OpenAI previews a safety layer that keeps zero data retention on frontier models
OpenAI said it continues to promise eligible API customers that prompts and responses are not retained, and previewed a layer called Private Safety Processing. The system aims to identify risky patterns across related interactions without giving personnel access to the underlying content. Rollout is planned for September.
The tension between safety monitoring and a no retention promise
Per an OpenAI announcement dated August 19, 2026, the company continues to offer Zero Data Retention on frontier models and is previewing a new safety approach designed not to break it.
Zero Data Retention is a clear commitment for eligible API customers: prompts and model responses are not retained after a request is processed, content is not available to OpenAI personnel for review, and enterprise customer data is not used to train models unless customers explicitly opt in.
Here is the problem: existing ZDR compatible safety systems evaluate each interaction individually. In OpenAI framing, some of the most serious risks only become visible when multiple interactions are viewed together. Private Safety Processing is designed to close that gap.
How the system works and who it covers
Per the announcement, in ZDR deployments customer content remains on infrastructure the customer controls. In addition, an option is in development where content is stored on OpenAI infrastructure but encrypted with keys the customer controls, and OpenAI personnel hold no copy of those keys.
In both cases automated systems can identify potential misuse and return limited safety signals without exposing the underlying prompts and responses to personnel. When a risk is identified, what reaches OpenAI is a narrowly defined signal indicating the type of activity involved. Personnel do not gain access even when content is flagged.
On the customer side the flow is described like this: they can investigate alerts and enforcement decisions using information in their own systems. If they want to appeal, clarify legitimate activity or support an investigation into verified abuse, they choose to share the relevant information themselves.
Agentic tasks stand out in the rationale. The announcement cites bad actors repeatedly probing safeguards, coordinating across accounts, or a system drifting from user intent by continuing to act after being told to stop.
There is a competitive dimension too. Per the announcement, some recent frontier model deployments have required customers to let their provider retain sensitive content for safety monitoring, which OpenAI says conflicts with the security obligations of many organizations. Per The Next Web assessment dated August 20, Anthropic takes the opposite approach and requires 30 day data retention for safety monitoring.
The scope boundary is clear as well. Per The Next Web, enterprise and API customers are covered while consumer tiers are excluded. One exception in the announcement deserves noting: because of a legal reporting obligation, images flagged as potential child sexual abuse material continue to be retained for manual review and reporting even in ZDR deployments.
Private Safety Processing is currently being tested with early customers. OpenAI says it plans to start rolling it out and to publish a technical white paper in September. Customers shaping the approach include Glean, Databricks, Abridge and Microsoft.
In enterprise AI the real negotiation is where the data sits
The assessment in this section is ours. In enterprise AI projects the bottleneck over the past year has not been model quality but legal and information security approval. The question from a bank, a hospital or a law firm is always the same: where does the data sit, who can see it, how long does it stay?
This announcement speaks exactly to that question. Safety monitoring and a no retention promise have long pulled against each other: catching misuse meant looking at content, and looking at content meant retaining it. The proposed solution moves only the risk signal upward, not the content.
The second point is the nature of agentic systems. Steps that look harmless one by one can be harmful in aggregate. While an AI agent runs a task lasting hours, risk appears in the pattern of steps rather than in a single prompt. Moving safety monitoring from the individual interaction to the pattern makes sense for that reason.
The third point is verifiability. Technical details are not published yet and the white paper is expected in September. What exists today is a design promise, not an independently reviewed system. Information security teams would do well to wait for that document before deciding.
Fourth, the direction of the sector. As frontier models grow more capable, safety monitoring deepens with them; the OpenAI announcement of a cybersecurity focused model was another face of the same trend. For an enterprise buyer it means the data clauses in the contract matter more than the choice of model.
What it means for businesses in Türkiye
The assessment below is not in the sources, it is our reading. The announcement mentions no Türkiye specific regulation or timeline.
The most concrete obstacle in front of enterprise AI projects here is KVKK compliance. Whether customer data, employee data or health data may be processed by a provider abroad is the first agenda item in almost every project. A commitment that zero data retention will continue makes that discussion easier.
There is a distinction to keep in mind though: data not being retained does not mean data not being processed. Under KVKK, transfer abroad and processing activity are assessed on their own. A retention period of zero does not remove the need for a disclosure text, explicit consent and transfer conditions.
The second practical point is scope. Per the sources this commitment concerns enterprise and API usage; the scenario where your team logs in from a browser with a consumer account and pastes data falls outside it. That is also the leakage path we see most often inside organizations.
Third is the habit of reading the contract. A provider default setting and the clause in the contract offered to you can differ. It is worth verifying which tier falls under ZDR, which exceptions exist, and whether that is written into your agreement.
Fourth is timing. Rollout is planned for September. Rather than deciding today, it is healthier to evaluate this with your information security team once the white paper and the contract text are clear.
The UNALSOFT take
In agentic AI projects the first thing we set up is not the model, it is the data boundary. No agent goes to production before it is written down which data passes through the system, which never leaves, and which step gets logged. For us this announcement means the provider side is starting to meet that discipline. Our approach does not change though: whatever the provider commits to, it is safer to minimise sensitive data in the architecture, never send data that is not needed, and keep our own records at critical steps. A contract offers protection, architecture reduces the risk in the first place.
Is the data boundary drawn in your AI project?
Let us clarify together which data goes where.