separately: list every custom GPT in the export, confirm its instructions and configuration were captured, and confirm each attached file exists in your storage with a matching checksum. Missing attachments are the most common silent loss, so treat a GPT with unresolved files as incomplete. Keep the reconciliation output, sampling method and reviewer names in the same evidence folder. Finally, keep an audit trail of who ran each export. Record the admin account, the date and time, the scope requested, the export file hashes and any re-runs. Deletion is irreversible from the workspace side once an admin removes conversations, and OpenAI's privacy statement says deleted conversations are removed from its systems within 30 days unless legally required. That window is OpenAI's stated limit, not your recovery window, so the verified copy you hold is the only copy you can rely on. Have a second person sign off before any deletion request is submitted.

What to plan before the ChatGPT Enterprise contract ends

An export is only one step in leaving ChatGPT Enterprise. The cards below cover the contract clock, retention settings, regional storage, the people who will move, and the written record of deletion. Confirm every contract term with your procurement or legal team rather than assuming it.

Notice period and renewal date

Find the notice period and auto-renewal terms in your order form and master agreement, then set the export deadline backward from them. Procurement or legal owns this task, and the effort depends on how many workspaces, seats and data sources you must extract before the cutoff. Ask OpenAI's account team in writing whether any export or retrieval window closes at the end of the term, and confirm that the Compliance API access you need stays available until then.

Retention setting review

Record the retention setting currently applied to the workspace before you change anything. Admins control retention, and deleted conversations are removed from OpenAI's systems within 30 days unless legally required, so a retention change made during the cutover can remove history you still need. The workspace owner should document the setting, the date it changed, and who approved it.

Data residency check

If your workspace uses a regional data residency setting, identify the region where in-scope content is stored at rest and whether inference residency applies. The compliance or data protection lead owns this check. Confirm with OpenAI which region your workspace uses, and make sure the target self-hosted stack and any model endpoints sit in a location your policies allow.

User communication and cutover

Users need to know when the old workspace goes read-only, where their history will appear, and which custom GPTs or files will not move. The IT service owner or platform lead runs this card, and the effort grows with the number of active users and the number of custom GPTs in use. Plan a dated cutover, a pilot group, and a short guide on exporting anything personal that will not be migrated.

Written request on deletion confirmation

Ask OpenAI in writing how it confirms that deleted conversations and workspace data have been removed, and what evidence it provides for that deletion. The security or privacy lead owns the request and should keep the reply with the contract file. Also confirm which deletion or retention records you may need for your own audit trail, since an export alone does not prove the source data is gone.

Questions teams ask before they export ChatGPT Enterprise data

How much effort does a ChatGPT Enterprise data export take?

The effort depends mostly on how much data the export covers and how cleanly you need it to land. The documented path is the Enterprise Compliance API, which gives admins an audit log of conversations and GPTs, so the work starts with pulling that data for every user in scope. Effort rises with the number of users, the total conversation volume, how many conversations contain attachments or uploaded files, and how many custom GPTs need to be recreated elsewhere. A workspace with a small user base and short histories is a much smaller job than one with years of conversations spread across many teams. Ask OpenAI and your own compliance team to confirm exactly which record types the API returns for your plan and what format they arrive in before you size the work.

How long does planning and running the export take?

No fixed duration applies to every workspace, so treat any single number with caution and confirm timing with OpenAI and with whoever runs the target system. Planning usually takes longer than the transfer itself, because someone must decide which users, time ranges and data classes are in scope, who approves the retention position, and where the exported records will be stored. Run time then scales with the same drivers as effort: user count, conversation volume and attachments. Build in time for a test export of a small group, a review of what came out, and a second pass for gaps. Ask OpenAI how long Compliance API requests typically take for an account of your size and whether any access approval step applies.

Can an internal team run the export without outside help?

Yes, an internal team can run the export if it has someone comfortable with API calls, data handling and the target platform. The export itself is a sequence of API requests, followed by checks on completeness and a load into the new interface. The harder parts are usually governance and verification: confirming which users and conversations belong in scope, documenting what was deleted or excluded, and proving that the target copy matches the source. Teams without those skills in-house often bring in an implementation partner for the planning and validation steps while keeping the data handling inside their own accounts. DeployOpen plans, implements and documents self-hosted platforms in the client's own infrastructure under a written, fixed scope, so that option is available if internal capacity is short.

What access and decisions does the export require from the admin?

The export requires a workspace admin with the right to view, export and delete end user conversations, and the ability to reach the Enterprise Compliance API. Before any data moves, the admin should confirm with legal and security who is authorized to see conversation content, because exports include what employees typed and received. The admin also needs to decide retention on the destination side, since OpenAI's documented deletion window of 30 days applies to its own systems and not to copies you take. Keep a written record of the export scope, the date it ran, who approved it, and how the output was stored, so auditors can trace each step later.

Do we need a consultant or implementation partner for this?

A consultant is not required, but one is useful when the export must satisfy audit, legal hold or data protection requirements that your team has not handled before. The engagement that helps most is usually scoped around planning, the destination platform and validation evidence rather than a generic data move. Ask any partner to put the scope, deliverables, timeline and fees in writing before work starts, and to state which parts remain your responsibility. DeployOpen works on fixed scopes agreed in writing and does not publish a price list, so you would receive a quote that follows from that scope. Ongoing support and upgrades of the destination stack are separate retainers, and you should ask about them explicitly.

Can exported ChatGPT conversations be imported into LibreChat or Open WebUI without custom work?

LibreChat documents conversation import and export among its features, and the migration guidance for LibreChat covers importing ChatGPT conversation exports, so an import path exists. Open WebUI is also a common destination for conversation history, but whether a given export file loads directly depends on the format your workspace produces and the version you run, so test with a sample before committing. Expect some custom work where the export does not carry everything you need, such as custom GPT instructions, file attachments or user-to-group mapping, which must be recreated as agents, knowledge collections or model presets. Confirm the exact import behavior with the LibreChat and Open WebUI documentation for the release you plan to deploy and run a test import on a copy of real records.

What does the export leave out that teams often miss?

The export typically misses anything that is not an audit record of conversations and GPTs, so plan for gaps before you rely on it. Items that teams often forget include uploaded file contents held separately, workspace settings, SSO and group configuration, and the instructions and knowledge files attached to custom GPTs. Verify each category with OpenAI against the Compliance API documentation for your plan, and record what you could not retrieve. Those gaps decide whether the destination is a faithful copy or a partial archive, and they should be written into the scope before the export starts.

Does the export also cover data residency and where copies end up?

The export moves data out of OpenAI's regional storage, so the destination location becomes your responsibility. OpenAI's data residency for ChatGPT stores in-scope content at rest in a selected region for eligible customers, but once you export, that data sits wherever you put it. Choose a destination that matches your residency and retention policies, and confirm that backups and logs follow the same rules. Keep the export out of general file shares and restrict access to the people named in your approval record.

How DeployOpen scopes and delivers a ChatGPT Enterprise data exit

DeployOpen plans and delivers the move of ChatGPT Enterprise history into a self-hosted chat interface inside your own infrastructure. We start from a written scope that names which conversations, GPT records and audit data are in and out, then build, test, document and hand over the result.

How we scope

Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
The written scope lists which conversations, GPT records and audit log entries retrieved through the Compliance API are included.
We confirm which content the export leaves out, such as files, memory or other items your admins must collect separately.

How we build

We deploy the chosen self-hosted interface in your cloud account, data center or air-gapped network, with the database kept under your control.
We convert retrieved ChatGPT exports into the import format of the target interface and test a sample set before full import.
We configure SSO, user groups and admin access so imported history is visible only to the users who should see it.

How we hand over

You receive documentation covering the export steps, import mapping, retention settings and the record of what moved.
We provide a reconciliation report comparing exported conversation counts with imported counts, with any gaps listed.
We walk your administrators through backup, restore and deletion procedures so retention decisions stay with your team.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover.
Upgrades to the self-hosted interface are planned and tested against the imported data before they reach production.
We prepare systems, controls and evidence for your compliance assessments, while independent auditors issue any audit reports or attestations.

How to export your data from ChatGPT Enterprise