Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
“Our access to API business data stored on our systems is limited to (1) authorized employees that require access for engineering support, investigating potential platform abuse, and legal compliance and (2) specialized third-party contractors...”
“Your fine-tuned models are for your use alone and never served to or shared with other customers or used to train other models.”
“After 30 days, API inputs and outputs are removed from our systems, unless we are legally required to retain them.”
“We may run any business data submitted to OpenAI's services through automated content classifiers and safety tools, including to better understand how our services are used.”
“We are able to sign Business Associate Agreements (BAA) in support of customers' compliance with the Health Insurance Portability and Accountability Act (HIPAA).”
“data from ChatGPT Business, ChatGPT Enterprise, ChatGPT for Healthcare, ChatGPT Edu, ChatGPT for Teachers, and the API Platform (after March 1, 2023) isn't used for training our models, unless you have explicitly opted in...”
This document governs how OpenAI handles your business data when you use its enterprise products or API. By default, OpenAI does not use your data to train its models, and it deletes your API inputs and outputs after 30 days. Only a narrow set of authorized OpenAI employees can access your conversations, and only for specific permitted reasons.
This document establishes OpenAI's data handling obligations and customer rights for enterprise and API use of its services. It sets a default of no model training from business data, with training permitted only upon explicit customer opt-in, and imposes a 30-day retention ceiling on API inputs and outputs followed by deletion unless law or harm-protection purposes require longer retention. Access to customer conversations and API business data is restricted to authorized personnel for an exhaustive set of enumerated purposes. Customers retain intellectual property rights over their inputs and outputs to the extent permitted by law, and fine-tuned models are exclusively reserved for the creating customer with no sharing or cross-training permitted.
As a business customer, your data is not used for model training unless you explicitly opt in, and your API inputs and outputs are deleted after 30 days by default. Your fine-tuned models are kept exclusively for your use and never shared with other customers or used to train other models. You own the rights to your inputs and the outputs you receive, to the extent permitted by law. If you have a qualifying use case, you can request zero data retention for eligible API endpoints.
Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.
We withheld clauses we had published from this document. Each withholding is recorded in our correction log:
“Our access to API business data stored on our systems is limited to (1) authorized employees that require access for engineering support, investigating potential platform abuse, and legal compliance and (2) specialized third-party contractors...”
“Your fine-tuned models are for your use alone and never served to or shared with other customers or used to train other models.”
“After 30 days, API inputs and outputs are removed from our systems, unless we are legally required to retain them.”
“We may run any business data submitted to OpenAI's services through automated content classifiers and safety tools, including to better understand how our services are used.”
“We are able to sign Business Associate Agreements (BAA) in support of customers' compliance with the Health Insurance Portability and Accountability Act (HIPAA).”
“data from ChatGPT Business, ChatGPT Enterprise, ChatGPT for Healthcare, ChatGPT Edu, ChatGPT for Teachers, and the API Platform (after March 1, 2023) isn't used for training our models, unless you have explicitly opted in...”
“Any deleted or unsaved conversations are removed from our systems within 30 days, unless longer retention is required by law, or is reasonably necessary to protect our services or any third party from harm.”
“you retain all rights to the inputs you provide to our services and you own any output you rightfully receive from our services to the extent permitted by law.”
“By default, we do not use your business data for training our models.”
“Authorized OpenAI employees will only ever access your conversations for the purposes of resolving incidents, recovering end user conversations with your explicit permission, or where required by applicable law.”
“You can also request zero data retention (ZDR) for eligible endpoints if you have a qualifying use-case.”
Every distinct legal provision identified in this document. Featured provisions appear above with analysis.
We have not recorded a change to this document since we began capturing it. Monitor includes alerts from a daily check, structured change summaries, and monitoring for up to 20 platforms.
Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.
Cross-platform context
See how other platforms handle API access limited to authorized employees and contractors and similar clauses.
Compare across platforms →OpenAI expanded its data sharing terms to include third-party marketing partners. The updated policy authorizes the use of personal data fo…
872 provisions across 8 AI platforms. The terms your AI provider sets become the terms your product operates under.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
The bill does not regulate most AI startups directly. But it changes the companies they depend on. Here is what the first federal AI law wo…
H.R. 8094 would make the FTC the referee for AI model disclosure. It also names system cards as a way to comply, which turns a voluntary in…
Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 343 platforms.