Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document discloses that OpenAI has obtained SOC 2 Type 2 certification, indicating that its security controls have been independently audited against the AICPA Trust Services Criteria for security, availability, and related categories.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
SOC 2 Type 2 certification is a commonly required vendor security assurance standard in enterprise procurement and is relevant to due diligence under GDPR Article 32 (appropriate technical and organizational measures) and HIPAA security rule requirements. Enterprise customers may request OpenAI's SOC 2 report as part of their vendor risk assessment.
The updated terms state that workspace admins 'can control' data retention rather than directly controlling it. This conditional phrasing may suggest that retention control is optional or contingent rather than a guaranteed capability. Enterprise customers relying on admin-driven data retention policies should clarify with OpenAI whether this change affects their ability to set specific retention timelines for workspace data.
View change record →The updated terms shift governance of conversation access and retention from end users to workspace administrators. Under the revised policy, workspace admins can now view, access, export, and delete any end user conversations within their workspace and control how long workspace data is retained. Additionally, OpenAI now reserves the right to retain deleted or unsaved conversations beyond the standard 30-day deletion window if retention is reasonably necessary to protect its services or any third party from harm, beyond prior language that limited retention extensions to legal requirements. Within an enterprise account, end users no longer have unilateral control over conversation visibility or deletion of their own conversations.
View change record →The removal of SOC 2 Type 2 certification disclosure eliminates a specific security compliance credential that previously assured customers of regular audits and maintained security controls.
View full change record →Changed from 'maintain' to 'achieved', added specificity about regular audits and security control maintenance, and clarified the purpose as data protection.
View full change record →This provision discloses that OpenAI's platform has undergone independent security auditing under the SOC 2 Type 2 framework, which is a standard enterprise security assurance certification. Enterprise customers can reference this certification in their vendor risk assessments and may request the audit report to verify scope and findings.
How other platforms handle this
The right to request detailed information about the specific types of Personal Data we've collected over the past 12 months, including data disclosed for business purposes
If you choose to reveal any personal information about yourself to other users, you do so at your own risk. We strongly encourage you to use caution in disclosing any personal information online.
When you are asked to provide information, you may decline to do so; but if you choose not to provide information that is necessary to provide some of our Services, you may not be able to use those Services.
Monitoring
OpenAI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"OpenAI has achieved SOC 2 Type 2 compliance, and our systems are audited regularly to ensure we maintain the security controls necessary to protect your data.Excerpt from OpenAI's Enterprise Privacy
(1) REGULATORY LANDSCAPE: SOC 2 Type 2 certification is relevant to GDPR Article 32 requirements for appropriate technical and organizational security measures, HIPAA Security Rule requirements for safeguards, and contractual vendor security requirements common in enterprise agreements. It is not itself a regulatory certification but is widely accepted as evidence of security controls in vendor due diligence contexts. (2) GOVERNANCE EXPOSURE: Low to Medium. The disclosure of SOC 2 Type 2 status is a positive security signal, but enterprise customers should obtain the full SOC 2 report to assess the scope of the audit (which Trust Services Criteria are covered), the period of audit, any identified exceptions or gaps, and whether the scope covers all services the customer is using. (3) JURISDICTION FLAGS: EU/EEA customers assessing Article 32 compliance should supplement the SOC 2 report with an assessment of OpenAI's specific security measures for EU data, particularly given the requirement for transfer impact assessments. HIPAA-covered customers should assess whether the SOC 2 scope addresses the specific technical safeguards required under the HIPAA Security Rule. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement and vendor risk teams should request the current SOC 2 Type 2 report as part of onboarding and on an annual basis thereafter. The DPA or service agreement should include a provision requiring OpenAI to notify customers of material changes to its security posture or loss of certification. Teams should confirm whether the SOC 2 scope includes all product tiers used by the organization. (5) COMPLIANCE CONSIDERATIONS: Information security teams should document receipt and review of OpenAI's SOC 2 report in their third-party risk management records. Any exceptions or qualifications noted in the report should be assessed for relevance to the organization's specific use case. Teams should establish a process for annual re-review of updated SOC 2 reports.
Regulatory citations, enforcement risk, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
SOC 2 Type 2 certification is a commonly required vendor security assurance standard in enterprise procurement and is relevant to due diligence under GDPR Article 32 (appropriate technical and organizational measures) and HIPAA security rule requirements. Enterprise customers may request OpenAI's SOC 2 report as part of their vendor risk assessment.
This provision discloses that OpenAI's platform has undergone independent security auditing under the SOC 2 Type 2 framework, which is a standard enterprise security assurance certification. Enterprise customers can reference this certification in their vendor risk assessments and may request the audit report to verify scope and findings.
ConductAtlas has identified this type of provision across 295 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.