The argument around enterprise AI has often been framed as a trade: stronger safety monitoring on one side, tighter data control on the other. OpenAI is trying to make that trade less blunt.
On August 19, the company said eligible API customers using Zero Data Retention can expect prompts and model responses not to be retained after processing. It also previewed Private Safety Processing, designed to identify risk patterns across related interactions without giving OpenAI personnel access to the underlying customer content.
What is actually being previewed
OpenAI says ordinary ZDR-compatible systems can assess interactions one at a time. Its proposed Private Safety Processing adds pattern detection across related activity. For customer-controlled infrastructure, the company says the content stays on infrastructure controlled by the customer. It is also developing an option for OpenAI-hosted storage encrypted with customer-controlled keys.
OpenAI says it would receive a limited signal about the type of risk identified, rather than the underlying prompts and responses. The system is being tested with early customers, and the company says it plans to begin rollout and publish a technical white paper in September.
Why operators should pay attention
This is a vendor commitment and preview, not a finished compliance program. Still, it addresses a real procurement question: can a company use capable models for sensitive work without making routine customer content available for human review by the AI provider?
For an Alberta firm, the questions remain practical. Which product and account tier is eligible? Where does data reside? What logs are kept in the company’s own stack? Who can investigate an alert? What gets escalated to a human? Get answers in writing before moving health information, financial records, legal files, or private customer correspondence into an agent workflow.