OpenAI Private Intelligence Review 2026: Zero Retention

This analysis was written by the aifreetool Editorial Team — a group of full-time AI-industry researchers and writers who verify every claim against primary sources. Last updated October 31, 2026. We keep no affiliate relationship with the companies covered here.

TL;DR: OpenAI's Private Intelligence, whose product page went live on October 30, 2026, keeps zero data retention but changes what the phrase means in practice. Records flagged by safety classifiers are now double-encrypted and written to a bucket the customer owns — AWS S3, Azure Blob, Google Cloud Storage or OCI — for 30 days, readable only inside a hardware-attested runtime with no human access. A separate Private Inference tier, built on confidential computing, has entered API preview. Intelligence about misuse stays with OpenAI; the underlying content does not.

For four years, zero data retention was a clean promise: nothing is kept. It is now a promise with a filing cabinet attached, and the filing cabinet is in your building. That is a better deal than the alternative — several frontier deployments have required customers to let the provider hold sensitive content for safety monitoring — but it is not the same deal enterprise security teams signed up for.

What OpenAI Actually Shipped on October 30

The framework has four layers, and only one of them is genuinely new technology. Access restrictions cover zero data retention plus Private Inference for eligible workflows. Data ownership means customers own inputs and outputs. Agent controls let a business decide which systems an agent may touch, which actions it may take, and when a human must approve — the layer that matters as agents start executing rather than drafting. Data security is encryption, access controls and threat detection.

Compliance paperwork runs to SOC 2 Type 2, ISO certifications, HIPAA business associate agreements on eligible services only, and FedRAMP for designated government products. Coverage spans ChatGPT, Codex and the API. The product page carries no pricing, no supported model list, no hardware specification for Private Inference, no general-availability date and no named customers.

The timeline explains the shape of the release. Private Safety Processing was previewed on August 19, 2026 and rolled out to API customers in phases from September 22. The Private Intelligence name appeared at DevDay on September 29, where private inference was promised for "this fall." A technical white paper is dated October 26. The October 30 page is the moment a roadmap item became an API preview.

Inside Private Safety Processing

The mechanism is worth following step by step, because the details determine whether this survives a bank's security review. When a classifier or a sampling policy flags a record, OpenAI's description of PSP says the content is double-encrypted and written to storage the customer controls, with a 30-day time to live. OpenAI keeps metadata and a storage reference. Decryption happens only inside a hardware-attested runtime that prohibits human access, and what comes back out is a narrow signal — the type of activity involved — not the prompt.

An optional Enterprise Key Management layer puts a customer key on top of the customer's own key management service. Revoke it and decryption stops working for everyone, including the party that built the classifier. That is the strongest single control in the package, and it is also the one with the least published detail: no pricing, no eligibility criteria, no statement on what happens to records already written when a key is destroyed.

Two footnotes matter for procurement. PSP applies to a project's entire API traffic, so there is no per-endpoint opt-out. And the white paper excludes third-party distribution channels such as Amazon Bedrock, which means a model bought through a reseller does not inherit these terms.

Why Per-Interaction Safety Review Broke Down

The engineering problem is real, and OpenAI states it plainly. A safety system that judges each request in isolation cannot see the pattern that matters: an account probing a boundary over forty turns, several accounts coordinating a disguised request, or an agent that keeps acting after the user told it to stop. Those risks only exist across interactions, and cross-interaction review is exactly what zero retention forbids.

The old answer was to break the promise quietly — some deployments now require customers to allow retention so a provider can monitor. For a hospital or a bank, that trade is often not available at any price. PSP is an attempt to keep both: automated systems see patterns, humans see nothing, and content never leaves the customer's perimeter in readable form.

The unresolved question is attestation. "Hardware-attested" is a claim a customer must be able to check independently — remote attestation against published firmware measurements, ideally with a third-party auditor examining the runtime. Apple took that step with Private Cloud Compute by publishing inspectable images. Until OpenAI publishes comparable detail, Private Inference is a credible architecture and not yet a guarantee.

• Key Takeaways:
  • Private Intelligence launched as a standalone offering on October 30, 2026, covering ChatGPT, Codex and the API.
  • Flagged records now land in customer-owned storage for 30 days instead of being discarded — zero retention with an audit trail.
  • Private Inference, the confidential-computing tier, is an API preview with no published hardware or pricing.
  • PSP applies to an entire API project, and resold models on Amazon Bedrock are out of scope.
  • Attestation is the open variable: without published measurements, "verifiable" is a label until someone verifies it.

My Take / The Bottom Line

The interesting sentence in OpenAI's framing is not about privacy. It is that some serious risks only become visible across multiple interactions. That is an admission that safety review and zero retention were on a collision course, and that the company chose to move the review into the customer's infrastructure rather than give up either one.

Best for: regulated buyers — banks, hospital systems, insurers, defence suppliers — that have been unable to deploy frontier models because their security team will not accept provider-side retention, and teams running long agentic workflows where cross-session misuse detection is the actual control. Trade-off: you now own a 30-day bucket of flagged content, which means your own retention, deletion and legal-hold policies apply to data you previously never possessed. The verdict I would defend: this is the most consequential privacy architecture shift in enterprise AI this quarter, and it is still a roadmap until OpenAI lets customers verify the enclave themselves. Ask for the attestation report before you sign.

More structural analysis of model deployment sits in our tech deep dives and industry trends hubs. Developers comparing agent runtimes can start from the OpenAI Codex profile.

FAQ

Q: Does OpenAI Private Intelligence still offer zero data retention?
Yes, with a narrower meaning. Content is not used for training and OpenAI staff cannot read it. Flagged records are encrypted into storage the customer owns for up to 30 days so automated systems can spot patterns across interactions.

Q: What is Private Safety Processing?
An automated layer that reviews related interactions for coordinated misuse without giving OpenAI personnel access to prompts or responses. It returns a limited signal describing the type of activity detected.

Q: Is Private Inference generally available?
No. It is an API preview for eligible workflows, with registration required. OpenAI has not published the hardware, supported models, pricing or a general-availability date.

Q: Does this cover models bought through Amazon Bedrock or other resellers?
No. OpenAI's white paper says third-party distribution channels such as Amazon Bedrock fall outside the scope of these protections.

Q: What should a security team ask before adopting it?
Three things: whether the workload qualifies for zero data retention with PSP, whether EKM is available on their contract, and whether OpenAI will share remote-attestation measurements for the Private Inference enclave.