Membership, SSO and data policy — owned by the tenant.

ChatGPT sign-in identifies a user; organization membership authorizes them. SSO records remain drafts until external verification, and EU residency remains policy-only until the infrastructure deployment is independently attested.