OpenAI Says It Can't See Your Agent Data. Can You Prove It?
On 19 August 2026, OpenAI reaffirmed its Zero Data Retention (ZDR) promise for eligible API customers and previewed a new system called Private Safety Processing. In plain terms: OpenAI is telling enterprise customers it can still monitor autonomous agents for abuse without its own staff ever reading your prompts or responses.
If you run AI agents on customer data, this is the vendor-trust and compliance conversation you need to have before you scale. Here is what actually changed, and what your in-house team now has to document.
What ZDR covers, and what it never did
Under ZDR, OpenAI does not retain prompts or model responses after a request is processed. Content is not available to OpenAI personnel for review, and enterprise data is not used to train models unless you explicitly opt in.
One exception has always applied and still does. OpenAI is legally required to report suspected child sexual abuse material, so images flagged as potential CSAM are retained for manual review even under ZDR. That carve-out is not new, but it belongs in your data-protection impact assessment.
Why the old model of safety breaks with agents
Here is the tension OpenAI is trying to resolve. Existing ZDR-compatible safety systems evaluate each interaction on its own. But as agents run longer and more autonomously, the serious risks only appear across multiple interactions.
Think of a bad actor probing safeguards repeatedly, coordinating across accounts, or an agent that keeps acting after being told to stop. From my observation, this is the real governance gap in agentic deployments: nobody was watching the pattern, only the single request.
How Private Safety Processing works
Private Safety Processing extends automated protection across related interactions. The mechanism, as OpenAI describes it, runs like this:
- For ZDR deployments, your content stays on infrastructure you control. OpenAI is also building an option where content sits on its infrastructure but is encrypted with keys only you hold.
- Automated systems review interactions for patterns of misuse. OpenAI personnel hold no copy of your keys, so they cannot read the underlying content.
- When a risk is detected, OpenAI receives a narrow signal: the type of activity and its severity, nothing more. Even flagged content stays closed to OpenAI staff.
- You investigate alerts using information in your own systems. If you want to appeal or support an abuse investigation, you can choose to share relevant content.
What this means for who sees what
| Data element | Customer | OpenAI staff |
|---|---|---|
| Prompts and model responses | Full access | None |
| Encryption keys (OpenAI storage option) | Controls keys | No copy |
| Risk signal (type + severity) | Full alert | Category only |
| Flagged content | Full access | None (unless customer shares) |
Table: who can see what under Private Safety Processing. Compiled from the OpenAI announcement.
What your team must document now
I think this materially strengthens the procurement case for OpenAI, but only if you can evidence it. The credibility rests on customer-held encryption keys, which is why Glean's CISO cited exactly that in the announcement.
Three things belong in your sign-off pack. First, confirm which storage model you are using and where keys live. Second, log the CSAM retention exception explicitly. Third, define your internal process for handling and appealing safety alerts, because those now land in your systems, not OpenAI's.
Rollout and a technical white paper are due in September 2026, so build your assessment against the paper, not the preview. For the broader shift in how buyers evaluate AI vendors, see my piece on ChatGPT becoming a B2B buying channel, and for the analytics governance angle, who edits your AI-written data story.
The concrete action: pull your current OpenAI data-processing terms, map them against the four-step mechanism above, and flag any gap for legal before your next agent deployment. Read the full OpenAI announcement and its stated principles so procurement is arguing from the primary source, not a summary.
Tags