ChatGPT Alternatives for Businesses: Data Processing, Training and Contract Compared

Using ChatGPT in the team, but keeping data, instance and contracts in your own hands? The WZ-IT AI platform runs as your own instance on your own domain, with models operated in Germany by German providers, a DPA and the Section 203 supplementary agreement from the smallest package. Book an initial consultation

In the search results for "ChatGPT alternative business" and "ChatGPT alternative GDPR", four questions recur: where are inputs processed? Are they used for training? Which contract applies? And who runs the system?

This article sets twelve offers side by side: ChatGPT Business and Enterprise as the starting point, plus Microsoft 365 Copilot, Google Gemini, Claude, Mistral Vibe, three platforms from German providers, the open interfaces Open WebUI and LibreChat and the WZ-IT AI platform. The statements link to the providers' own pages. As of 11 November 2026. WZ-IT offers an AI platform itself and is therefore included in the tables.

Table of contents

• Short answer: four kinds of ChatGPT alternatives
• Comparison of the offers in three tables
• The offers in detail
• Legal framework in three checks
• Decision guide by situation
• Common misconceptions
• Status and methodology
• Our approach at WZ-IT
• Further guides
• Sources

Short answer: four kinds of ChatGPT alternatives

Comparison of the offers in three tables

All three tables have the same row order. "No statement" means: not found on the pages checked (as of 11 Nov 2026). Prices are shown as the provider states them; currencies are not converted.

Table 1: price and contracting party

Table 2: processing, training and contract

Table 3: sign-in, administration and hosting

The offers in detail

ChatGPT Business and Enterprise

Business costs USD 20 per user and month for standard seats on annual billing and USD 25 on monthly billing, premium seats USD 100 and USD 125 respectively. Business is available from two seats and, since 24 August 2026, with at most 200 paid seats per subscription; workspaces created earlier keep their previous limit. Inputs are not used for training by default; contractually this is in the Services Agreement. A DPA can be executed via an online form; the contracting party in the EEA is OpenAI Ireland Ltd.. The sub-processor list names Microsoft, Amazon Web Services and Google Cloud, among others, for Business. SSO via SAML and OIDC is included, SCIM is not. Ads appear only on the Free and Go plans, according to OpenAI.

Enterprise has no list price ("Custom pricing"). Data residency is included at no additional cost: new Enterprise customers can have content at rest stored in Europe (EEA and Switzerland), among other regions, and eligible customers can also run GPU inference in Europe. OpenAI itself names limits: non-GPU processing may still occur globally, some data is processed transiently outside the region, and account, billing and usage data and metadata are not covered. Enterprise also includes SCIM and role-based access control.

Microsoft 365 Copilot

Microsoft 365 Copilot is available as an add-on to a Microsoft 365 plan or in the Microsoft 365 E7 bundle. Copilot Chat, the web-based assistant, is available at no additional cost with eligible Microsoft 365 plans; advanced features are billed by usage. The Enterprise add-on costs EUR 26.00 per user and month on annual billing, Copilot Business EUR 21.84 monthly or EUR 18.20 annually, each plus VAT; until 31 December 2026, Copilot Business has a promotional price of EUR 15.60 for the first year. Copilot Business is designed for up to 300 users per tenant. Until now the add-on requires an eligible Microsoft 365 plan; from 1 December 2026, new Copilot offers can also be bought without a base subscription. In its documentation, the product is now called Microsoft Copilot.

On processing, Microsoft writes that EU traffic stays within the EU Data Boundary, but that worldwide traffic can also go to other regions for LLM processing. Anthropic models are excluded from the EU Data Boundary and disabled by default in the EU and the UK; for Copilot in Word, Excel and PowerPoint, the setting is enabled by default for tenants created after 25 March 2026. On 5 November 2026, Microsoft announced that it will bring the Claude models in Copilot into the EU Data Boundary by the end of 2026. For the search queries sent to Bing in web search, Microsoft is its own controller; the EU Data Boundary and the DPA do not apply to them. Prompts and responses are not used to train the foundation models. Copilot only surfaces data the user can at least view.

Google Gemini

At Google, Gemini is part of the Workspace plans: Starter EUR 6.80, Standard EUR 13.60 and Plus EUR 21.10 per user and month excluding taxes; the Gemini app is included at no additional cost according to the FAQ. The data region can be set to the US or the EU for data at rest (Business Standard and Plus: one policy for the whole organisation; policies for regional processing belong to Enterprise Data Regions). Business Starter is not in the edition list, and Gemini Notebook is excluded from region settings. Workspace does not use customer data to train models without the customer's prior permission or instruction. The Cloud Data Processing Addendum makes Google a processor; Google LLC is certified under the EU-US Data Privacy Framework.

Separate from this is Gemini Enterprise, its own subscription, in the Business edition "starting at $21 per seat per month"; the Standard, Plus and Frontline editions run via sales.

Claude Team and Enterprise

Claude Team costs USD 20 per seat and month on annual billing, USD 25 on monthly billing, excluding taxes, for 2 to 150 seats. Since 12 February 2026, Claude Enterprise can also be bought without a sales conversation: USD 20 per seat and month on annual billing, at least 20 seats, usage in addition at API rates.

On processing, Anthropic states that traffic may be routed to selected countries in the US, Europe, Asia and Australia, with storage in the US. We did not find EU data residency for Team and Enterprise; Anthropic names regional data storage via Amazon Bedrock, Google Vertex AI and Microsoft Foundry. Anthropic may not train models on Customer Content. The DPA is part of the Commercial Terms; the contracting party in the EEA is Anthropic Ireland, Limited. SCIM and audit logs exist only in Enterprise; the documentation names custom roles at group level for Enterprise.

Mistral Vibe

Mistral renamed Le Chat to Vibe on 28 May 2026. The Team plan costs USD 24.99 per user and month excluding taxes. Mistral AI is a French company based in Paris, and data is hosted in the EU by default. Training differs by plan: in Free and Pro it is on by default and can be opted out of; in the Team plan administrators can switch it off for the organisation; in Enterprise it is opted out by default. On all plans, feedback with a thumbs rating can permit the use of the rated input and output to improve the models. SAML SSO and audit logs exist only in Enterprise, as does deployment on premises or in a private cloud.

Langdock, innoGPT and DeutschlandGPT

The three providers are multi-tenant SaaS platforms with models from several vendors. A comparison of ten German providers with instance model, data path and Section 203 terms is in the article AI Platforms for Businesses Compared 2026 (as of 14 Oct 2026); the statements here are as of 11 November 2026.

• Langdock: Core EUR 23.20 annually, EUR 29.00 monthly, SSO, SCIM and SAML in every plan. According to its Terms, the platform runs in Frankfurt on Microsoft Azure; the DPA names Microsoft Ireland, Amazon Web Services EMEA, Google Cloud EMEA, OpenAI Ireland and Mistral AI as sub-processors, among others, plus Sentry and Cloudflare based in the US. Inference takes place outside the EU only for models with "global deployment" that are actively selected. A dedicated instance is available from 2,000 seats.
• innoGPT: EUR 25 monthly, EUR 22.92 annually, SSO at extra cost. The Trust Center lists 31 sub-processors, including AWS, Google Cloud, Microsoft Azure, OpenAI and Mistral AI. The pricing page says "keine Drittlandübermittlung" (no third-country transfer); the help centre on model choice describes tiers with global processing under high utilisation, and the help centre additionally describes models with transfer to the US based on standard contractual clauses (OpenAI API) and processing in the US (image models via Replicate). The trial phase is not Section 203 compliant.
• DeutschlandGPT: EUR 24 monthly, EUR 20 annually; SAML SSO, SCIM and the professional secrecy mode (Section 203 StGB) are included in the Business plan at no extra charge. The Trust Center names ten sub-processors, including T-Systems, Hetzner, Microsoft, AWS, Google, OpenAI and Mistral; AI processing at US providers runs via their EU subsidiaries. Audit log only in Enterprise according to the plan table.

Self-hosting Open WebUI and LibreChat

Neither interface runs chat models itself; they connect models via interfaces such as Ollama or OpenAI-compatible APIs. Where model inference takes place is therefore decided by the connected model; embeddings, text recognition, web search and other features can have their own processing paths. With Open WebUI, prompt and context can be visible to a configured external model provider.

Open WebUI is licensed under its own Open WebUI License, which the project documentation calls "not an OSI-approved 'open source' license". The branding clause has applied since version 0.6.6; under the current licence text (item 4), it prohibits altering, removing or replacing the "Open WebUI" branding, except with at most 50 end users within any rolling 30-day period, with prior written permission, or with an enterprise licence. Internal operation with visible branding is possible free of charge and without a user limit; the project does not state enterprise licence prices, which go through sales. More in the article Open WebUI License 2026. SCIM is documented, but the sales page lists SCIM among the enterprise features. The documentation also describes operation in an air-gapped network with an offline configuration; a standard installation by itself checks, among other things, the version at GitHub, which can be switched off. The audit log is off by default.

LibreChat is licensed under the MIT licence. ClickHouse acquired the project on 4 November 2025 and states that operations continue unchanged. The project supports OIDC, SAML and LDAP; we did not find SCIM in the documentation. We found an audit log for the granting of permissions, but no general audit log of chat usage.

With both, operation, updates, security and backups are the responsibility of the operating organisation or a service provider. We did not find hosting by the projects themselves.

WZ-IT AI platform

The AI platform is Open WebUI as a dedicated instance per organisation on its own domain, operated by WZ-IT, with models running in Germany with German providers. The packages cost net per month EUR 149.90 (Start, 10 users), EUR 399.90 (Team, 25), EUR 699.90 (Business, 50) and EUR 1,199.90 (Organisation, 100); each additional user costs EUR 14.90 (Organisation up to 150 users, above that an individual offer). SSO, DPA and the Section 203 supplementary agreement are included in the smallest package. A test instance runs for 7 days free of charge with non-critical data and is not Section 203 compliant. Open WebUI runs with its original interface; the branding stays visible.

Legal framework in three checks

The GDPR attaches to the specific processing, not to a product as such. Three points can be evidenced for each offer:

1. Data processing: If a provider processes personal data on your behalf, Article 28 GDPR requires a contract or another binding legal instrument. All SaaS offers in the comparison supply a DPA for this. With self-hosted interfaces, processing relationships arise with external service providers that process personal data on the operator's behalf, such as hosts, model providers or maintenance providers; fully self-run operation with local models and without external service providers needs no external processor.
2. Transfers to third countries: Processing in the EU and access from a third country are separate questions. OpenAI and Anthropic base transfers on standard contractual clauses, and OpenAI additionally names the adequacy decision; Microsoft (DPA) and Google LLC (transfer terms) state that they are certified under the EU-US Data Privacy Framework. Standard contractual clauses and the framework are transfer bases; whether a transfer is permitted in a specific case remains to be assessed.
3. Professional secrecy: The professional secrecy holders and public officials named in Section 203 StGB may involve contributing service providers as far as necessary for their work and must ensure they are bound to confidentiality, unless they are themselves among those named (paragraphs 3 and 4). A DPA alone is not enough; the contract chain is described in What is Section 203 hosting?.

In addition, the works council's co-determination right under Section 87(1) no. 6 BetrVG may apply; according to the case law of the Federal Labour Court, objective suitability for monitoring is sufficient.

Whether a specific use is permitted depends on data, purpose and legal basis and must be assessed by the using organisation, where appropriate with its data protection officer. This is not legal advice.

Decision guide by situation

A cloud workspace comes into question when contract, data classes and usage have been checked and no own operation is wanted. More on this trade-off is in Local AI or ChatGPT Business?.

Common misconceptions

"ChatGPT is not GDPR-compliant." The statement is as blanket as its opposite. For Business and Enterprise there is a DPA, no training on inputs by default and OpenAI Ireland Ltd. as contracting party in the EEA. Whether a use is permitted is for the using organisation to assess.

"An EU region means everything stays in the EU." The providers name exceptions themselves: with OpenAI Enterprise, non-GPU processing can take place globally; at Microsoft, Anthropic models and Bing web search are excluded; Langdock has models with "global deployment"; innoGPT has global processing under high utilisation; Mistral has temporary transfers depending on the feature.

"A German provider means no US group in the data path." The sub-processor lists of German platforms name Microsoft, AWS, Google and OpenAI, mostly via EU entities. The list decides, not the company seat.

"Open source means no licence questions." LibreChat is under the MIT licence. Since version 0.6.6, Open WebUI has been under its own licence with a branding clause that, according to the project documentation, is not recognised by the OSI as an open source licence.

"Self-hosted means automatically compliant with data protection." Even your own instance connects to the models the operator attaches and, depending on configuration, to further services such as version checks or web search. Data protection results from configuration, contracts and organisation.

"You can install your own ChatGPT." For ChatGPT, OpenAI names no variant in your own data centre. Open models such as gpt-oss-120b under the Apache 2.0 licence, however, run on your own hardware.

Status and methodology

• Status: 11 November 2026. Prices, plans and terms change often; the provider's page is authoritative.
• Selection: offers that recur in the search results for "ChatGPT alternative business" and "ChatGPT alternative GDPR" (Brave search, 11 Nov 2026) and that either have a business plan with data processing or can be self-hosted. Among German platforms, Langdock, innoGPT and DeutschlandGPT stand in for the group; further providers are compared in the article AI Platforms Compared 2026. Not included are, among others, Perplexity and DeepSeek; the columns of this comparison can be checked against the source for them as well.
• Sources: pricing pages, terms of use and contract terms, DPAs, sub-processor lists, trust centres, licence files and the providers' official documentation.
• Prices: as stated, list prices without discounts, not converted. Whether net or gross is not always stated explicitly (OpenAI: no statement; Anthropic, Google, Mistral: excluding taxes; Microsoft: plus VAT). OpenAI and Anthropic state US prices; regional prices can differ. Calculation for 50 users: number of users times price per user on monthly payment; this is not a total cost comparison, because contract term, included usage and scope of features differ.
• Negative statements: "no statement" and "not found" refer to the pages checked.
• Not assessed: answer quality, model strength and usability; these are better tested in trial phases than in tables.
• Transparency: WZ-IT is the provider of the WZ-IT AI platform; as with all providers, the information about it comes from its own offer page. Please report errors or changed information; we will update the tables.

Tables and figures may be reused with attribution and a link to this article.

Our approach at WZ-IT

The WZ-IT AI platform is built for organisations where data storage and contracts are decisive:

• Dedicated instance: no shared SaaS, but one instance per organisation on its own domain, with its own database, knowledge bases and groups.
• Models in Germany: gpt-oss, Qwen and Ministral run with a German AI hosting provider in Germany, with no US provider in the data path of documents, chats and models and no training on inputs. With web search enabled, only search terms without personal reference go to search engines.
• Contract chain: DPA with technical and organisational measures and Section 203 supplementary agreement from the smallest package.
• Operation to your requirements: hosted in Germany, optionally reachable only from your own network or via VPN, on premises on an App Node or with local models on the AI Cube.
• Interface: Open WebUI with web search, knowledge bases, assistants, dictation and SSO. If you only need hosting and operations for Open WebUI and connect models yourself, you will find that in the configurator.

For law firms, tax advisers and public administrations there are dedicated pages, such as AI for law firms and AI for public authorities.

Further guides

• AI Platforms for Businesses Compared 2026: GDPR, Section 203 and Data Storage
• Local AI or ChatGPT Business? Cost, control, and use compared
• Open WebUI, LibreChat, AnythingLLM & Co. Compared 2026
• Open WebUI License 2026: What the Branding Clause Means for Businesses
• Private ChatGPT for business: four operating models compared
• Shadow AI in companies: why a policy alone is not enough
• WZ-IT AI platform: dedicated instance, models in Germany with German providers

Dedicated instance instead of a shared platform, Section 203 from the smallest package? Test the WZ-IT AI platform for 7 days free of charge with non-critical data and clarify user numbers, sign-in and operating model in an initial consultation. Book an appointment

Sources

• ChatGPT: pricing and minimum size
• ChatGPT Business: data residency only in Enterprise
• ChatGPT Enterprise: roles and permissions
• OpenAI: business data and training
• OpenAI: Enterprise privacy and DPA
• OpenAI: Services Agreement
• OpenAI: Data Processing Addendum
• OpenAI: sub-processor list
• OpenAI: data residency and inference residency
• OpenAI: ChatGPT Business FAQ
• OpenAI: SSO for ChatGPT Business
• OpenAI: Compliance API for ChatGPT Enterprise
• OpenAI: ads in ChatGPT
• Microsoft: Microsoft 365 Copilot pricing (Enterprise)
• Microsoft: Microsoft 365 Copilot Business pricing
• Microsoft Learn: privacy and EU Data Boundary for Copilot
• Microsoft Learn: Anthropic models as a subprocessor
• Microsoft Learn: Anthropic models in Word, Excel and PowerPoint
• Microsoft: Claude models in Copilot and the EU Data Boundary
• Microsoft: Data Protection Addendum
• Microsoft Learn: Partner Center announcements June 2026
• Microsoft Learn: Enterprise Data Protection
• Microsoft Learn: web search in Copilot
• Microsoft Learn: audit for Copilot
• Microsoft Learn: Copilot licence options
• Microsoft Learn: Copilot privacy and protections
• Microsoft Learn: Partner Center announcements October 2026
• Google Workspace: pricing
• Google: privacy of Gemini in Workspace
• Google: choose a data region
• Google: data covered by data regions and versions
• Google: Cloud Data Processing Addendum
• Google: Alternative Transfer Solution and Data Privacy Framework
• Google: setting up SSO
• Google Cloud: Gemini Enterprise Business
• Google Cloud: Gemini Enterprise FAQ
• Anthropic: Claude pricing
• Anthropic: Team plan
• Anthropic: Enterprise plan
• Anthropic: release notes
• Anthropic: roles and permissions
• Anthropic: server locations and data storage
• Anthropic: regional compliance
• Anthropic: Commercial Terms
• Anthropic: Data Processing Addendum
• Anthropic: SCIM and JIT provisioning
• Anthropic: audit logs
• Anthropic: Trust Center FAQ
• Mistral: pricing
• Mistral: Vibe replaces Le Chat
• Mistral: data storage
• Mistral: training on inputs
• Mistral: opting out of training
• Mistral: Data Processing Addendum
• Mistral: SAML SSO
• Mistral: Vibe Enterprise
• Langdock: pricing
• Langdock: Terms
• Langdock: data processing agreement
• Langdock: security and deployment options
• Langdock: legal documents and professional secrecy addendum
• innoGPT: pricing
• innoGPT: terms
• innoGPT: data protection and security
• innoGPT: Trust Center
• innoGPT: zero retention policy
• innoGPT: user management, members and roles
• DeutschlandGPT: pricing
• DeutschlandGPT: Trust Center
• DeutschlandGPT: data processing
• Open WebUI: licence file
• Open WebUI: licence in the documentation
• Open WebUI: authentication and SSO
• Open WebUI: SCIM
• Open WebUI: FAQ
• Open WebUI: security and air-gapped operation
• Open WebUI: chat data privacy
• Open WebUI: quick start and outgoing connections
• Open WebUI: enterprise sales
• Open WebUI: README
• LibreChat: licence file
• LibreChat: authentication
• LibreChat: access control and audit
• LibreChat: running with Docker
• ClickHouse: acquisition of LibreChat
• gpt-oss-120b: model card with licence
• GDPR: Regulation (EU) 2016/679
• European Commission: EU-US Data Privacy Framework
• Section 203 StGB: violation of private secrets (German)
• Section 87 BetrVG: co-determination rights (German)
• Federal Labour Court: decision 1 ABR 7/15 (German)