The document states that API inputs and outputs may be retained for up to 30 days for service provision and abuse identification, after which they are deleted unless legally required to be retained, and that zero data retention is available for eligible endpoints on a qualifying use case basis.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the operative data retention posture for API Platform users and defines the conditions under which zero data retention may be requested. The availability of zero data retention is conditioned on endpoint eligibility and use case qualification, meaning it is not universally available.
The updated terms state that workspace admins 'can control' data retention rather than directly controlling it. This conditional phrasing may suggest that retention control is optional or contingent rather than a guaranteed capability. Enterprise customers relying on admin-driven data retention policies should clarify with OpenAI whether this change affects their ability to set specific retention timelines for workspace data.
View change record →The updated terms shift governance of conversation access and retention from end users to workspace administrators. Under the revised policy, workspace admins can now view, access, export, and delete any end user conversations within their workspace and control how long workspace data is retained. Additionally, OpenAI now reserves the right to retain deleted or unsaved conversations beyond the standard 30-day deletion window if retention is reasonably necessary to protect its services or any third party from harm, beyond prior language that limited retention extensions to legal requirements. Within an enterprise account, end users no longer have unilateral control over conversation visibility or deletion of their own conversations.
View change record →Current version clarifies the 30-day retention applies to all endpoints except documented exceptions, explicitly mentions abuse identification as a retention reason, and introduces the zero data retention (ZDR) option for eligible use cases.
View full change record →Under this provision, API inputs and outputs are retained for up to 30 days by default, with deletion thereafter absent legal requirements. Zero data retention is available only for eligible endpoints and qualifying use cases, requiring customers to assess and request this option rather than receiving it automatically.
Cross-platform context
See how other platforms handle API Data Retention and Zero Data Retention Option and similar clauses.
Compare across platforms →"Except for certain endpoints and features listed in our platform documentation, OpenAI may securely retain API inputs and outputs for up to 30 days to provide the services and to identify abuse. After 30 days, API inputs and outputs are removed from our systems, unless we are legally required to retain them. You can also request zero data retention (ZDR) for eligible endpoints if you have a qualifying use-case.Excerpt from OpenAI's Enterprise Privacy
(1) REGULATORY LANDSCAPE: This retention provision engages GDPR data minimization and storage limitation principles, which require that personal data be kept no longer than necessary for the specified purpose.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes the operative data retention posture for API Platform users and defines the conditions under which zero data retention may be requested. The availability of zero data retention is conditioned on endpoint eligibility and use case qualification, meaning it is not universally available.
Under this provision, API inputs and outputs are retained for up to 30 days by default, with deletion thereafter absent legal requirements. Zero data retention is available only for eligible endpoints and qualifying use cases, requiring customers to assess and request this option rather than receiving it automatically.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.