A focused, provider-agnostic brief comparing Claude, ChatGPT, and Perplexity for dealership leaders. These three cover the work most dealerships actually need: drafting and analysis, customer-facing communication, and citation-grounded research. Current pricing verified directly with each vendor. Consumer plans are identified and deprioritized. Dealership-specific risks (FTC Safeguards, Red Flags Rule, CDK-class DMS exposure) are flagged throughout.
Three providers, three distinct jobs. Claude Team Standard ($20/seat/mo) is the strongest analytical and drafting workhorse with the cleanest contractual defaults. ChatGPT Business ($20/user/mo) has the lowest seat floor (2 users) and the broadest connector ecosystem—best for fast small-group rollouts. Perplexity Enterprise Pro ($40/seat/mo) is purpose-built for citation-grounded research—competitive intel, OEM tracking, market scans. The $20–$40 seat price is irrelevant compared to the $50,000+ per-violation Safeguards Rule exposure from a single misconfigured consumer account.
Dealers are financial institutions under GLBA. Every AI tool that touches a deal jacket, credit application, or customer PII becomes a service provider under the amended FTC Safeguards Rule.
A typical deal jacket contains SSN, driver's license, credit application, bureau pull, bank routing, trade-in payoff, income verification, co-signer PII, OFAC screening—every field is GLBA non-public personal information. Any AI tool that reads, summarizes, or indexes this data is a service provider under §314.4(f).
The FTC's first dealer-specific Safeguards FAQ (June 2025) makes clear that "vendor oversight" is not a box to check—it is an ongoing obligation requiring written due diligence, sub-processor disclosure, monitoring, and incident-notification terms.
As of April 2026, Claude Free/Pro/Max trains on user data by default (5-year retention, effective Sept. 28, 2025). ChatGPT and Perplexity consumer tiers also retain consumer data under terms unsuitable for PII. When a BDC rep or F&I manager pastes a credit app into a personal account, the dealer has simultaneously failed Safeguards §314.4(f), CCPA/CPRA sensitive-PI rules, and—depending on downstream use—Red Flags Rule obligations.
The fix is simple and inexpensive: block consumer AI on anything that touches customer data and provide staff with enterprise-tier accounts that carry contractual no-training commitments.
A dealership's AI stack is rarely one tool. These three providers cover distinct, non-overlapping workloads and—at the business tier—each meets the baseline contractual requirements for handling dealership data.
Long-form drafting, analysis, document review, technical work, and code. The cleanest contractual defaults in the group: SOC 2 Type II + ISO 27001, no-training by default on Team and Enterprise. Best for the analyst, the controller, the GM writing a board memo, the F&I director reconciling a chargeback report.
The broadest connector ecosystem (60+ apps including Slack, Drive, SharePoint, GitHub) and the lowest seat floor for a business contract (2 users). Best for fast small-group rollouts and for any team that already lives inside Microsoft 365 or Google Workspace and wants AI woven into existing tools.
Citation-grounded answers, not summaries. Built for research workflows where you have to defend a source. Best for competitive intelligence, OEM news tracking, used-car market scans, vendor due diligence, and prep for 20-group meetings—any task where "where did this come from?" is the next question.
These nine capabilities separate an enterprise-grade AI contract from a consumer app with a login page. If a plan is missing more than two, it does not belong in a dealership workflow that touches customer data.
Contractual commitment—not a toggle buried in settings. On by default, documented in the DPA.
Okta, Entra ID, or Google Workspace for centralized identity. Required for deprovisioning when staff turn over.
Automatic user lifecycle management. Eliminates the risk of a terminated F&I manager retaining AI access.
Who asked what, when. Required for any Safeguards Rule incident investigation or state AG inquiry.
Admin-set retention windows, deletion on demand. Prevents conversations becoming discoverable records.
US or regional data locality, especially for multi-state groups and California operations.
Independent audit, not a marketing claim. ISO 27001 is a plus. Required for cyber-insurance renewals.
Signed Data Processing Agreement with disclosed downstream vendors. Required under §314.4(f).
Written timelines aligned with the Safeguards 30-day breach-reporting rule (effective May 13, 2024).
For every provider, consumer/personal plans are shown in muted, dashed cards and marked "Not for Business." Plans that clear the business-ready bar are emphasized. The "Best for Business" badge marks the plan a typical dealership or small dealer group should start with.
A consolidated view across the three providers. This is how a typical dealership or dealer group should triage before any procurement conversation.
Each column is the entry business tier a typical dealer group would start with. Enterprise-tier additions are noted where they close a gap.
| Capability | Claude Team — $20 |
ChatGPT Business — $20 |
Perplexity Ent. Pro — $40 |
|---|---|---|---|
| Best fit (job to be done) | Drafting, analysis, code | Connector-driven workflows | Research with citations |
| No training on your data | Yes | Yes | Yes |
| SSO / SAML | Yes | Yes | Yes |
| SCIM provisioning | Enterprise tier | Enterprise tier | 50+ seats or 1 Max |
| Audit logs | Enterprise tier | Enterprise tier | Same gating as SCIM |
| Custom data retention | Enterprise tier | Enterprise tier | Same gating as SCIM |
| CMEK / customer-managed keys | No | Enterprise (EKM) | No |
| Data residency options | US API at 1.1× | 10 regions on Enterprise | Limited |
| HIPAA BAA | Sales-assisted | No* | Gap assessment |
| SOC 2 Type II | Yes | Yes | Yes |
| ISO 27001 | Yes | Yes (+27701) | Not published |
| Seat minimum | 5 | 2 | None (self-serve to ~250) |
| Free trial | No | No | No |
| Annual billing / commit | Yes | Yes | Yes (20% off) |
| Context window | Up to 500K | 256K (Thinking) | Varies by model |
| Bundled extras worth noting | Claude Code, Claude Cowork | Codex, custom GPTs | Comet browser, 15K file uploads |
← scroll →
*ChatGPT HIPAA BAA handled via separate ChatGPT for Healthcare product or qualifying API customers. "Enterprise tier" = capability available only on the provider's enterprise tier (contact sales). Pricing and features verified as of April 2026—always re-verify at the vendor's pricing page before contract.
If you do nothing else on this page, do these three things. They are ordered by risk reduction per hour invested.
Consumer-tier ChatGPT, Claude, and Perplexity accounts are the single largest source of silent Safeguards Rule exposure in dealerships today. Deploy a DNS-level block or MDM policy on work devices. Provide staff with enterprise-tier accounts so they don't have a reason to use personal ones. This is a one-week project with immediate risk reduction.
Claude, ChatGPT, and Perplexity are not interchangeable. The cheapest path is also the riskiest: one tool for everything means staff will reach for whatever's easiest, including their personal accounts. Provision Claude for analysts and managers, ChatGPT for connector-heavy and customer-facing teams, and Perplexity for the one or two people doing serious research. Total cost is still well under $100/seat for the people who need all three.
The FTC's first enforcement move in any Safeguards inquiry is a vendor-management document request. Your file should include: AI vendor due diligence memo, executed DPA, current sub-processor list, residency choice and reasoning, incident-notification terms, a manual-process continuity plan for when an AI vendor is compromised (as CDK was in June 2024), and evidence of periodic re-review. Treat this like your cyber-insurance renewal packet—because it functions as one.
Don't pick a winner. Each provider does a different job. The right answer for most dealerships is a thin layer of two or three, not a thick layer of one.
Every regulator inquiry and every cyber-insurance claim involving AI in 2025 began with an employee using a personal account. Close that hole first.
Any AI wired into CDK, Reynolds & Reynolds, or DealerSocket shares the same exposure that failed at CDK in June 2024. Vendor risk assessments and manual-process continuity plans are non-negotiable.
ChatGPT pricing shifted six times in eight months. Claude moved Enterprise to a usage-based model in early 2026. Re-verify pricing at the vendor page before any signature.
None of these providers markets a dealership-specific product. You will be early and expected to set your own guardrails. The providers will adapt to your demands only if you have them in writing.
Colorado AI Act takes effect June 30, 2026. California CARS Act takes effect October 1, 2026. Texas AG has been active on auto data enforcement since 2024. The window to be ahead of compliance is this calendar year.
"The $20–$40 seat price is nearly irrelevant next to the $50,000-per-violation Safeguards exposure from a single misconfigured consumer account. Pay for admin controls. Document your vendor program. The rest is noise."