OpenAI API Data Retention & ZDR in 2026

OpenAI API data retention and zero data retention (ZDR)

OpenAI does not train on API data by default, and keeps API inputs and outputs for up to 30 days for abuse monitoring. Zero data retention (ZDR) removes that 30-day window for eligible customers on approved endpoints. It is not self-serve. Since 22 September 2026, OpenAI has been rolling out Private Safety Processing to API customers in phases. It runs automated safety checks across related requests so OpenAI can keep offering ZDR, and OpenAI staff never see your content. Here is who qualifies, what OpenAI still keeps, and how to use OpenAI in Meetily with your own key.

OpenAI's API training default

OpenAI's enterprise privacy page commits that data submitted through the OpenAI API, ChatGPT Enterprise, and ChatGPT Team is not used to train OpenAI's models. The consumer ChatGPT free and Plus tiers default differently and are out of scope for this page.

When Meetily users select OpenAI as their summary provider via BYOK, the request hits api.openai.com under your API key and your account's contract. The defaults on this page apply unless you have a separate enterprise arrangement.

Retention

OpenAI's documented default for API inputs and outputs is short-term retention for abuse monitoring (up to 30 days as published by OpenAI), after which the data is deleted unless legal obligations require longer retention. Specific endpoints such as fine-tuning, Assistants, and Stored Completions have their own retention semantics that you opt into when you use those features.

For exact retention windows, consult OpenAI's enterprise privacy documentation and your Business Associate Agreement (if applicable). Reviewing those before deployment is recommended for regulated workloads.

Zero data retention

OpenAI offers zero data retention for eligible customers on supported endpoints. With ZDR, prompts and outputs are not stored after the request completes, and the store parameter is always treated as false even if a request sets it to true. Supported endpoints include /v1/chat/completions, /v1/responses, /v1/embeddings, /v1/audio/transcriptions, /v1/audio/translations, /v1/moderations, and others enumerated in OpenAI's data-controls documentation. ZDR is an approved, opt-in control rather than a self-serve toggle: eligibility and the current endpoint list are published by OpenAI, and your account team must enable it at the organization or project level.

Even under ZDR, OpenAI's documentation notes that logs may be retained where longer retention is required by law or is reasonably necessary to protect its services or any third party from harm. "Zero retention" is therefore not absolute in every legal sense, though it removes the routine 30-day abuse-monitoring window.

Private Safety Processing (September 2026)

On 19 August 2026 OpenAI previewed Private Safety Processing, and on 22 September 2026 it began rolling it out to API customers in phases. OpenAI's existing ZDR-compatible safety checks look at one request at a time. Private Safety Processing looks across related requests, because some misuse only shows up as a pattern. OpenAI says the point is to keep offering ZDR as frontier models become more capable.

How it treats your content:

For ZDR deployments, customer content stays on infrastructure the customer controls. OpenAI is also developing an option that stores content on OpenAI infrastructure, encrypted with keys the customer holds and OpenAI does not.
When the system flags something, OpenAI receives a narrow signal: the type and severity of the activity. OpenAI staff do not get access to the prompts or responses, even when content is flagged.
The customer receives the full alert and can choose to share details with OpenAI, for example to appeal.

Eligibility for ZDR has not changed: it is still offered to eligible API customers, with OpenAI's approval. One exception applies even under ZDR: images flagged as potential child sexual abuse material (CSAM) are retained for manual review and reporting, because the law requires it.

Litigation note (New York Times)

A 2025 preservation order in the New York Times copyright litigation required OpenAI to retain output data going forward, overriding the normal deletion schedule. That order applied to consumer ChatGPT (Free, Plus, Pro, Team) and to API customers without a ZDR agreement; API customers with a ZDR agreement, ChatGPT Enterprise, and ChatGPT Edu were excluded. OpenAI has stated that the obligation to retain that going-forward content ended on 2025-09-26.

The case is ongoing. In early 2026 a court ordered OpenAI to produce a sample of de-identified consumer ChatGPT logs in discovery; that production concerns consumer logs, not API traffic covered by a ZDR agreement. For any regulated Meetily deployment, confirm the current posture against OpenAI's published statements, and prefer a ZDR agreement or a local summary provider where the routine deletion schedule must not be overridable.

How Meetily uses OpenAI

Meetily routes OpenAI traffic through your own API key. Your account's contract terms apply. The transcript text is sent over TLS to api.openai.com for summarization, and the response is returned to Meetily and stored locally on your device. Audio is never transmitted to OpenAI at any point.

If you want stronger guarantees than the cloud default offers, switch your summary model to a local provider (Ollama). Meetily's transcription path is already local, so the local-summary path keeps the entire pipeline on-device.

References

The facts on this page were last checked on 2026-09-26 against sources 1 and 5, and on 2026-06-29 against the others. Confirm against the linked policies, which OpenAI may update at any time.

"Data controls in the OpenAI platform," OpenAI. https://developers.openai.com/api/docs/guides/your-data (accessed 2026-09-26). States API data is not used to train or improve OpenAI models unless you opt in, documents the 30-day abuse-monitoring retention, the ZDR-eligible endpoint list, and the legal-retention caveat.
"Enterprise privacy at OpenAI," OpenAI. https://openai.com/enterprise-privacy/ (accessed 2026-06-29). No-training commitment for API, ChatGPT Enterprise, and ChatGPT Team, plus enterprise compliance posture.
"How we're responding to The New York Times' data demands in order to protect user privacy," OpenAI. https://openai.com/index/response-to-nyt-data-demands/ (accessed 2026-06-29). Scope of the preservation order, exclusion of ZDR API customers and enterprise tiers, and the 2025-09-26 end of the going-forward retention obligation.
"OpenAI Loses Privacy Gambit: 20 Million ChatGPT Logs Likely Headed to Copyright Plaintiffs," Jones Walker LLP / National Law Review, 2025. https://natlawreview.com/article/openai-loses-privacy-gambit-20-million-chatgpt-logs-likely-headed-copyright (accessed 2026-06-29). Corroborates the early-2026 discovery order for de-identified consumer ChatGPT logs.
"Offering Zero Data Retention for frontier models," OpenAI, 19 August 2026, updated 22 September 2026. https://openai.com/index/offering-zero-data-retention-for-frontier-models/ (accessed 2026-09-26). Source for Private Safety Processing, its phased rollout to API customers, what OpenAI receives when content is flagged, and the CSAM exception under ZDR.

Frequently asked questions

Does OpenAI train models on my API prompts and outputs?

No, not by default. OpenAI's enterprise privacy page commits that data submitted via the API, ChatGPT Enterprise, and ChatGPT Team is not used to train OpenAI's models. The consumer ChatGPT free and Plus tiers are governed by different settings; this page covers the API path.

How long does OpenAI retain my API prompts and outputs?

OpenAI's published default for API inputs and outputs is up to 30 days for abuse monitoring, after which they are deleted, unless legal obligations require longer retention. Specific endpoints (e.g., fine-tuning, Assistants) carry their own retention semantics described in OpenAI's documentation.

Is zero data retention (ZDR) available for the OpenAI API?

Yes, for eligible customers on supported endpoints. ZDR removes the 30-day default retention so prompts and outputs are not stored after the request completes; when ZDR is active the store parameter is always treated as false. Supported endpoints include /v1/chat/completions, /v1/responses, /v1/embeddings, /v1/audio/transcriptions, /v1/audio/translations, and others listed in OpenAI's data-controls documentation. ZDR is an approved, opt-in control: contact your OpenAI account team to enable it at the organization or project level. Note that even under ZDR, OpenAI may retain logs where longer retention is required by law or is reasonably necessary to protect its services or third parties from harm.

What is Private Safety Processing, and does it change ZDR?

It is an automated safety system OpenAI previewed on 19 August 2026 and began rolling out to API customers in phases on 22 September 2026. It looks for misuse patterns across related requests, not just one request at a time, so OpenAI can keep offering ZDR as models get more capable. For ZDR deployments, customer content stays on infrastructure the customer controls, and OpenAI receives only a narrow signal (the type and severity of a potential issue), not the prompts or responses. OpenAI staff do not get access to the content, even when it is flagged. Who can get ZDR has not changed: it is still for eligible customers, with OpenAI's approval.

Where is OpenAI API data stored geographically?

OpenAI processes API traffic primarily on US infrastructure. Data residency options (e.g., European data residency) are available for eligible enterprise contracts; consult OpenAI sales for the current geographic scope.

How do I request deletion of data OpenAI has retained?

For API accounts, OpenAI deletes data on the published retention schedule by default. For deletion of data outside the default schedule, submit a request through OpenAI's privacy contact channels per the privacy policy on openai.com.

Does the New York Times lawsuit against OpenAI affect my API data retention?

A 2025 court order in the New York Times copyright litigation required OpenAI to preserve output data going forward, overriding the normal deletion schedule for consumer ChatGPT (Free, Plus, Pro, Team) and API customers without a ZDR agreement. API customers with a Zero Data Retention agreement, ChatGPT Enterprise, and ChatGPT Edu were excluded from that preservation order. OpenAI has stated that its obligation to retain that going-forward content ended on 2025-09-26. The case continues, and in early 2026 a court ordered OpenAI to produce a sample of de-identified consumer ChatGPT logs; that discovery concerns consumer logs, not API traffic covered by ZDR. Confirm the current status against OpenAI's published statements before relying on this for a regulated workload.

Does OpenAI have SOC 2, HIPAA, or other compliance certifications?

OpenAI publishes its compliance posture on their Trust Portal. SOC 2 Type 2 is available; HIPAA BAAs are available for eligible enterprise customers on supported endpoints. Consult OpenAI sales for the current scope.

How does Meetily handle OpenAI when I pick it as my summary provider?

Meetily transcription runs 100% locally by default. When you select an OpenAI model as your summary provider via BYOK, Meetily routes transcript text (not audio) to api.openai.com using your own API key. The retention and training defaults on this page apply to your traffic, not Meetily's.

What if I want zero retention but my OpenAI account does not have ZDR enabled?

Two options: ask your OpenAI account team to enable ZDR on your workspace, or switch your Meetily summary model to a local provider like Ollama. Meetily's transcription path is unchanged on the local-summary route, so the entire pipeline runs on your device.