OpenAI Extends Zero Data Retention to API Customers, Previews Private Safety Processing
In this article
OpenAI formally extended Zero Data Retention to eligible API customers on August 19, 2026, coupling the announcement with a preview of Private Safety Processing — a cross-interaction safety architecture designed to remain compatible with ZDR. The no-retention guarantee is live now; the new safety layer enters early-customer testing before a September general rollout.
The timing matters because agentic deployments have exposed a structural tension. As developers push models into longer, multi-step workflows — the kind of orchestration challenges already visible in multi-agent architectures — safety signals that are invisible in a single turn can surface only when several interactions are read together. OpenAI's prior ZDR-compatible systems evaluated each request in isolation. Private Safety Processing is the company's answer to that gap.
What Zero Data Retention Actually Guarantees
Under ZDR, OpenAI does not retain customer prompts or model responses after a request completes. OpenAI personnel cannot access that content for review, and enterprise customer data is not used for model training unless the customer explicitly opts in. One statutory carve-out applies: images flagged for potential child sexual abuse material are retained for mandatory review and reporting regardless of ZDR status, consistent with existing legal obligations across frontier model providers.
The guarantee is scoped to eligible API customers — not ChatGPT consumer tiers. Organizations handling financial records, health data, confidential business plans, or proprietary research are the primary constituency. Glean's CISO Sunil Agrawal confirmed in OpenAI's announcement that ZDR and the no-training commitment were the conditions that gave the company confidence to build on OpenAI infrastructure.
How Private Safety Processing Works Without Breaking Data Isolation
The core design challenge Private Safety Processing solves: cross-interaction pattern detection ordinarily requires retained content, which ZDR prohibits. OpenAI's approach separates the content plane from the signal plane.
Customer content remains in one of two locations. In ZDR deployments, it stays on infrastructure the customer controls. Where customers use OpenAI-provided storage, content is encrypted with keys controlled by the customer — OpenAI personnel hold no copy of those keys and therefore cannot read the underlying prompts or responses. Automated systems scan across related interactions and, when a risk pattern is detected, return a narrowly defined signal indicating the type of activity — not the content itself. That signal is what OpenAI acts on for enforcement decisions.
Customers retain investigative control on their end. If they need to contest an enforcement decision, clarify that flagged activity was legitimate, or assist a verified abuse investigation, they can selectively share relevant content with OpenAI at their own discretion.
The design directly addresses patterns that single-turn checks miss: repeated probing of safeguards, cross-account coordination, and agentic tasks that continue acting after an explicit stop instruction — scenarios where data security posture in production API environments is already a known attack surface.
Coverage and Availability
| Capability | Existing ZDR-Compatible Safety | Private Safety Processing |
|---|---|---|
| Evaluation scope | Single interaction | Patterns across related interactions |
| Content retained by OpenAI | No | No (customer-controlled keys or customer-controlled infra) |
| OpenAI personnel access to content | No | No, including when flagged |
| Signal returned to OpenAI on risk detection | Per-request | Narrowly defined activity-type signal |
| Customer appeal / disclosure mechanism | Not described | Customer-initiated selective sharing |
| Availability (as of Aug 19, 2026) | Live for eligible API customers | Early-customer testing; general rollout September 2026 |
| Technical white paper | N/A | Planned for September 2026 |
September Rollout and What Comes Next
OpenAI committed to publishing a technical white paper alongside the Private Safety Processing rollout in September 2026. Early customers across industries, regions, and company sizes are currently shaping the operational details — a co-development posture the company framed explicitly as part of its safety principles, arguing no single lab can address emerging risks in isolation.
The broader implication is structural: enterprise data isolation and frontier safety monitoring are no longer being treated as mutually exclusive design goals. As frontier models take on more autonomous roles, the pressure to enforce capability boundaries without sacrificing data sovereignty will only intensify — and OpenAI's September white paper will be the first concrete technical test of whether the encryption-and-signal architecture holds up under scrutiny.