Your security team signed off on the API integration on one condition: nothing you send leaves your control. Then the good models started arriving with a retention clause attached, and that sign-off quietly expired. On August 19 OpenAI pushed back. It's previewing Private Safety Processing, a way to keep Zero Data Retention on frontier models while still watching for abuse across a whole agent run rather than one call at a time. Content stays on infrastructure you control, or on OpenAI storage encrypted with keys OpenAI doesn't hold. When something trips, OpenAI receives a narrow signal about the type of activity, not your prompts. Anthropic went the other way in June and requires 30 days of retention on its covered models. So the trade is a live procurement question now, and one side of it is still a promise with a September date on it.
The short answer
OpenAI says Zero Data Retention keeps working on its frontier models. The new piece is Private Safety Processing: automated systems correlate abuse patterns across related calls, then hand OpenAI a narrow signal instead of your prompts. Content stays on your infrastructure, or on OpenAI storage encrypted with keys you hold. Anthropic took the opposite route in June and does not offer ZDR on covered models. OpenAI’s version is a preview. Anthropic’s is already policy.
What OpenAI actually announced
Zero Data Retention is an old promise and OpenAI restated it plainly: for eligible API customers, prompts and model responses aren’t retained once a request has been processed, that content isn’t available to OpenAI staff for review, and enterprise data isn’t used for training without an explicit opt-in.
The problem OpenAI describes is real, and it isn’t unique to OpenAI. A single request rarely looks dangerous. The pattern does. Someone probing a safeguard the same way forty times, or coordinating across accounts, or an agent that keeps acting after it’s been told to stop. ZDR-compatible safety systems today score each interaction on its own, which is exactly the wrong shape for that.
Private Safety Processing is the attempt to widen the window without widening who can read your data. Automated systems look across related interactions. If something trips, OpenAI receives a narrowly defined signal describing the type of activity, and uses that to decide whether enforcement is warranted. Staff don’t get the content even then. You investigate the alert with your own logs, and if you want to appeal or support an investigation, you choose what to hand over.
Image: OpenAI
Glean, Databricks, Abridge and Microsoft are named on the announcement as customers shaping it. Glean’s CISO, Sunil Agrawal, is the only one quoted. Preview, early customers, no numbers.
The other lab picked the other side
This landed as competitive positioning and it reads that way, so let’s be exact about what it’s positioned against.
Anthropic’s own privacy documentation says prompts and outputs from covered models are retained for 30 days to support safety work, effective 9 June 2026. Covered models are the Mythos-class models plus future ones Anthropic designates, and Claude Fable 5 shares that underlying model. ZDR isn’t available for them. An organisation already running a zero-retention workspace has to switch retention on to get access, and that holds across the Claude API, AWS Bedrock, Google Cloud Agent Platform, Azure Foundry and Claude Enterprise. After 30 days the data is deleted automatically, minus anything flagged by trust and safety or held for legal reasons. Eligible organisations can add customer-managed encryption keys and access transparency logs.
Honestly, both readings of the problem are defensible. Anthropic’s is that if you need cross-interaction context, you need the interactions, so say so and put a clock on it. OpenAI’s is that you can get the signal without the content, which is a harder engineering claim and a much easier sell.
What it changes for you this week
Not much, and that’s the honest answer. If your ZDR terms are already in place with OpenAI, nothing in this announcement removes them. That’s the actual news: a reaffirmation, at a moment when the direction of travel looked like the opposite.
Where it does change something is the shortlist. Teams handling health records, legal files or client data under contractual no-retention clauses have been quietly ruling out certain models for weeks. If you’re one of them, the shortlist just got longer on the OpenAI side and stays shorter on the other. Whether that’s the right way to pick a model is a separate argument, and it’s not one your compliance officer is going to lose.
One thing worth doing now: go and read what your current agreement actually says, rather than what you remember it saying. Model tiers move. We watched GPT-5.6 ship in three variants with different availability rules, and retention eligibility is exactly the kind of clause that gets attached per model rather than per account.
The part that isn’t published yet
Everything rests on one assertion: automated systems can correlate behaviour across your calls, flag it, and no human at OpenAI ever sees what triggered it. That’s plausible. It’s also the exact thing a technical white paper exists to demonstrate, and the white paper comes in September along with the rollout.
Until then there’s no threat model, no general availability date, no pricing, no eligibility criteria, and no published list of the signals that leave your tenancy when something fires. I might be wrong about how much that matters to a CISO who mostly wants a direction of travel. But a preview announced against a competitor’s live policy is a different artefact from a shipped control, and it’s worth keeping the two apart in your notes.
September is the test. If the paper lands with a real description of how the correlation works and what the signals contain, this becomes a genuine option. If it slips, the announcement was positioning.
Sources
OpenAI, “Offering Zero Data Retention for frontier models” (official announcement, 19 August 2026, including the September rollout and white paper commitment and the CSAM footnote). Anthropic Privacy Center, “Data retention practices for Covered Models” (the 30-day retention policy, effective 9 June 2026, and the surfaces it applies to). TechCrunch on the announcement and its competitive framing. The Next Web on what the preview leaves unproven.
Frequently asked questions
What is Private Safety Processing?
It is a safety system OpenAI previewed on 19 August 2026 that looks for abuse patterns across related interactions rather than scoring each call on its own, without OpenAI personnel getting access to the underlying content. Customer content either stays on infrastructure the customer controls, which is the Zero Data Retention case, or sits on OpenAI storage encrypted with keys the customer holds. When a risk is identified, OpenAI receives what it calls a narrowly defined signal indicating the type of activity, and can act on that. It is in preview with early customers, with a rollout and a technical white paper promised for September.
Does Zero Data Retention still exist on OpenAI frontier models?
Yes. OpenAI restated the ZDR promise for eligible API customers: prompts and model responses are not retained after a request is processed, that content is not available to OpenAI personnel for review, and enterprise customer data is not used for training unless the customer opts in. One carve-out survives. Images flagged as potential child sexual abuse material are still retained for manual review and reporting, as they are today, because US law requires the report.
What does Anthropic require on covered models?
Anthropic retains prompts and outputs from covered models for 30 days to support safety work, a policy that took effect on 9 June 2026. Covered models are the Mythos-class models and future models with similar capabilities that Anthropic designates. ZDR is not available on those models, so an organisation with an existing zero-retention agreement has to enable retention to use them. That applies on the Claude API, AWS Bedrock, Google Cloud Agent Platform, Microsoft Azure Foundry and Claude Enterprise. Consumer plans are unaffected, and the data is deleted automatically after 30 days unless it was flagged or is legally held.
Can I put Private Safety Processing in a compliance document today?
We would not. It is a preview, not a general availability announcement, and OpenAI has published no white paper, no threat model, no eligibility criteria and no pricing. The claim that automated systems can correlate behaviour across calls while no human sees the content is the whole product, and none of the technical detail behind it is public until September. The existing ZDR terms in your contract are the thing you can point an auditor at right now.
Who is the customer-managed key option for?
Teams that want the cross-interaction safety coverage but cannot run the storage themselves. OpenAI says it is developing an option where content sits on OpenAI infrastructure encrypted with keys the customer controls, and that OpenAI personnel do not hold a copy of those keys. Practically that is the same shape as customer-managed encryption keys elsewhere in cloud, and the same questions apply: who can trigger a decrypt, under what process, and what gets logged when they do.
