OpenAI reaffirms zero data retention

OpenAI restated its zero data retention (ZDR) commitment for eligible API customers, meaning prompts and model responses are not stored once a request finishes processing, and alongside it previewed Private Safety Processing, a system meant to catch abusive or malicious use without OpenAI itself reading or retaining customer content. ZDR has mainly been offered to enterprises in regulated industries such as healthcare and finance that need contractual proof their data isn’t logged.

The policy carries a carve-out: OpenAI reserves the right to make a specific customer ineligible for ZDR, with advance written notice, if it’s reasonably necessary to investigate or prevent severe risk activity. Bloomberg reports the move is aimed at reassuring paid API customers as OpenAI expands safety screening for agentic and tool-using traffic.

What it means for you

If you’ve sold a customer or your own compliance team on “OpenAI never stores our prompts,” this update doesn’t change that baseline, but it does mean OpenAI can suspend the guarantee for a specific account under a severe-risk investigation. Update your data-processing documentation to reflect the carve-out rather than the blanket claim, especially if you operate in a regulated vertical. It’s a smaller move than OpenAI’s other safeguards work after the Hugging Face breach, but part of the same pattern of OpenAI tightening the paper trail around what it can and can’t see, alongside a busy week for OpenAI product news that also included Replit’s new GPT-5.6 Luna free mode and ChatGPT ads expanding into Europe.