Check retention endpoint by endpoint before you send customer data, because Batch, Files, vector stores, Conversations, and the Agents API keep application state even under Zero Data Retention. By default OpenAI does not train on API data and keeps abuse monitoring logs up to 30 days. Zero Data Retention and Modified Abuse Monitoring both need OpenAI's approval.
When you need this
- Security or legal review asks where prompts and outputs are stored, and for how long.
- Customer contracts require that a model provider retain nothing.
- You process protected health information, or data that must stay in one region.
Evaluation criteria
Default retention
How long can OpenAI's abuse monitoring logs hold your data?
Look forDefault terms that fit your data. Training happens only if you opt in, and abuse monitoring logs stay up to 30 days, longer only when law requires it. Responses keeps 30 days of application state when store is true, the default.
Zero Data Retention or Modified Abuse Monitoring
Which control has OpenAI approved for your organization and each project?
Look forBoth keep customer content out of abuse monitoring logs, and Zero Data Retention also forces store to false on Responses and Chat Completions. Projects inherit the organization setting unless you set them otherwise. incident.io and Cyberdesk both report negotiating zero data retention with OpenAI before shipping. File the request well before launch. One builder's launch waited on a Zero Data Retention request with no reply after four business days. A company with about 70 customers in Europe asked sales repeatedly for EU data residency and got automated replies.
Endpoint eligibility
Is every endpoint you call eligible for Zero Data Retention?
Look forResponses, Chat Completions, embeddings, audio transcription, and speech support Zero Data Retention. Batch, Files, vector stores, Conversations, and the Agents API do not and keep state until deletion. Under any control, OpenAI can hold images and files for review if scanning flags CSAM.
Prompt caching state
Does extended prompt caching fit your retention policy?
Look forAccount for cached key/value tensors on GPU-local storage for up to 24 hours. Without Zero Data Retention, older models that support extended caching use it by default.
Residency
Where must inference run, and where must data rest?
Look forRegional processing in the US, the EU, and the UAE, and storage-only residency in Australia, Canada, Japan, India, Singapore, South Korea, and the UK. Both are set per project at a 10% uplift on models released since March 5, 2026. Any region other than the US requires abuse monitoring controls and a Modified Retention amendment.
Health data
Do you process protected health information through the API?
Look forSince October 5, 2026, admins of eligible API organizations can accept OpenAI's standard Business Associate Agreement in Organization settings; check covered services in the Help Center.
Cloud alternatives
Would a cloud provider's data terms suit you better?
Look forOn Azure OpenAI, Microsoft is the processor and OpenAI cannot see your prompts. On Amazon Bedrock, AWS sets retention, and setting store to false does not by itself guarantee zero data retention. A consultant on Hacker News reports that virtually all of their clients buy through Bedrock or Azure with zero data retention.
Questions to ask vendors
- Is Zero Data Retention or Modified Abuse Monitoring approved for our organization, and which projects override it?
- Which of our workloads call Batch, Files, vector stores, Conversations, or the Agents API?
- Do we need a Business Associate Agreement, and which endpoints does it cover?
Red flags
- Assuming Zero Data Retention covers the Batch API or vector stores.
- Leaving store at its default on Responses calls that carry sensitive data.
- Picking a non-US region without the required abuse monitoring controls and amendment.
Products in this piece
Sources
- Official documentation
- 7
- Public source
- 6
- OpenAI API docs: Data controls in the OpenAI platform
- OpenAI API docs: Prompt caching
- OpenAI API docs: Migrate to the Responses API
- OpenAI API docs: Pricing
- OpenAI API docs: OpenAI on Amazon Bedrock
- OpenAI API docs: Changelog
- Microsoft Learn: Data, privacy, and security for Models sold by Azure
- incident.io: Lessons learned from building our first AI product (Jan 17, 2024)
- Hacker News comment from Cyberdesk on zero data retention and BAAs (Aug 14, 2025)
- Hacker News comment on switching providers for a zero data retention guarantee (Oct 7, 2026)
- Hacker News comment on clients buying through Bedrock or Azure (Oct 9, 2026)
- OpenAI Developer Forum: Zero Data Retention request blocking a production launch (May 27, 2026)
- OpenAI Developer Forum: An Azure OpenAI customer asking for OpenAI's EU data residency endpoint (Oct 13, 2025)