Reviewing related exchanges without retaining them, OpenAI says
OpenAI on Nov. 5 (Nov. 6 Japan time) introduced "Private Safety Processing (PSP)," a safety review system for users of its API (the interface software uses to call the AI), on its official X account for developers. It says it can review multiple related exchanges together without retaining prompts (instructions to the AI) or responses. Records stay in the user's environment, an automated safety agent reviews them, and OpenAI employees cannot access the content, it said. These are OpenAI's statements, and no third-party audit or verification could be confirmed.
Private Safety Processing lets OpenAI review related API requests for safety without retaining your prompts or responses. Records stay in your environment, where an automated safety agent reviews them without OpenAI personnel being able to access your content.
PSP is a mechanism for detecting misuse under "zero data retention (ZDR)" contracts, under which prompts and responses are not kept after processing. Previous systems examined each exchange individually. PSP aims to catch activity not visible in a single exchange, such as repeatedly probing safeguards or coordination across multiple accounts. OpenAI announced a trial on Aug. 19 (U.S. time) and has positioned it as one of the pillars of "OpenAI Private Intelligence," an initiative to bring in companies' confidential work.
It is unclear whether the latest post announced the start of availability. In August, OpenAI said it would begin a phased rollout starting in September. edgeX, which carried an article from CryptoBriefing, reported that a phased rollout to API customers began on Sept. 22, but ORIENS could not confirm this date in OpenAI's materials. The official developer guide says organizations approved for ZDR can configure it from the API dashboard.
The text of the post could not be opened directly from this environment, and the full text was confirmed via the fxtwitter API. The contents of the video attached to the post were not checked.
Encrypted records kept in customers' clouds, reviewed in an isolated environment
According to the developer guide, exchanges subject to review are those selected by safety classifiers or approved sampling policies. Being selected does not by itself constitute a finding of a violation, it says. Selected records are encrypted and written to a cloud storage location managed by the customer, without stopping response generation. OpenAI retains metadata (attribute information about the records) and a reference to the storage location, but no copy of the content, it says.
Review takes place later in an environment called the "Safety Review Runtime." The company says this environment proves its integrity through hardware and cuts off human access, and that it is the only part of OpenAI's processing that can decrypt customer content. Only limited safety signals and operational metadata leave it in plain text. Detailed results are encrypted and returned to the customer's storage location. Stored content is not used to train models and is not passed to other OpenAI departments or partners, it says.
When a problem is found, OpenAI makes the enforcement decision. OpenAI receives limited signals indicating the type of activity, and customers can investigate in their own systems and choose whether to provide information for appeals or investigations. The guide lists responding to notices of safety concerns and investigating with OpenAI as customer responsibilities.
| Method | Where content is stored | Period |
|---|---|---|
| Standard API | OpenAI's abuse monitoring logs | Up to 30 days |
| ZDR | Excluded from abuse monitoring logs | Not stored (with exceptions) |
| ZDR with PSP | Customer's cloud (encrypted) | 30 days |
| Private Retention with PSP | OpenAI-managed infrastructure (encrypted) | Not confirmed in official materials |
Even with "zero retention," 30 days of records on the customer side
Even if OpenAI does not retain content, encrypted records remain with the customer. Records expire after 30 days, customers are obliged to keep them for at least 30 days and must not configure them to be deleted sooner. During that time, they must maintain the storage location, permissions and key authorization. VentureBeat pointed out that because encrypted copies remain after inference, companies need to check this against legal, regulatory and internal retention policies.
The scope of application is also broad. PSP is enabled per project and applies to all API traffic in that project, including requests to models that do not require PSP. To keep using ZDR without PSP, a separate project is needed.
Encryption keys are layered: OpenAI manages the inner key, and customers can use their own managed keys (EKM) for the outer layer. OpenAI recommends enabling EKM. With EKM enabled, OpenAI's key alone cannot decrypt the content. However, revoking authorization does not delete stored records or undo processing that has already been completed.
Exceptions to claim that employees cannot see content; no third-party verification found
OpenAI's materials also describe exceptions to the statement that employees cannot see content. Images suspected of depicting child sexual abuse are retained for human review even under ZDR or PSP. When necessary to investigate or prevent serious risks, the company may exclude models from ZDR for specific customers after giving prior written notice. Under this "Safety Retention," content that classifiers flag as a possible violation is retained and may be reviewed by humans.
No third-party audit report verifying the technical description was found. OpenAI explains the technical design in a white paper, but no material in which an outside party confirmed that employees cannot access content could be found. Pawan Khandavilli, who works on confidential computing product development at Microsoft, analyzed the 36-page document, published in September, on his personal blog and pointed out that the chain of verification relies mainly on controls by OpenAI and its auditors. Customers do not get the raw attestation data for each review or a way to link published code to the processes actually running, he said.
He also cited other limitations. The original API requests are outside PSP's protection, and protection of inference as a whole is handled by "Private Inference," which is still in trial. Metadata that remains for 30 days could be used to infer who was flagged, when and how many times. The white paper acknowledges that it sets no cap on the total amount of information disclosed when reviews are repeated, he said.
The original white paper is a large file, and ORIENS could not check it directly. Its contents are as read by Khandavilli. His article reflects his personal views and is not the result of an audit or field testing.
Terms of use: for API organizations approved for ZDR, pricing unconfirmed
PSP is available to API organizations that OpenAI has approved for ZDR. ZDR requires prior approval and agreement to additional requirements, and eligibility is checked through the sales team. ChatGPT's individual Free, Plus, Go and Pro plans are not eligible. How far the phased rollout has spread could not be confirmed.
Four storage options can be used: Amazon S3, Azure Blob Storage, Google Cloud Storage and Oracle (OCI) Object Storage. Azure requires specifying an approved U.S. or EU region, and OCI lists 4 U.S. regions and 10 EU regions. There is no list of regions for AWS and Google Cloud. The guide does not mention Japanese or Asian regions, and whether storage in Japan can be used is unconfirmed.
Pricing is not given in either the developer guide or the data controls documentation. Nor does it say who bears the cost of the cloud storage. The guide refers to models that require PSP but does not list them. Whether ChatGPT Enterprise for businesses is covered could not be confirmed either.
Anthropic also keeps records in customers' clouds, at no charge
Anthropic has also moved on the same issue. Starting June 9 (U.S. time), the company required 30-day data retention even for enterprise customers on its top models, "Fable 5" and "Mythos 5," but after pushback it announced "Enterprise Frontier Safeguards" on Sept. 1 (U.S. time). Records used for automated review can be kept in customers' Amazon S3, Azure Blob Storage or Google Cloud Storage and managed with customers' keys.
The 2 companies differ in where detection results go. In Anthropic's system, detection signals go to the customer, the customer's team responds, and no review by Anthropic employees is needed. In OpenAI's PSP, limited signals go to OpenAI, and OpenAI decides on enforcement. Anthropic charges no usage fee, and customers bear only cloud costs. However, it is rolling out in phases starting "later this fall," and until then eligible customers can use Fable 5 and 5.1 under ZDR. Reuters reported in August that the 30-day retention requirement would continue, but Anthropic's announcement does not state a retention period.
- Anthropic applies 30-day retention to enterprise customers on top modelsReport
- OpenAI announces PSP trialOfficial
- Anthropic announces Enterprise Frontier SafeguardsOfficial
- OpenAI begins phased rollout of PSPReport
- OpenAI announces Private Intelligence at DevDayOfficial
- OpenAI Devs introduces PSP on official X accountOfficial
Anthropic gains share of corporate spending
In corporate spending, Anthropic is gaining share. According to an index from corporate card company Ramp, OpenAI's share of spending on AI models fell from 44.2% in the week of Sept. 25 to 35.1% in the week of Oct. 23, while Anthropic's rose from 51.3% to 60.5%. Ramp's figures cover only payments by companies using its corporate cards. Whether PSP can win wider adoption for confidential work, where data handling is a selection criterion, will hinge on disclosure of pricing and covered models and on outside verification.
