Where does this provider put your AI data — and who can compel its disclosure?
| Residency | United States us |
|---|---|
| Sovereignty | United States us |
| Endpoints | api.openai.com |
| Packages | openai (Python), openai (npm), @ai-sdk/openai (npm), com.openai (Java), OpenAI (.NET) |
How does this provider treat the data you send it? Advisory statements about documented practices — not legal advice.
| Trains on customer API data by default | No source — 'As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in)'; per-endpoint table shows 'Data used for training: No' (retrieved 2026-08-21) |
|---|---|
| Retention (API inputs/outputs) | Abuse-monitoring logs retained up to 30 days by default; application state varies by endpoint (Responses API stores 30 days when store=true; some endpoints until deleted). Zero Data Retention or Modified Abuse Monitoring excludes customer content from abuse logs for approved customers. source — 'Abuse monitoring logs ... retained for up to 30 days' and per-endpoint 'Storage requirements and retention controls' table (retrieved 2026-08-21) |
| Subprocessor list | https://openai.com/policies/sub-processor-list/ — Linked from the data controls guide ('OpenAI uses sub-processors to provide its services') (retrieved 2026-08-21) |
| Enterprise tier | Zero Data Retention and Modified Abuse Monitoring are subject to prior approval by OpenAI and acceptance of additional requirements (contact sales); Enterprise Key Management (BYOK) is available for application state. source — 'Currently, these controls are subject to prior approval by OpenAI and acceptance of additional requirements'; Enterprise Key Management (EKM) section (retrieved 2026-08-21) |
| Entry last reviewed | 2026-08-21 |