OpenAI previews private safety checks that keep zero data retention

When companies deploy frontier AI, enterprise security teams and AI providers usually hit a wall over data retention. Enterprises want their prompts gone the second an API call finishes, but frontier safety teams argue they need to watch what bad actors are doing over time.

OpenAI is trying to square that circle. The company previewed Private Safety Processing, a new system designed to analyze abuse patterns across multiple interactions without violating its Zero Data Retention (ZDR) guarantee.

On September 22, 2026, OpenAI began rolling out the system to API customers in phases, alongside a technical white paper.

Spotting bad actors without reading the logs

The fundamental problem with traditional zero-retention setups is that they evaluate prompts one by one in isolation. That works for basic chatbot requests, but real risks often span multiple calls.

Attackers rarely type out a dangerous request in a single prompt. Instead, they probe guardrails incrementally, coordinate across accounts, or mask malicious workflows as benign research. Long-running AI agents can also drift out of bounds, such as continuing to take unauthorized actions after an operator explicitly tells them to stop.

Catching those issues requires contextual memory across multiple interactions. While other frontier model deployments have forced enterprise customers to let providers store sensitive text for safety reviews, OpenAI is taking an automated, blind approach.

Under Private Safety Processing, customer data either stays entirely on the customer's own infrastructure or lives in OpenAI storage encrypted with customer-held keys. OpenAI employees never hold the decryption keys.

Automated systems scan across related sessions to detect suspicious patterns. If a violation is flagged, OpenAI receives only a narrow metadata signal classifying the behavior, without any underlying prompt or completion text exposed to human review.

If enforcement happens, the customer inspects the alert on their own servers, and they can choose whether or not to share logs if they want to appeal.

Why it matters

For enterprise teams in healthcare, finance, and defense, this is a massive operational relief. Security and legal officers routinely block frontier model rollouts because safety monitoring would otherwise expose proprietary records or breach privacy laws. If your company paused agentic deployments over data retention concerns, this setup makes testing feasible again.

For the AI industry, OpenAI is throwing down a gauntlet. Providers have increasingly pushed enterprises to accept data logging as the unavoidable cost of using smarter, more capable models. OpenAI is arguing that you do not need human eyeballs on plain text to enforce safety.

We think the cryptographic-plus-automated design is clever, but it leaves one major question mark: false positives. When an automated system flags a complex agentic workflow as abusive without human staff being able to see what went wrong, resolving edge-case disputes could turn into an agonizing back-and-forth for developers.