OpenAI is testing a way to keep stronger safety monitoring compatible with Zero Data Retention.
The company said on August 19 that eligible API customers using frontier models can keep the core ZDR promise: OpenAI does not retain prompts or model responses after processing, customer content is not available to OpenAI personnel for review, and enterprise customer data is not used for training unless customers opt in.
The new piece is Private Safety Processing. OpenAI says the system is designed to identify risky patterns across related interactions without giving OpenAI personnel access to the underlying content. That matters because agentic work can spread risk across many steps. A single prompt may look benign while the broader task shows probing, coordination, or activity that drifts outside the user’s stated intent.
The privacy model has two paths
OpenAI describes two deployment shapes.
In the first, customer content remains on infrastructure the customer controls. In the second, content can be stored on OpenAI infrastructure but encrypted with customer-controlled keys. OpenAI says its personnel do not have those keys.
When automated systems detect a risk, OpenAI receives a limited safety signal about the activity type rather than the underlying prompts and responses. Customers can investigate with their own logs and can choose to share relevant information if they want to appeal, clarify legitimate activity, or support an abuse investigation.
The preview is currently being tested with early customers. OpenAI says it plans to start rolling out Private Safety Processing and publish a technical white paper in September.
ZDR is becoming harder as agents get longer
The old safety model was easier to reason about when a request was short and self-contained. The provider could inspect one interaction, apply policy, and move on.
Longer agent tasks are different. A user might delegate a research workflow, coding session, security assessment, or business process that spans many tool calls and context updates. Misuse may appear only after the system sees a sequence. Misalignment may appear when an agent continues after it should stop.
That creates a real enterprise trade-off. Highly regulated customers want no-retention commitments because they handle financial records, health data, legal work, proprietary research, or sensitive internal systems. Providers still need some way to detect abuse and contain agents that cross boundaries.
OpenAI’s proposal is to turn safety monitoring into a privacy-preserving signal system instead of a human-readable content review process.
