OpenAI Private Safety Processing Keeps Frontier Models on ZDR
OpenAI says Private Safety Processing will let eligible API customers use frontier models with Zero Data Retention while automated systems look for risky patterns across related interactions. Customer content stays in customer-controlled infrastructure or in storage encrypted with customer-controlled keys. The design is still an early test, and OpenAI has not yet published its promised technical paper or independent validation.
On this page
OpenAI has confirmed a preview, not a finished rollout
OpenAI announced Private Safety Processing on 19 August 2026 for eligible API customers using Zero Data Retention, or ZDR. The system is intended to detect dangerous patterns across related interactions without giving OpenAI personnel access to the underlying prompts and responses.
The company describes two storage arrangements. In a ZDR deployment, customer content remains on infrastructure controlled by the customer. OpenAI is also developing storage on its own infrastructure where content would be encrypted with keys controlled by the customer and unavailable to OpenAI personnel. Automated systems would return a limited signal about the suspected activity rather than the conversation itself.
This is not generally available technology yet. OpenAI says it is testing the system with early customers, plans to begin rollout in September, and will publish a technical white paper then. No supported model list, price, eligibility criteria, external audit, or production availability date appears in the announcement.
Zero retention does not mean no cloud processing
OpenAI defines ZDR as excluding customer content from abuse-monitoring logs and preventing supported endpoints from storing application state after a request is processed. The prompt still travels to OpenAI infrastructure for inference. ZDR therefore concerns storage after processing, not where the model runs.
The promise also applies to eligible API customers and compatible features, not every OpenAI product. OpenAI's current API documentation says some capabilities can create application state or fall outside ZDR. Background Responses requests, Code Interpreter, extended prompt caching, and some image or file paths have separate limitations. Remote MCP servers are third parties with their own data policies.
OpenAI also states that images flagged as possible child sexual abuse material will continue to be retained for legally required human review and reporting. Organizations evaluating the offer need the exact contract and endpoint configuration, not only the phrase “Zero Data Retention.”
The missing technical details decide how strong the claim is
Cross-interaction monitoring creates a genuine engineering problem. A provider needs enough continuity to recognise repeated safeguard probing, coordinated accounts, or an agent continuing after a stop instruction. Retaining full conversations makes that analysis easier, but it also creates a sensitive dataset.
Private Safety Processing is OpenAI's proposed way around that conflict. The announcement says automated systems inspect customer content where it is stored and send OpenAI a narrowly defined safety signal. Customers can use their own records to investigate an alert or voluntarily share evidence when appealing a decision.
OpenAI has not yet explained the cryptographic protocol, execution environment, key lifecycle, signal contents, account-linking method, or resistance to a compromised monitoring service. It also has not published false-positive and false-negative results. Until the September paper arrives, the available evidence supports a product design and an early-customer test, not a verified guarantee that the provider can learn nothing beyond every safety signal.
Anthropic has chosen a different confirmed boundary
Anthropic's current policy for Claude Fable 5, Mythos 5, and future designated “Covered Models” requires prompts and outputs to be retained for 30 days. Some partner deployments keep that retained content inside AWS or Google Cloud rather than Anthropic's environment, but the models are not available under a zero-retention arrangement.
That comparison is limited to confirmed policies. Reports about future changes at Anthropic rely on unnamed sources and should not be treated as released product details. OpenAI's own system is also incomplete until the promised documentation and rollout appear.
For teams choosing between cloud and local AI, the practical audit remains the same: identify where inference runs, which party stores prompts, which features create state, what safety exceptions apply, and whether third-party tools receive content. Local inference removes the model-provider API from the normal chat path, while a cloud ZDR agreement limits retention after remote processing. They solve different parts of the privacy problem.