There’s a tension every AI provider is wrestling with right now. To catch misuse, it helps to watch requests over time. To guarantee privacy, you want to store as little as possible. Doing both at once is hard. On August 19, OpenAI laid out a proposal for how it might work anyway - “Private Safety Processing.”
The problem in one sentence
The most dangerous patterns often don’t show up in a single request, but only across several. Someone probes the safeguards over and over, spreads requests across multiple accounts, or disguises intent as harmless research. An agent working through a long task can also drift off course and keep going after being told to stop. The existing safety systems that are compatible with Zero Data Retention check each request on its own - and miss exactly these patterns.
How the trick works
Zero Data Retention means OpenAI doesn’t keep your prompts and responses after processing, staff can’t read them, and enterprise data only goes into training with explicit opt-in. Private Safety Processing is meant to keep that promise intact.
The content either stays on infrastructure the customer controls, or it sits with OpenAI - but encrypted with keys only the customer holds. OpenAI has no copy of those keys. Automated systems can then spot suspicious patterns and report back only a narrow signal: the type and severity of the incident. Nobody at OpenAI gets to see the actual text - not even when something is flagged. Only if a customer wants to appeal an alert or support an investigation can they choose to share content.
OpenAI spells out one exception: images that suggest child sexual abuse material are still retained for manual review - the company is legally required to do that.
My take
The feature is still in testing with select customers; a technical white paper and the wider rollout are slated for September. What I find interesting is less the tech than the admission behind it: safety checks and data minimization pull in different directions, and the more capable the models get, the harder they pull. Anthropic knows the same tension - Claude has its own Compliance API for enterprise customers, which by now also covers Cowork and Claude Code. Whoever finds the most convincing way to catch misuse without turning into a data hog wins with enterprise buyers. That’s exactly where this contest is being fought right now.
Sources: