OpenAI pledges AI safety checks—no customer data stored

On August 19, 2026, OpenAI announced a new system designed to detect misuse of its most powerful AI models across multiple interactions—without storing customer conversations or giving employees access to them. The technology, called Private Safety Processing, is meant to keep Zero Data Retention available for organizations working with sensitive data.

The announcement targets business customers and developers using OpenAI’s API. With Zero Data Retention (ZDR), OpenAI does not retain prompts or model outputs for eligible API customers after processing. According to OpenAI, that means employees cannot view customer content. Business data also isn’t used to train models unless a customer explicitly opts in.

The challenge: as AI systems grow more capable, they can act autonomously for longer. Harmful or unwanted behavior may unfold across several tasks and interactions. A safety check that evaluates each prompt in isolation might miss those patterns.

Private Safety Processing analyzes patterns across related AI interactions without making the underlying customer content accessible to OpenAI employees. It’s an attempt to reconcile two demands that increasingly collide with advanced AI: privacy and safety monitoring.

Existing systems compatible with Zero Data Retention mostly review interactions one by one, according to OpenAI. The new system can instead detect links across multiple interactions. That should help, for example, when someone repeatedly tries to bypass safeguards or when risks only surface during a longer AI-run process.

This becomes more critical with the rise of AI agents—systems that don’t just answer a question but execute multi-step tasks, tapping software and external tools along the way.

OpenAI cites an example: an agent that keeps acting after a user says to stop. A single interaction reveals little, but the sequence of actions can expose a safety issue.

OpenAI aims to run analysis without giving employees access to the underlying prompts and responses. In ZDR setups, customer content, according to the company, remains on infrastructure controlled by the customer.

OpenAI is also developing a second option: information can be stored on OpenAI infrastructure but encrypted with keys controlled by the customer. OpenAI says its employees do not receive copies of those keys and therefore cannot decrypt the content.

When the system flags a potential risk, OpenAI says it receives only a limited safety signal about the type of activity. The company can then use that signal to decide whether action is needed.

Even when an interaction is flagged, employees do not automatically gain access to the content, according to OpenAI. Customers can choose to share relevant information themselves—for instance, to appeal a decision or support an investigation into confirmed abuse.

More powerful frontier models sharpen the trade-off between data privacy and safety oversight. Companies want to avoid having sensitive information sit with an external AI vendor, while model developers need enough signals to detect serious abuse.

That tension is acute for organizations handling financial data, medical records, trade secrets, or proprietary research. For them, having an AI provider retain prompts can clash with internal security requirements, contracts, or regulation.

As a result, Zero Data Retention is more than a privacy feature—it can be a prerequisite before organizations move critical processes to generative AI.

OpenAI has already tied ZDR to use cases involving sensitive data. Its HIPAA guidance, published in March, shows that Zero Data Retention and custom retention options are part of the configuration for certain healthcare applications via the API.

The key technical shift is in what OpenAI itself receives. Private Safety Processing aims to derive safety signals without requiring employees to view full conversation content.

That principle will matter more as AI agents become more autonomous. Safety systems must assess not just what a model says at a single moment, but whether a chain of actions, taken together, points to misuse or unwanted behavior.

At the same time, the exact technical mechanics remain largely under wraps. OpenAI is calling the technology a preview for now and says it’s currently testing with early customers. The company plans to start rolling it out in September, alongside a technical whitepaper.

That document will be key to assess how much signal the safety data really carries, which cryptographic techniques are used, and what practical limits the approach has.

Zero Data Retention doesn’t mean no data can ever be kept under any circumstance. OpenAI explicitly points to a legal exception for potential child sexual abuse material.

Images flagged as potentially such material may be preserved under Zero Data Retention for human review and legally required reporting, the company says. According to OpenAI, that exception also applies to current ZDR implementations.

Enterprise users should not treat Zero Data Retention as an absolute guarantee that data can never be stored under any condition.

The announcement underscores that competition in advanced AI isn’t just about benchmarks, speed, or price. How vendors handle corporate data is becoming a defining factor.

That creates a new technical trade‑off for organizations. A powerful model is less appealing if it requires sensitive prompts to be stored long‑term by an external provider. At the same time, companies want to avoid deploying AI infrastructure without robust safety controls.

Private Safety Processing is OpenAI’s bid to satisfy both demands. Whether it does so convincingly will be clearer when the company releases its promised whitepaper in September and makes the technology more widely available.