OpenAI keeps Zero Data Retention on frontier models

On 19 August 2026 OpenAI made a more demanding claim than a new privacy clause: it will keep offering Zero Data Retention (ZDR) for frontier models while safety systems look for patterns across multiple interactions. In «Offering Zero Data Retention for frontier models» the lab previews Private Safety Processing. The point is to catch misuse and agent drift without giving OpenAI staff access to the underlying prompts or responses.

This is a governance issue, not a feature drop. As agents take on longer tasks, a single isolated request is a weak security window. At the same time, banks, health providers, law firms and public bodies cannot accept a frontier vendor holding 30 days of customer prompts «for safety». OpenAI is positioning ZDR as the answer. Anthropic has already chosen a different line for its most capable models.

What OpenAI actually promises

For eligible API customers, OpenAI describes ZDR as three commitments:

• Prompts and model responses are not retained after a request is processed.
• Customer content is not available to OpenAI personnel for review.
• Enterprise data is not used for training unless the customer explicitly opts in.

Today’s ZDR-compatible safety systems evaluate each interaction on its own. That is too narrow when risk only becomes visible over time: an actor who splits harmful steps across sessions, coordinates across accounts, disguises probing as research, or an agent that keeps acting after the user said stop.

Private Safety Processing is meant to extend monitoring across related interactions. When risk is flagged, OpenAI receives a narrowly defined signal about the type of activity, not the content itself. The company can then decide whether enforcement is needed. Customers investigate alerts in their own systems. If they want to appeal, document legitimate work, or support a case of verified abuse, they can choose to share information.

Two storage models are described:

• Classic ZDR: content stays on infrastructure the customer controls.
• An option in development: content is stored on OpenAI infrastructure, encrypted with keys the customer controls. OpenAI staff do not hold copies of those keys, so they should not be able to read the underlying content.

In both cases, automated systems are supposed to return limited safety signals without exposing prompts and responses to personnel. The approach is being tested with early customers. OpenAI plans to start rolling it out and to publish a technical white paper in September 2026.

Glean CISO Sunil Agrawal is quoted saying enterprise AI adoption depends on customer control of data, with no direct or derivative use beyond the chosen service. The no-training commitment and ZDR give Glean confidence to build on OpenAI.

What this is set against

OpenAI does not name a rival. TechCrunch does, and Anthropic’s own support page confirms the policy. From 9 July 2026 Anthropic requires limited retention and review for so-called covered models. Prompts and outputs are kept for 30 days on every platform where those models are offered. That applies to Mythos-class models and future models with similar capabilities that Anthropic designates as covered. Other models stay on existing terms.

Anthropic’s rationale is that Claude Mythos 5 and Fable 5 add capabilities that can be misused. For ZDR customers that effectively means turning on retention in a workspace, cloud subscription or a separate Azure subscription to get the most capable models. By default Anthropic staff cannot read retained conversations. Human review happens only through a controlled access path, for example when automated systems flag potential harm, by a small set of approved reviewers, with a tamper-proof log. After 30 days the data is deleted automatically, except for flagged cases and legal holds.

That is the real fork: OpenAI says frontier safety should run without the vendor retaining content. Anthropic says the most capable models require 30 days of retention so patterns can be seen over time. Both point at the same problem. They offer different answers to the CIO, CISO and DPO.

TechCrunch frames this as a fight for enterprise trust. That is relevant, but secondary. For a board the question is not who «wins privacy». It is which data-processing agreement, which risk picture and which burden of proof you can defend when agents touch core processes.

What this means for Nordic leaders

Treat it as DPA, DPIA and supplier-control work, not a chatbot policy.

First: ZDR is not «OpenAI stores nothing». It is an approval-based API commitment for eligible customers. Staff using free or Go ChatGPT sit on a different surface with different terms. Separate the API/enterprise contract from consumer use before you quote the post in board papers.

Second: Private Safety Processing is a preview, not a production guarantee. The white paper is due in September. Until then you do not know how pattern detection technically runs on customer-controlled infrastructure, what false positives you will get, or how a «narrow signal» lands in your SIEM. Ask for architecture, data minimisation, subprocessors, key handling, deletion, and what happens under legal process.

Third: cross-session monitoring is exactly what agent platforms need, and exactly what privacy law makes hard. GDPR requires purpose limitation, storage limitation and access rights. A signal without content may be easier to defend than 30 days of full retention. It can also make it harder to reconstruct why an account was blocked. Require that the customer owns the alerts, can reconstruct the decision in its own logs, and can appeal without handing over more data than needed.

Fourth: customer-controlled keys are not the same as data never leaving your control. Encrypted storage at the vendor is still vendor risk: availability, jurisdiction, misconfiguration and future exceptions. If the requirement is that OpenAI must never be able to read the content, key procedures, HSM and breach notification need the same rigor as a cloud KMS.

Fifth: model choice becomes a privacy decision. If you need Anthropic’s Mythos class, 30-day retention belongs in the DPIA. If you can live with OpenAI’s ZDR pledge, you still have to govern agents, tool access and logging yourself. Switching vendors to «avoid retention» without strengthening your own monitoring only moves the responsibility.

Decisions for the next 90 days

• Map which frontier models actually touch regulated data, source code, client files and agent tools. Separate experiments from production.
• Update the data-processing agreement and DPIA with an explicit ZDR or retention choice per model class, not per brand.
• Require the vendor to document what a safety signal contains, how long it lives, who can trigger enforcement, and how you appeal.
• Log agent prompts, tool calls and outputs in your own control zone. Vendor ZDR does not remove the need for internal traceability.
• Do not accept «safety requires we read everything» or «privacy requires we see nothing» as a board answer. Demand a third path: automated pattern detection, customer-controlled keys where needed, and human review only on flags you can reconstruct.

OpenAI has heard that customers want predictability. That is right. Predictability arrives when the white paper, the contract and your own logs match. Until then this is a direction of travel, and a clear signal that frontier safety and enterprise privacy can no longer be bought as two separate products.

Sources and media

• Primary source: OpenAI, «Offering Zero Data Retention for frontier models», 19 August 2026 — https://openai.com/index/offering-zero-data-retention-for-frontier-models/
• source_name: OpenAI
• Corroboration: TechCrunch, «OpenAI seeks to one-up Anthropic with new customer privacy protections», 19 August 2026 — https://techcrunch.com/2026/08/19/openai-seeks-to-one-up-anthropic-with-new-customer-privacy-protections/
• Anthropic support: «Data retention practices for Covered Models», 9 July 2026 — https://support.claude.com/en/articles/15425996-data-retention-practices-for-covered-models
• Official X post: OpenAI, 19 August 2026 — https://x.com/OpenAI/status/2090165328290701800
• Thumbnail: OpenAI Image 2 / hogby.ai