Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document states that OpenAI maintains SOC 2 Type 2 certification and applies encryption to customer data both at rest and in transit for enterprise and API service tiers.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision discloses the security assurance framework applicable to enterprise data, which is a standard due diligence reference point for vendor security assessments and regulatory compliance programs requiring documented technical safeguards.
Interpretive note: The SOC 2 Type 2 report itself is not publicly reproduced; the scope of systems and controls covered must be verified by obtaining the report directly from OpenAI.
The updated policy now states that workspace admins 'can control' data retention rather than 'control' it, introducing subtle ambiguity about whether retention control is a guaranteed right or a permitted option. Additionally, the removal of the word 'workspace' before 'data' broadens the scope of data potentially subject to admin control beyond workspace-specific information. These changes could affect how enterprise customers understand the extent of their administrative authority over data retention practices.
View change record →The updated terms establish that workspace admins, rather than individual end users, control how long workspace conversation data is retained and authorize admins to view, access, export, and delete end user conversations. Previously, the policy stated that each user controlled whether their conversations were retained and that only end users could view their own conversations. The revised terms also permit OpenAI to retain deleted or unsaved conversations beyond the standard 30-day deletion window if retention is required by law or reasonably necessary to protect OpenAI's services or third parties from harm. Workspace users should review their organization's data governance policies to understand what access and retention practices their admins have implemented.
View change record →This generic security provision was removed, potentially indicating it was relocated to a separate security or compliance document or deemed less critical for the usage policy.
View full change record →Previous version 'Security Commitments and Certifications' had no excerpt; current version specifies SOC 2 Type 2 and encryption details, and severity downgraded from medium to low.
View full change record →Enterprise and API customers can reference SOC 2 Type 2 certification and encryption-in-transit and at-rest as disclosed technical security controls when conducting vendor risk assessments or satisfying regulatory documentation requirements.
How other platforms handle this
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
When you are asked to provide information, you may decline to do so; but if you choose not to provide information that is necessary to provide some of our Services, you may not be able to use those Services.
Monitoring
OpenAI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"We maintain SOC 2 Type 2 compliance and encrypt data at rest and in transit.Excerpt from OpenAI's API Data Usage Policies
1) REGULATORY LANDSCAPE: SOC 2 Type 2 certification is referenced by GDPR, HIPAA, and CCPA compliance programs as evidence of implemented security controls, though it is not a direct compliance certification under any of these frameworks. The FTC's Safeguards Rule and state security laws may also reference equivalent controls. 2) GOVERNANCE EXPOSURE: Low to Medium. SOC 2 Type 2 is a standard commercial security assurance mechanism. Compliance teams should request the current SOC 2 report to review the scope of controls, audit period, and any exceptions noted. The marketing disclosure does not substitute for review of the actual audit report. 3) JURISDICTION FLAGS: GDPR Article 32 requires appropriate technical and organizational measures; SOC 2 Type 2 can support but does not automatically satisfy this requirement. HIPAA Security Rule assessments should reference the SOC 2 scope to confirm coverage of relevant safeguards. 4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should request the SOC 2 Type 2 report under NDA as part of vendor onboarding, review the scope of systems covered, and assess any noted exceptions. Encryption specifications (algorithm, key management) are not disclosed on this page and should be requested separately. 5) COMPLIANCE CONSIDERATIONS: Organizations should document receipt and review of the SOC 2 report in their vendor management records, assess the audit period for currency, and request updated reports on renewal cycles. Penetration testing and vulnerability disclosure practices should also be assessed separately.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision discloses the security assurance framework applicable to enterprise data, which is a standard due diligence reference point for vendor security assessments and regulatory compliance programs requiring documented technical safeguards.
Enterprise and API customers can reference SOC 2 Type 2 certification and encryption-in-transit and at-rest as disclosed technical security controls when conducting vendor risk assessments or satisfying regulatory documentation requirements.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.