A private GPT is not a Custom GPT in ChatGPT with uploaded PDFs. It is a model that only sees the documents you authorise. Identity. A log. A perimeter someone can explain. This list is what you need clear before you connect OpenAI or an internal chat.
Data: what goes in
- A list of sources (wiki, Drive, folder, API). A named owner for each one.
- A rough classification: internal, confidential, with people’s data, secret. What you cannot classify does not go in.
- A copy or read-only access. Who may grow the set later.
- Retention: how long questions, answers and recovered chunks are kept.
- Language and versions. An old procedure next to the current one is a trap.
Who asks and what they see
- The chat or API uses a company account. Not a loose link.
- If someone cannot see the document at source, the model does not see it either.
- There are roles: who asks, who indexes, who reads logs. Not everyone reindexes.
- Keys live in the environment. Not on a laptop or in a shared Make flow.
- If the provider processes outside the EU, that is said first.
What never goes to a public chat
Passwords, tokens, third-party data, payroll, open incidents, contracts and any PDF you would not email to a stranger. Pasting that into ChatGPT is not “trying the case”. It is taking the file out of the perimeter. The alternative is in why not to paste internal PDFs.
Signals you are not ready yet
- Nobody knows which folder is the good one.
- The only access is a personal Google or Microsoft account.
- You want “everything” up front. The deliverable is one case, not the historical archive.
- There is nobody who can say “this answer is wrong” and fix the source document.
When the list is clear, setting up the RAG or GPT is engineering. Madrid. If you want me to leave it running, it is here.