You open a fresh chat to draft a statement of work for Client B, and ChatGPT casually references the pricing model you built for Client A last week. You never pasted it. You never named the other engagement. If you juggle multiple clients on a Plus, Pro, or Business plan, ChatGPT can carry one client's context straight into another client's session, and it can happen even when you believe you switched memory off. As of June 2026, that is the default behavior, not a bug you can report.
Most "ChatGPT for consultants" advice tells you to flip the memory toggle and move on. That advice is incomplete. The word "memory" in ChatGPT covers more than one system, and the toggle you find first does not cover all of them. So you end up with a confidentiality problem hiding inside a feature everyone treats as a convenience, and nobody warns you until it surfaces a name it should never have known.
ChatGPT has two memory layers, not one
ChatGPT's persistent memory is two separate features stacked together. The first is Reference saved memories: explicit facts the model has stored, like your name, your role, or a preference you stated. The second is Reference chat history, where ChatGPT draws on your past conversations to make new ones more relevant without you asking it to remember anything. Both live as distinct toggles in Settings under Personalization, and either one can surface prior context. According to OpenAI's own Memory FAQ, only the saved-memories list is auditable; the chat-history layer is inferred at runtime and never shown to you as a fixed list.
The chat-history layer is the one that bites consultants. It does not need a saved note that says "Client A pays a 20 percent retainer." It can reach back into the actual conversation where you worked through Client A's retainer and pull that thread forward when the topic looks similar. To the model, your two clients are just two regions of the same history. There is no per-client wall between them by default.
ChatGPT does not see two clients. It sees one history, and it pulls from all of it.
Turning off memory does not turn off every source
Disabling Reference saved memories in ChatGPT also disables Reference chat history, and switching memory off does not delete anything already stored. The toggle helps. It is also narrower than the word "memory" suggests, because a setting labeled memory does not necessarily cover every place the product can pull in prior context. The layers you did not touch keep doing their quiet work behind the chat you are actually reading.
This is not hypothetical. In an account published by writer Stephen Smith on May 25, 2026, a law partner had switched off ChatGPT's memory on his IT director's advice. He then asked ChatGPT to summarize a contract, and the reply opened by referencing one of his other clients. He had pasted nothing, uploaded nothing, and mentioned no other matter. The toggle he flipped was one of several, and the others kept retrieving context.
Why this is a confidentiality problem, not a quirk
When Client A's confidential context appears inside a Client B session, you have a data-segregation failure. The model is not malicious and it is not breaking out of a sandbox. It is doing exactly what cross-chat reference is designed to do, which is reuse your earlier work. The flaw sits in the design's assumption that all your work belongs to one person and can be freely mixed. For anyone bound by client confidentiality, that assumption is simply wrong.
Consumer and Plus ChatGPT ship with no per-client isolation. There is one memory pool, and your engagements share it. The risk stays quiet because nothing alerts you. You only notice when the model volunteers a detail it should not have, and by then it has already crossed the matters in front of you. The leaks you do not catch are the dangerous ones.
For a freelancer or a small agency, the exposure compounds with every client you add. Each new engagement lands in the same pool, so the surface for bleed grows the more work you take on. A consultant with two clients has a small problem. A consultant with twenty has a memory store where any past conversation can resurface in any new one. The tooling does not scale isolation for you, so your own discipline has to.
Your plan tier decides whether projects stay isolated
Here is what most coverage will not tell you: a project per client does not make you safe, and the safety depends entirely on your plan. On Enterprise and Edu, projects stay contained inside the project boundary. On non-Enterprise accounts, including Plus, Pro, and Business, default-memory projects can reference chats from outside the project unless that project is set to project-only. So the workaround everyone recommends, a tidy folder per client, leaks by default on the exact plans most consultants pay for. The container only holds if you explicitly close it.
Project-only memory is the setting that actually walls things off. With it on, a project references only conversations inside that project and does not pull from your general memory or other projects. With default memory, the project can reach your wider history. The difference is one toggle inside the project, and most people never open it.
There is a catch that catches everyone. Project-only memory is a one-way door: once you turn it on for a project, OpenAI does not let you turn it back off, and it only applies to new projects, not the ones you already built. If your client folders predate the day you learned about this, switching them to project-only is not a setting you can flip. You have to recreate each project with the same name, instructions, and files, then move the chats across. Most consultants set up their folders months before they ever heard the phrase project-only memory, which means the projects holding their oldest, most sensitive client history are exactly the ones still running on the leaky default.
How to spot a leak before it spreads
The tell is when ChatGPT introduces a detail you did not provide in the current thread. It names a deliverable, a figure, or a stakeholder that belongs to a different engagement. That is the model retrieving from your wider history rather than the chat in front of you. Treat any unprompted specific as a signal that cross-chat reference is active and reaching across clients.
A second tell is easier to miss. The model phrases something with confidence you never handed it, like assuming a pricing structure or a contract term. That confidence often traces back to a prior conversation. If you cannot tie a claim to the current chat, do not let it ride. Open the project header, confirm which workspace you are in, and check whether project-only memory is set before you trust the output for a confidential matter.
| Setting | What it does | Limit for multi-client work |
|---|---|---|
| Reference saved memories off | Stops new explicit facts from being stored and used | Also disables chat history reference, but does not delete what was already saved |
| Reference chat history off | Stops ChatGPT pulling from past conversations | Tied to the saved-memories toggle; easy to assume it is off when a project setting overrides intent |
| Project per client (default memory) | Groups one client's chats in a workspace | On Plus, Pro, Business, can still reference chats outside the project |
| Project-only memory on | Keeps a project's context inside that project | Cannot be turned off later, and only applies to new projects, not existing ones |
| Temporary Chat | Chat with no memory, no history, no training use | Nothing persists, so it is unusable for ongoing client work |
How to actually segregate clients in ChatGPT
There is a workflow that holds, and it is more than one switch. The goal is simple. Every client lives in its own sealed box, and nothing the model retrieves crosses between boxes. Set it up once per client and the isolation sticks.
- Create one project per client, and turn project-only memory on inside each new project so it cannot reach your general history or other projects.
- Because project-only memory cannot be reversed and does not retrofit onto old projects, rebuild any pre-existing client folder as a fresh project with the same name, instructions, and files, then move the chats in.
- Do client work only inside the right project. A loose chat in the main sidebar runs against your full history, which is where bleed happens.
- For one-off sensitive prompts, use Temporary Chat: it uses no memory, is not saved to your history, and is not used to train the models, though OpenAI keeps a copy for up to 30 days for safety before deleting it.
- Audit and prune saved memories periodically under Settings, Personalization, Manage memories, and delete anything tied to a closed engagement, since switching memory off does not erase what was already stored.
One more habit closes the gap. Name your projects so the boundary is obvious at a glance. A project called Client B Acme leaves no doubt about where a chat belongs, while a vague title invites you to drop work in the wrong place. The cheapest leak to prevent is the one caused by typing into the default sidebar instead of the project you set up. Make the right box easy to find and you will use it.
Temporary Chat is the cleanest option for confidentiality because it carries nothing in and leaves nothing behind. Its limit is the flip side of its strength: it forgets the moment you close it, so it cannot support a project you return to for weeks. For ongoing client work you need persistence and isolation at the same time, and that is exactly where a single shared memory pool fails you.
Before each client session, glance at the project name in the header. If a chat is not inside the correct project, ChatGPT is running against your entire history, not just that client's.
Where a private memory layer changes the math
The deeper issue is that ChatGPT decides what to retrieve, and its default is to mix. A separate memory layer flips that default. MemX is private by architecture: per-user isolation, encryption at rest, CMEK, and memories that are never used to train models. Context surfaces only when you choose to bring it in, so one client's work does not silently leak into another client's chat. You keep persistence without keeping one shared pool that crosses matters on its own.
That is the practical difference for anyone holding multiple confidential engagements. Instead of policing toggles and project settings to stop bleed, you start from isolation and add context deliberately. The model still helps. It just stops volunteering the one detail you most needed it to keep separate.
It also removes the audit burden. With one shared pool, every new client adds a place to check, and you have to remember which projects are project-only and which saved memories went stale. A per-user layer that surfaces context only on request shrinks that work to almost nothing, because the default is to keep things apart rather than to mix them. For consultants, that safer default is the whole point.
Frequently asked questions
01Can ChatGPT mix up different clients in separate chats?
Yes. On Plus, Pro, and Business plans there is one shared memory pool with no per-client isolation by default, so ChatGPT can reference one client's earlier context inside another client's chat unless you wall each client off with a project set to project-only memory.
02Does turning off ChatGPT memory stop it referencing other clients?
Not completely. Disabling Reference saved memories also disables chat history reference, but it does not delete what is already stored, and project settings can still pull outside context. In one May 2026 account, memory was off and ChatGPT still referenced another client.
03What is the difference between saved memories and chat history?
Saved memories are explicit facts you asked ChatGPT to remember. Chat history reference lets ChatGPT draw on past conversations automatically, with no saved note. The chat-history layer is the one most likely to surface a different client's context unexpectedly.
04How do I keep clients separate in ChatGPT?
Create one project per client and turn on project-only memory inside each new one, so the project references only its own chats. Do all client work inside the right project, use Temporary Chat for one-off sensitive prompts, and prune saved memories from closed engagements.
05Do projects isolate memory on a Plus or Pro plan?
Not by default. On non-Enterprise plans, a default-memory project can reference chats from outside the project. Only Enterprise and Edu keep projects contained automatically, or any plan once you switch a new project to project-only memory.
The takeaway
ChatGPT can carry one client's context into another client's session because memory is two layers, not one, and the obvious toggle does not cover both. On Plus, Pro, and Business plans there is no per-client wall by default, and even a project per client can reach outside unless you set it to project-only, which you cannot undo and cannot retrofit onto old folders. Segregate deliberately with project-only memory and Temporary Chat, or move persistent context to a memory layer that isolates per user and surfaces nothing on its own.
