OpenAI is extending frontier-model safety monitoring without giving up Zero Data Retention

On August 19, 2026, OpenAI said eligible API customers can continue to use Zero Data Retention with frontier models while it develops a new Private Safety Processing layer. Existing ZDR safety controls evaluate requests individually; the new system is intended to identify misuse patterns across related interactions without exposing the underlying prompts or responses to OpenAI personnel. For ZDR deployments, content can remain on customer-controlled infrastructure. OpenAI is also developing an option where content is stored on its infrastructure but encrypted with keys held by the customer. OpenAI receives only a limited safety signal when automated systems identify risk. The feature is being tested with early customers, with broader rollout and a technical white paper planned for September.

As model capability and agent autonomy increase, providers want safety systems that reason over longer sequences rather than isolated requests. That has created tension for organizations that cannot accept provider-side retention of sensitive prompts and outputs. Private Safety Processing is materially relevant because it proposes a technical separation between cross-interaction safety monitoring and provider access to raw customer content. If the design works as described, regulated and high-sensitivity API workloads may not have to choose between frontier-model access and strict retention controls. The trade-off is that the important guarantees currently rest on OpenAI’s preview description; cryptographic design, operational boundaries and enforcement behavior still need technical scrutiny.

OpenAI says Zero Data Retention still means eligible customer prompts and model responses are not retained by OpenAI after processing and are not available to OpenAI personnel for review, subject to disclosed legal exceptions. Private Safety Processing adds cross-interaction automated analysis so potentially harmful patterns can be detected over longer tasks without handing the underlying content to human reviewers.

OpenAI describes two storage models. In ZDR deployments, customer content remains on infrastructure the customer controls. A second planned option would keep content on OpenAI infrastructure encrypted with keys controlled by the customer; OpenAI says its personnel would not hold copies of those keys. Automated systems can process the protected content and return a narrow risk signal.

When the system detects risk, OpenAI says it receives a limited signal describing the type of activity rather than the prompts or responses themselves. That signal can inform enforcement. Customers retain the ability to investigate using their own records and can choose to share relevant content if they want to appeal or help investigate verified abuse.

OpenAI has not yet published the technical white paper, full threat model, key-management design, processing environment or independent validation. Builders evaluating the feature for compliance-sensitive workloads should therefore treat the current announcement as an architectural commitment under development rather than a finished security specification.