On August 19, 2026, OpenAI announced a preview of Private Safety Processing for eligible API customers using Zero Data Retention (ZDR). The important change is not another model feature. It is an attempt to address a practical enterprise tension: a system needs safety signals, while a customer may not want prompts and model responses retained or read by platform personnel.
OpenAI describes ZDR as a policy under which eligible customers' prompts and model responses are not retained after a request completes and are not available to OpenAI personnel. It also says enterprise data is not used for training unless a customer opts in. These are the vendor's product and data-handling claims; eligibility still depends on the account, agreement, and API configuration.
Private Safety Processing is designed to run on customer-controlled infrastructure or in OpenAI storage encrypted with customer-controlled keys. Automated systems return narrow safety signals without exposing prompts or responses to OpenAI personnel. OpenAI says that a flagged interaction still does not give its personnel access to the underlying content. The design therefore separates a safety decision from permission to read customer data.
Why look across interactions? OpenAI says some risks do not appear in one request. They emerge across multiple turns, long-running tasks, or an agentic workflow that gradually departs from the user's intent. The announcement gives the example of an agent continuing after a user has told it to stop. A system that isolates every request may see ordinary individual messages while missing the pattern across the whole run.
For AI workflow teams, the architectural implication is that data minimization does not have to mean abandoning safety telemetry. A stronger design may keep raw content inside the customer's control, return only the narrow result needed for a safety decision, and let the customer's policy, human review, and incident process determine what happens next. That is an interpretation of the announcement, not evidence that the preview covers every safety failure mode.
OpenAI says it has tested the capability with early customers and plans a technical white paper and broader rollout in September. It should therefore be treated as a preview rather than a standalone compliance guarantee. A deployment review still needs to cover retention, key management, data regions, visible metadata, alert handling, and human escalation rather than relying on the ZDR label alone.
The announcement also describes an important exception: potential CSAM images that are flagged may still be retained for manual review and reporting even under ZDR. In other words, “ordinary prompts and responses are not retained” is not the same as “no content can ever be retained.” High-risk workflows need those exceptions, legal duties, and escalation paths documented before production use.
The larger value of Private Safety Processing is the sharper boundary it proposes for enterprise agents: can a platform provide useful safety signals without taking possession of the underlying content? The answer still needs the white paper, real configuration details, and independent scrutiny. The direction, however, is moving from a binary retain-or-not question toward what is retained, who can see it, and how the signal is governed.
