OpenAI presented on August 19, 2026, its Zero Data Retention offering for the deployment of advanced models to eligible API customers, as well as a preview feature called Private Safety Processing. These concepts are important for sensitive projects, but they should not be reduced to the phrase "data is not stored."
1. What is Zero Data Retention?
Within the announced framework, eligible API customers can use certain models with requests and responses not retained after processing. OpenAI also states that this content is not accessible to its staff and reminds that company data is not used to train models without the customer's explicit choice.
This option addresses a common constraint: preventing business content, a confidential document, or personal data from remaining in the provider's logs beyond the time necessary for the call.
The term "eligible" is essential. You need to check the model, the endpoint, the contract, the region, the functions used, and any possible exceptions. Official documentation shows that compatibility depends on each endpoint and its configuration: conversations, assistants, files, vector stores, batch processing, video, and certain asynchronous modes particularly require separate verification. A policy declared at the account level does not necessarily apply to each tool, file, cache, or ancillary service.
As of September 2, 2026, the official documentation also distinguishes between the “Eyes Off” and “Safety Retention” regimes. OpenAI indicates that it can make certain models ineligible for Zero Data Retention for a given client, with written notification. Depending on the regime applied, content may then be retained and, for Safety Retention, reviewed in order to investigate activity presenting a severe risk. This caveat must appear in the contractual analysis.
The same documentation specifies that the mode background The Responses API can temporarily write data to allow querying of the result, the prompt cache can store encrypted tensors on the GPU for a limited time, and third-party services, including remote MCP servers, apply their own retention policy.
2. What this does not mean
Zero retention does not mean zero processing. The data must be transmitted and loaded into memory to generate a response. The security of transport, the isolation of the infrastructure, technical access, and incident management therefore remain crucial.
This does not mean either that the client application keeps nothing. Prompts can appear in application logs, APM traces, message queues, backups, the browser, or an observability tool. The most talkative link is often on the integrator's side.
Finally, non-use for training, retention period, and location are three distinct subjects. They must be documented separately in the risk analysis and the record of processing activities.
3. The role of Private Safety Processing
OpenAI presents Private Safety Processing as a way to detect risk patterns appearing across multiple interactions without giving staff access to the underlying content. According to the announced architecture, the content can remain under the client's control. OpenAI is also developing a processing option on encrypted infrastructure with keys controlled by the client; it should not be considered generally available at this stage.
The provider would then receive a signal of a narrowly defined risk, and not the details of the conversations. The mechanism seeks to reconcile confidentiality and the detection of coordinated abuse, particularly when the analysis of an isolated call would be insufficient.
This is still a pre-release tested with early clients. OpenAI announced an initial rollout and a technical white paper in September. As of September 2, 2026, no separate announcement of general availability has been found: implementation details, verifiable guarantees, and access conditions need to be examined on a case-by-case basis.
4. An architecture with multiple levels of control
A robust project must distinguish at least five layers. The first is minimization: never send the model unnecessary data. The second is pseudonymization or masking before the call. The third covers transport and processing at the provider. The fourth concerns storage. The fifth relates to logs and controls of the client application.
Private Safety Processing adds a sixth layer: the potential production of a risk signal separate from the content. This layer must be documented as a full-fledged flow, with its purpose, recipients, duration, and possible consequences.
Encryption with a client-controlled key can enhance control, but it is not sufficient on its own. It is necessary to know when the data is decrypted, which component can use it, how the keys are renewed, and what happens in case of revocation.
5. Questions to ask before signing a contract
Start by establishing a matrix of the functions used: text, files, images, tools, search, cache, and asynchronous processing. For each, ask about the retention period, exceptions, region, subcontractors, and the deletion method.
Then check the eligibility conditions for Zero Data Retention, the available evidence, incident handling, and audit mechanisms. Ask how abuse, legal obligations, and particular categories of content are managed. The announcement specifically mentions an exception related to images of sexual abuse of minors; teams must know exactly the rules applicable to their service.
For Private Safety Processing, ask for the exact definition of the signal, its persistence, the decisions it can trigger, and the available means of appeal or investigation.
6. The controls to keep on the client side
A vendor privacy option does not replace access control. Each call must be linked to a user, a use case, and a data policy. Retrieved documents must respect the rights of the person querying the system.
Set up a sensitive data filter before sending, a strict output schema, deadlines, quotas, and the ability to quickly cut off the provider. Logs should prioritize identifiers, hashes, and metrics rather than full content.
Security tests must include prompt injections, indirect exfiltration, misconfigured tools, and compartmentalization errors. These topics are covered in our guide on the operational governance of AI.
7. The adapted use cases
Zero Data Retention is particularly relevant for summarizing confidential documents, internal assistance, contract analysis, technical support, or data extraction when the provider meets the other project requirements.
It does not automatically make the sending of medical, financial, or judicial data acceptable. For these categories, a thorough analysis, a legal basis, enhanced measures, and sometimes a dedicated infrastructure remain necessary.
High-autonomy use cases also require more than confidentiality. An agent able to write into the IT system must have minimal permissions, validations, and traceability for each action.
8. How to drive a pilot
Select a representative but desensitized test corpus. Map all flows, including logs, backups, and support tools. Enable the appropriate contractual option, then check the actual behavior of each endpoint.
Simulate errors, interruptions, and key revocation. Measure the data visible in observability and ensure that no one can retrieve the content from an identifier or a trace.
Finally, have the documentation validated by security, the DPO, and the business unit. The pilot is successful when the organization can explain where each piece of data goes, who can access it, and how to stop the service.
The announcement of August 19 constitutes an interesting advance for demanding companies. Its value will depend on the announced technical documentation, the contractual conditions, and the ability of integrators to apply the same discipline in their own architecture.
Partitech supports the design of secure AI services: flow mapping, architecture choice, data minimization, access control, observability, and compliance documentation.