Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document states that API inputs and outputs may be retained for up to 30 days for service provision and abuse identification, after which they are deleted unless legally required to be retained, and that zero data retention is available for eligible endpoints on a qualifying use case basis.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the operative data retention posture for API Platform users and defines the conditions under which zero data retention may be requested. The availability of zero data retention is conditioned on endpoint eligibility and use case qualification, meaning it is not universally available.
The updated terms state that workspace admins 'can control' data retention rather than directly controlling it. This conditional phrasing may suggest that retention control is optional or contingent rather than a guaranteed capability. Enterprise customers relying on admin-driven data retention policies should clarify with OpenAI whether this change affects their ability to set specific retention timelines for workspace data.
View change record →The updated terms shift governance of conversation access and retention from end users to workspace administrators. Under the revised policy, workspace admins can now view, access, export, and delete any end user conversations within their workspace and control how long workspace data is retained. Additionally, OpenAI now reserves the right to retain deleted or unsaved conversations beyond the standard 30-day deletion window if retention is reasonably necessary to protect its services or any third party from harm, beyond prior language that limited retention extensions to legal requirements. Within an enterprise account, end users no longer have unilateral control over conversation visibility or deletion of their own conversations.
View change record →Current version clarifies the 30-day retention applies to all endpoints except documented exceptions, explicitly mentions abuse identification as a retention reason, and introduces the zero data retention (ZDR) option for eligible use cases.
View full change record →Under this provision, API inputs and outputs are retained for up to 30 days by default, with deletion thereafter absent legal requirements. Zero data retention is available only for eligible endpoints and qualifying use cases, requiring customers to assess and request this option rather than receiving it automatically.
Cross-platform context
See how other platforms handle API Data Retention and Zero Data Retention Option and similar clauses.
Compare across platforms →Monitoring
OpenAI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"Except for certain endpoints and features listed in our platform documentation, OpenAI may securely retain API inputs and outputs for up to 30 days to provide the services and to identify abuse. After 30 days, API inputs and outputs are removed from our systems, unless we are legally required to retain them. You can also request zero data retention (ZDR) for eligible endpoints if you have a qualifying use-case.Excerpt from OpenAI's Enterprise Privacy
(1) REGULATORY LANDSCAPE: This retention provision engages GDPR data minimization and storage limitation principles, which require that personal data be kept no longer than necessary for the specified purpose. The 30-day default retention for abuse identification may be assessed against GDPR's requirement that retention periods be justified. HIPAA minimum necessary and retention standards are relevant for API users processing protected health information under a BAA. (2) GOVERNANCE EXPOSURE: Medium. The conditionality of zero data retention on endpoint eligibility and use case qualification means that not all API processing activities may qualify for the most restrictive retention posture. Organizations with data minimization obligations should map their specific API endpoints against OpenAI's eligibility criteria and document the outcome. (3) JURISDICTION FLAGS: EU and UK organizations should assess whether the 30-day retention period for abuse identification is justified under GDPR's storage limitation principle and whether this is addressed in executed DPAs. Healthcare organizations in the US should confirm that their BAA addresses the 30-day retention window and that it is consistent with HIPAA obligations. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should confirm that executed enterprise agreements or DPAs specify the retention period and the conditions for zero data retention eligibility. The reference to 'certain endpoints and features listed in our platform documentation' means that retention terms may vary by endpoint and that platform documentation should be reviewed as part of vendor assessment. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should document which API endpoints are in use, assess eligibility for zero data retention, and formally request ZDR where applicable. Data processing inventories should reflect the 30-day default retention period. Organizations should establish a process to monitor changes to endpoint eligibility and platform documentation that may affect retention posture.
This provision establishes the operative data retention posture for API Platform users and defines the conditions under which zero data retention may be requested. The availability of zero data retention is conditioned on endpoint eligibility and use case qualification, meaning it is not universally available.
Under this provision, API inputs and outputs are retained for up to 30 days by default, with deletion thereafter absent legal requirements. Zero data retention is available only for eligible endpoints and qualifying use cases, requiring customers to assess and request this option rather than receiving it automatically.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.