The document states that API inputs and outputs may be retained for up to 30 days for service provision and abuse identification, after which they are deleted unless legal retention obligations apply, and that zero data retention is available for eligible endpoints upon request for qualifying use cases.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the default data retention period for API data, the legal retention carve-out, and the availability of a zero data retention option that is conditional on endpoint eligibility and use case qualification, requiring proactive engagement by API customers to activate.
Interpretive note: Eligibility criteria for zero data retention and the definition of qualifying use cases are contained in external platform documentation referenced but not reproduced in this document, creating dependency on documentation that may change independently.
The updated policy now states that workspace admins 'can control' data retention rather than 'control' it, introducing subtle ambiguity about whether retention control is a guaranteed right or a permitted option. Additionally, the removal of the word 'workspace' before 'data' broadens the scope of data potentially subject to admin control beyond workspace-specific information. These changes could affect how enterprise customers understand the extent of their administrative authority over data retention practices.
View change record →The updated terms establish that workspace admins, rather than individual end users, control how long workspace conversation data is retained and authorize admins to view, access, export, and delete end user conversations. Previously, the policy stated that each user controlled whether their conversations were retained and that only end users could view their own conversations. The revised terms also permit OpenAI to retain deleted or unsaved conversations beyond the standard 30-day deletion window if retention is required by law or reasonably necessary to protect OpenAI's services or third parties from harm. Workspace users should review their organization's data governance policies to understand what access and retention practices their admins have implemented.
View change record →This new provision establishes specific retention timelines (30 days), purposes for retention, automatic deletion practices, and introduces a zero data retention option for qualifying use cases.
View full change record →Under this provision, API inputs and outputs are retained by default for up to 30 days. The zero data retention option is not automatic and requires the customer to request it for eligible endpoints with a qualifying use case, with the eligibility criteria and qualification standards referenced in platform documentation rather than specified in this document.
Cross-platform context
See how other platforms handle API Data Retention and Zero Data Retention Option and similar clauses.
Compare across platforms →"Except for certain endpoints and features listed in our platform documentation, OpenAI may securely retain API inputs and outputs for up to 30 days to provide the services and to identify abuse. After 30 days, API inputs and outputs are removed from our systems, unless we are legally required to retain them. You can also request zero data retention (ZDR) for eligible endpoints if you have a qualifying use-case.Excerpt from OpenAI's API Data Usage Policies [RETIRED: redirects to /enterprise-privacy/ (CA-D-000825)]
(1) REGULATORY LANDSCAPE: This provision engages GDPR storage limitation principles and HIPAA data minimization standards for API customers processing personal data or PHI.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes the default data retention period for API data, the legal retention carve-out, and the availability of a zero data retention option that is conditional on endpoint eligibility and use case qualification, requiring proactive engagement by API customers to activate.
Under this provision, API inputs and outputs are retained by default for up to 30 days. The zero data retention option is not automatic and requires the customer to request it for eligible endpoints with a qualifying use case, with the eligibility criteria and qualification standards referenced in platform documentation rather than specified in this document.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.