Codex for Enterprises: License, Security, Governance

License Model — Choosing the Right Plan

Codex is bundled into several ChatGPT tiers. Pick wrong and you overspend; pick right and you save:

Plan	Price	Codex usage	Best for
ChatGPT Plus	$20/seat/mo	Basic — monthly cap	Solo developer, experimenter
ChatGPT Pro	$200/seat/mo	High — 2x usage through May 31, 2026	Power user, small team (1–3)
ChatGPT Business	$25/seat/mo (annual)	Team — admin console, SSO	Dev team of 5–50
ChatGPT Enterprise	Custom quote	Enterprise — ZDR, audit, SAML	Compliance-heavy organizations
API (GPT-5.3-Codex)	$1.75 / $14 per 1M tokens	Pay-per-use	CI/CD automation, embedded tools

Data Flow — Where Does Your Code Go?

This is the question your compliance team will press hardest. Let's trace the data:

• Codex CLI: code stays on the dev machine, but context sent to the model goes to OpenAI API (US region) — file contents, error messages, command output
• Cloud Codex: the repo is cloned into OpenAI's sandbox — all code lives on OpenAI's cloud for the session
• Default retention: OpenAI may retain data for abuse monitoring (30 days) — see Privacy Policy
• ZDR (Zero Data Retention): Enterprise customers can request ZDR — OpenAI keeps no data after the response
• Training opt-out: Business and Enterprise plans do not use customer data to train models by default

Compliance — PDPA, ISO/IEC 27001, SOC 2

Thai organizations with compliance requirements must verify these items before rollout:

Compliance	What to check
PDPA (Thailand)	If code contains personal data (test data, fixtures), mask before sending
ISO/IEC 27001	OpenAI is certified — but Statement of Applicability may not cover every service. Verify scope
SOC 2 Type II	Available to Enterprise customers — request the report
Data residency	No OpenAI region in Thailand/ASEAN — data resides in the US. Evaluate carefully
ISO/IEC 29110	VSE software engineering standard — using AI must be in your documented process

Security — Risks and Mitigations

• Secret leak in context — if a developer accidentally feeds .env or API keys into the session — set up .codexignore or pre-commit hooks
• Prompt injection — if Codex reads external docs (web search, MCP), it can be tricked into unintended actions
• Insecure code suggestion — AI may suggest vulnerable patterns — set up SAST in CI to catch them
• Supply chain risk — Codex may suggest unsafe dependencies — set up a dependency scanner
• Account compromise — a hacked OpenAI account exposes all submitted code — require 2FA + SSO

Governance Framework — For CTO + Compliance Teams

Enterprise deployment requires a complete framework. We recommend the AI Governance structure:

1. Define allowed scope — which repos may use Codex, which may not (e.g., trade-secret repos)
2. Set role-based access — admin defines who can use Codex Business and at what permission level
3. Audit trail every session — log prompts, output, and modified files — retain at least 90 days
4. Approval workflow before merge — Codex-generated code must clear human review before merging to main
5. Incident response plan — if Codex-generated code causes a production bug, how do you roll back
6. Team training — developers must understand limitations and never trust output without verification

Integrating with Saeree ERP

For Thai organizations already using Saeree ERP, Codex deployment can hook into existing governance:

• Audit log: Saeree ERP records every login and data change. Admins can query history themselves — no vendor needed
• 2FA + SSO: use the same 2FA + SSO as ChatGPT Business for unified access
• Role-based permissions: admins manage user role/permissions themselves — add/inactivate users, set valid-from/valid-to dates, restrict accessible modules
• Approval workflow: Saeree ERP's approval workflow supports multi-level approval — usable for both business processes and system-deploy approvals
• Digital signature: use digital signatures tied to approvals for non-repudiation

Codex Deployment Checklist

Category	Action
License	Pick a plan that fits team size (Plus / Pro / Business / Enterprise)
Data flow	Ensure submitted code carries no secrets or personal data — configure .codexignore
Compliance	Pass DPO / compliance team review before rollout
SSO + 2FA	Enable SSO + 2FA for every ChatGPT Business account
Audit log	Retain Codex usage logs at least 90 days — weekly review
CI guardrails	Codex-generated code must pass tests, lint, and SAST before merge
Human reviewer	Every PR requires human approval — Codex review is only the first pass
Training	Onboarding training for every developer — emphasize verify + limitations
Incident response	Have a playbook for bugs traced to Codex-generated code
Metrics	Track velocity, quality, and cost monthly

Organizations that succeed with Codex don't "let everyone figure it out" — they invest in governance and training at least as much as license fees.

- Sureeraya Limpaibul, Saeree ERP

Summary — Codex for Enterprises EP 4/4

Codex is a powerful force multiplier for dev teams — but it's only safe and cost-effective with full governance in place. Good deployment plans address three dimensions together: license fit for team size, data flow that passes compliance, and a governance framework covering audit, approval, and incident response. Thai organizations already on Saeree ERP can use the ERP's infrastructure as the governance backbone for AI tools.

Continue Reading — EP 1, EP 2, EP 3

• EP 1: What is OpenAI Codex? AI Coding Agent
• EP 2: Codex vs Claude Code: 2026 Comparison
• EP 3: 8 Real-World Codex Use Cases

References

• OpenAI — Enterprise Privacy
• OpenAI Developers — Codex Pricing
• OpenAI Trust Portal — SOC 2, ISO 27001
• UI Bakery — OpenAI Codex Pricing 2026

Need a workshop to design an AI Coding Tools governance framework integrated with your ERP system? The Saeree ERP team has deployed AI agents at compliance-heavy Thai enterprises — schedule a consultation or contact our advisory team.