AI procurement for schools

Put the answers next to each other.

Four providers. Twelve questions. Only claims we could verify in official documents. If a detail is missing, the table says so.

Checked 18 September 2026This compares public product and contract information. Contract terms, licences and settings can change the answer for your school.

Providers compared

BrainBite

PrivateGPT

PrivateGPT details

OpenAI

ChatGPT Edu

OpenAI DPA

Google

Gemini for Education

Google Education guide

Microsoft

Microsoft Copilot

Microsoft privacy guide

The twelve questions

Comparison of four AI vendors
Question	PrivateGPT	ChatGPT Edu	Gemini for Education	Microsoft Copilot
Where the data lives
In which country are the servers, and which legal entity is the processor?	Published Dutch datacentres. BrainBite acts as processor.	Check contract OpenAI Ireland contracts with EEA customers. Eligible Edu customers can choose European data residency.	Check contract Google acts as processor under Workspace terms. A specific storage country is not clearly published here.	Check contract Microsoft acts as processor. The EU Data Boundary applies to EU customers.
Who are the subprocessors, and can we get the list in writing?	Check contract Available in the school processing agreement.	Published OpenAI publishes a subprocessor list.	Published Google publishes a Workspace subprocessor list.	Published Microsoft publishes Online Services subprocessors, including model providers where used.
Does anything leave the EEA for support, logging or monitoring?	Check contract The product is presented as processing in the Netherlands.	Check contract European residency is available, but scope and any exceptions depend on the ordered setup.	Check contract Google documents safeguards for transfers outside the EEA.	Check contract The EU Data Boundary applies, with service details and subprocessors set by contract.
What happens to the content
Is school data used to train or fine-tune a model, including by the model provider?	Published No. This is stated as a contractual commitment.	Published ChatGPT Edu inputs and outputs are not used for training by default.	Published Education Core service data is not human reviewed or used to train models outside the domain without permission.	Published Prompts, responses and Graph data are not used to train foundation models.
Is that promise in the contract, rather than only on a webpage?	Check contract Covered in the education processing agreement.	Published OpenAI publishes a Data Processing Addendum for business services.	Published Workspace terms and the Service Data Addendum apply.	Published The Microsoft DPA and Product Terms apply.
How long are prompts and outputs kept after a session?	Published The school sets the retention period.	Check contract Qualifying organisations can configure retention.	Not clearly published A single Gemini Education retention period is not clearly published.	Check contract Retention follows Microsoft 365 and Purview policy settings.
Who can see it
Who inside the company can read pupil content, and under which conditions?	Not clearly published The public page does not describe staff access conditions in enough detail.	Check contract OpenAI says it does not routinely review business data. Confirm exceptions in the contract.	Published Google says Education Core service content is not reviewed by human reviewers.	Not clearly published A specific staff access statement is not clearly published on the reviewed page.
Is access logged, and can the school inspect those logs?	Published An administrator audit log is included.	Not clearly published The reviewed public documents do not clearly describe an Edu content access log.	Published Gemini activity can be reviewed in supported Workspace audit and investigation tools.	Published Copilot interactions and admin activity are supported in Microsoft Purview Audit.
Who stays in control
Does the system make or influence decisions about a pupil?	Check contract No automated pupil decision claim is made. Confirm the intended school use in writing.	Not clearly published Not clearly published for school decisions.	Not clearly published Not clearly published for school decisions.	Not clearly published Not clearly published for school decisions.
Can a teacher see why, change it and overrule it?	Published Schools set rules by group and administrators can change them.	Not clearly published No equivalent teacher override is clearly published.	Not clearly published No equivalent teacher override is clearly published.	Not clearly published No equivalent teacher override is clearly published.
Getting out
Can we export everything in a format we can open without asking the vendor?	Published Conversation export is included.	Check contract Members can export their own data if an admin enables it. Export is unavailable with data residency configured.	Not clearly published A Gemini Education specific full export is not clearly published here.	Not clearly published A Copilot specific self-service full export is not clearly published here.
What is deleted at termination, how fast, and do we receive confirmation?	Published Data can be taken out and a destruction statement is provided.	Not clearly published A specific Edu deletion deadline and confirmation are not clearly published here.	Not clearly published A Gemini Education specific deadline and confirmation are not clearly published here.	Not clearly published A Copilot specific deadline and confirmation are not clearly published here.

BrainBite

PrivateGPT

Where the data lives

In which country are the servers, and which legal entity is the processor?: Published
Dutch datacentres. BrainBite acts as processor.
Who are the subprocessors, and can we get the list in writing?: Check contract
Available in the school processing agreement.
Does anything leave the EEA for support, logging or monitoring?: Check contract
The product is presented as processing in the Netherlands.

What happens to the content

Is school data used to train or fine-tune a model, including by the model provider?: Published
No. This is stated as a contractual commitment.
Is that promise in the contract, rather than only on a webpage?: Check contract
Covered in the education processing agreement.
How long are prompts and outputs kept after a session?: Published
The school sets the retention period.

Who can see it

Who inside the company can read pupil content, and under which conditions?: Not clearly published
The public page does not describe staff access conditions in enough detail.
Is access logged, and can the school inspect those logs?: Published
An administrator audit log is included.

Who stays in control

Does the system make or influence decisions about a pupil?: Check contract
No automated pupil decision claim is made. Confirm the intended school use in writing.
Can a teacher see why, change it and overrule it?: Published
Schools set rules by group and administrators can change them.

Getting out

Can we export everything in a format we can open without asking the vendor?: Published
Conversation export is included.
What is deleted at termination, how fast, and do we receive confirmation?: Published
Data can be taken out and a destruction statement is provided.

PrivateGPT details

OpenAI

ChatGPT Edu

Where the data lives

In which country are the servers, and which legal entity is the processor?: Check contract
OpenAI Ireland contracts with EEA customers. Eligible Edu customers can choose European data residency.
Who are the subprocessors, and can we get the list in writing?: Published
OpenAI publishes a subprocessor list.
Does anything leave the EEA for support, logging or monitoring?: Check contract
European residency is available, but scope and any exceptions depend on the ordered setup.

What happens to the content

Is school data used to train or fine-tune a model, including by the model provider?: Published
ChatGPT Edu inputs and outputs are not used for training by default.
Is that promise in the contract, rather than only on a webpage?: Published
OpenAI publishes a Data Processing Addendum for business services.
How long are prompts and outputs kept after a session?: Check contract
Qualifying organisations can configure retention.

Who can see it

Who inside the company can read pupil content, and under which conditions?: Check contract
OpenAI says it does not routinely review business data. Confirm exceptions in the contract.
Is access logged, and can the school inspect those logs?: Not clearly published
The reviewed public documents do not clearly describe an Edu content access log.

Who stays in control

Does the system make or influence decisions about a pupil?: Not clearly published
Not clearly published for school decisions.
Can a teacher see why, change it and overrule it?: Not clearly published
No equivalent teacher override is clearly published.

Getting out

Can we export everything in a format we can open without asking the vendor?: Check contract
Members can export their own data if an admin enables it. Export is unavailable with data residency configured.
What is deleted at termination, how fast, and do we receive confirmation?: Not clearly published
A specific Edu deletion deadline and confirmation are not clearly published here.

OpenAI DPA

Google

Gemini for Education

Where the data lives

In which country are the servers, and which legal entity is the processor?: Check contract
Google acts as processor under Workspace terms. A specific storage country is not clearly published here.
Who are the subprocessors, and can we get the list in writing?: Published
Google publishes a Workspace subprocessor list.
Does anything leave the EEA for support, logging or monitoring?: Check contract
Google documents safeguards for transfers outside the EEA.

What happens to the content

Is school data used to train or fine-tune a model, including by the model provider?: Published
Education Core service data is not human reviewed or used to train models outside the domain without permission.
Is that promise in the contract, rather than only on a webpage?: Published
Workspace terms and the Service Data Addendum apply.
How long are prompts and outputs kept after a session?: Not clearly published
A single Gemini Education retention period is not clearly published.

Who can see it

Who inside the company can read pupil content, and under which conditions?: Published
Google says Education Core service content is not reviewed by human reviewers.
Is access logged, and can the school inspect those logs?: Published
Gemini activity can be reviewed in supported Workspace audit and investigation tools.

Who stays in control

Does the system make or influence decisions about a pupil?: Not clearly published
Not clearly published for school decisions.
Can a teacher see why, change it and overrule it?: Not clearly published
No equivalent teacher override is clearly published.

Getting out

Can we export everything in a format we can open without asking the vendor?: Not clearly published
A Gemini Education specific full export is not clearly published here.
What is deleted at termination, how fast, and do we receive confirmation?: Not clearly published
A Gemini Education specific deadline and confirmation are not clearly published here.

Google Education guide

Microsoft

Microsoft Copilot

Where the data lives

In which country are the servers, and which legal entity is the processor?: Check contract
Microsoft acts as processor. The EU Data Boundary applies to EU customers.
Who are the subprocessors, and can we get the list in writing?: Published
Microsoft publishes Online Services subprocessors, including model providers where used.
Does anything leave the EEA for support, logging or monitoring?: Check contract
The EU Data Boundary applies, with service details and subprocessors set by contract.

What happens to the content

Is school data used to train or fine-tune a model, including by the model provider?: Published
Prompts, responses and Graph data are not used to train foundation models.
Is that promise in the contract, rather than only on a webpage?: Published
The Microsoft DPA and Product Terms apply.
How long are prompts and outputs kept after a session?: Check contract
Retention follows Microsoft 365 and Purview policy settings.

Who can see it

Who inside the company can read pupil content, and under which conditions?: Not clearly published
A specific staff access statement is not clearly published on the reviewed page.
Is access logged, and can the school inspect those logs?: Published
Copilot interactions and admin activity are supported in Microsoft Purview Audit.

Who stays in control

Does the system make or influence decisions about a pupil?: Not clearly published
Not clearly published for school decisions.
Can a teacher see why, change it and overrule it?: Not clearly published
No equivalent teacher override is clearly published.

Getting out

Can we export everything in a format we can open without asking the vendor?: Not clearly published
A Copilot specific self-service full export is not clearly published here.
What is deleted at termination, how fast, and do we receive confirmation?: Not clearly published
A Copilot specific deadline and confirmation are not clearly published here.

Microsoft privacy guide

Capability is a separate question

Privacy answers do not measure model quality. The Artificial Analysis Intelligence Index v4.3 combines ten benchmarks. The current maximum is 53.

PrivateGPT

GLM-5.3 in Standard and Deep Think

45 of a current maximum of 53Current maximum 53

ChatGPT Edu

Top OpenAI model in the existing index comparison

53 of a current maximum of 53Current maximum 53

Gemini for Education

No score in the existing comparison

Not clearly published

Microsoft Copilot

No score in the existing comparison

Not clearly published

Artificial Analysis Intelligence Index v4.3, September 2026

The page does not sign the paperwork for you.

A public comparison does not replace a verwerkersovereenkomst, the Dutch data processing agreement, or a DPIA for uses that can affect pupils. Ask each provider to put every important answer in writing.

Now ask us the same questions.

Bring your school documents and your privacy checklist. We will show the product and answer the awkward bits too.

Request a PrivateGPT demo Read the full checklist