Short answer: yes, you can put company documents into ChatGPT — via file uploads, Projects, or a Team workspace — and for quick, low-stakes questions it’s genuinely useful. But before you paste a single file, two things matter: your privacy settings (whether your data can be used to train models) and a hard rule about what never goes in. And once you need ChatGPT to answer from your documents reliably — with sources cited, access controlled, and files that update themselves — you’ve outgrown uploads and need a RAG system instead.
This guide walks the options ladder from “upload a PDF this afternoon” through to a proper retrieval setup, with a privacy checklist in the middle and an honest line on where each option stops working.
The options ladder at a glance
| Option | Rough cost | Good for | Where it falls over |
|---|---|---|---|
| File uploads (Free/Plus) | $0–~US$20/month (approx) | One-off questions about a single document | No memory between chats; re-upload every time |
| ChatGPT Projects | Included with Plus/Team | A small, stable reference set you query often | Manual re-uploads; no citations to your files |
| ChatGPT Team workspace | ~US$25–30/user/month (approx) | A whole team querying shared material | Per-seat cost adds up; still no real access control per document |
| Custom GPTs with knowledge | Included with Plus/Team | A reusable “ask our handbook” bot for casual use | Knowledge files are loosely held; hard to govern or audit |
| RAG system (proper build) | From $9,500 one-off with us | Staff or customers getting citable answers from your real documents | Upfront build cost — overkill for a one-person query habit |
Third-party prices above are approximate and shift regularly — treat them as ballpark, and check OpenAI’s current pricing before budgeting.
Option 1: File uploads — fine for Tuesday, not for operations
The simplest path: drag a PDF, Word doc or spreadsheet into a chat and ask questions about it. For “summarise this 40-page tender” or “what does clause 14 actually say?”, it’s excellent and costs nothing beyond your subscription.
The catches show up fast:
- No memory between chats. Tomorrow’s conversation doesn’t know the file exists. You re-upload, every time.
- Context limits. Long documents get truncated or sampled. Ask about page 38 of a 60-page contract and you may get a confident answer from pages the model never saw.
- No citations. ChatGPT will happily tell you what the document says without showing you where. For anything you’ll act on — quotes, compliance, HR matters — that’s a problem, because you can’t verify the answer without reading the document yourself, which defeats the point.
Option 2: Projects — a halfway house with a ceiling
Projects (on paid plans) let you pin a set of files to a workspace so every chat in that Project can draw on them. It feels like “ChatGPT knows our documents”, and for a small, stable reference set — a style guide, a product overview, a few SOPs — it mostly works.
The limits matter more than the marketing:
- Manual upkeep. Update your price list on your shared drive and the Project still has the old version until someone remembers to re-upload it. Stale answers are worse than no answers.
- Still no reliable citations. It may mention which file an answer came from, but it doesn’t quote passages with page-level references you can audit.
- No access control per document. Everyone in the workspace sees everything. There’s no “the apprentice can query SOPs but not the payroll spreadsheet” — it’s all or nothing.
The privacy checklist — read this before uploading anything
This is the section most people skip and shouldn’t.
1. Check your training-data setting. On consumer ChatGPT plans, your conversations may be used to improve the model unless you opt out in settings (Data Controls → “Improve the model for everyone”). Business tiers — Team and Enterprise — and the API don’t train on your data by default. If your business is putting company material in, use a business tier or turn the setting off. Full stop.
2. Know what never goes in. Regardless of settings:
- Passwords, API keys, or any credentials
- Tax file numbers, Medicare details, or government identifiers
- Health information about staff or clients
- Client personal information you don’t need for the task — de-identify first
- Material under legal privilege or strict NDA, unless you’ve cleared it
- Unreleased financials or anything market-sensitive
3. Think about the Privacy Act at a high level. If the documents contain personal information about Australians, the Privacy Act 1988 (Cth) and the Australian Privacy Principles apply to most businesses above the small-business threshold (and to many below it, depending on what you handle). The relevant idea here: APP 8 makes you responsible for taking reasonable steps when personal information is disclosed overseas — and ChatGPT’s servers are not in Australia. This isn’t legal advice, but “we pasted our customer list into a US-hosted AI tool” is not a sentence you want to explain to the OAIC. De-identify where you can, use business tiers with proper data terms, and write a one-page internal rule about what’s allowed in.
4. Assume anything pasted in is stored. Retention policies vary by plan. Treat every upload as semi-permanent and act accordingly.
Option 3: When you need a RAG system instead
RAG — retrieval-augmented generation — is the grown-up version of everything above. Your documents are indexed into a searchable store that sits next to the AI model, not inside a chat window. When someone asks a question, the system retrieves the relevant passages and the AI answers from those passages — with citations back to the exact source. (If you want the full plain-English explainer, we’ve written about RAG vs fine-tuning and when each makes sense.)
The upgrade triggers are usually clear:
- You need receipts. Staff quoting policies, prices or procedures to customers need answers they can verify. A RAG system shows its working; an upload doesn’t.
- Your documents change. A RAG index can re-sync from your shared drive or SharePoint on a schedule. No one’s job becomes “remember to re-upload the price list”.
- More than a handful of people use it. Per-seat ChatGPT Team licences at ~US$25–30/user/month add up fast; a shared RAG assistant has no per-seat tax and gives you one governed knowledge base instead of fifteen personal Projects.
- Access matters. A proper build can respect who should see what — the office manager queries HR policies, the field team queries install manuals, and neither sees the other’s material.
- It’s customer-facing. If the answers go to customers, you need guardrails, logging and citations. ChatGPT chat windows don’t give you that; a build does.
Our RAG Knowledge Systems service builds exactly this — your documents indexed, wired into an internal assistant or customer-facing chatbot, citations on, access rules baked in — from $9,500 fixed, delivered in 4–6 weeks. It’s a bigger step than a $20 subscription because it’s solving a different problem: not “help me read this document” but “make our collective knowledge answerable, accurately, forever”.
A realistic path for most SMBs
You don’t have to pick one rung forever. The sensible sequence looks like:
- Week 1: Use uploads for ad-hoc document questions, with the privacy checklist pinned next to the monitor. Fix the training-data setting on day one.
- Month 1–2: Graduate recurring reference material into a Project or a Custom GPT. Notice which questions come back weekly.
- When it hurts: The first time someone acts on a stale answer, or you catch yourself re-uploading the same manual for the fifth time, or a second team member asks “can I get access to that bot?” — that’s the signal. The documents and question patterns you’ve built up along the way aren’t wasted; they’re the input list for a proper RAG knowledge system build.
Which option are you?
- Occasional one-off questions about individual documents? File uploads on a paid plan, training-data sharing off. Costs you nothing extra.
- A small team querying the same stable set of docs? Projects or a Team workspace — but write down who owns re-uploads, because “someone will remember” is not a document strategy.
- Documents that change, answers that need sources, or more than a few people relying on it? That’s RAG territory — from $9,500, live in 4–6 weeks, and the privacy story gets simpler, not harder, because your data sits in infrastructure you control.
- Genuinely unsure where your situation lands? That’s exactly what our free 20-minute scoping call is for — bring your document pile and your questions, and if the honest answer is “a $20 ChatGPT plan is all you need”, we’ll tell you that too.