service openai-apivendor OpenAIcategory Model APIs
No (Favourable)Not used for training unless you opt in (e.g. via feedback sharing).
Not used for training unless you opt in (e.g. via feedback sharing).
As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us).
Abuse monitoring logs up to 30 days. Stateful endpoints (Assistants, Conversations, vector stores, files) keep application state until you delete it.
By default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days, unless longer retention is required by law, or is reasonably necessary to protect our services or any third party from harm.
Against the 21 tools that state a period (grey dots):
Zero Data Retention or Modified Abuse Monitoring, per org or project, after OpenAI approves you. Stateful endpoints are not ZDR-eligible.
Currently, these controls are subject to prior approval by OpenAI and acceptance of additional requirements.
Even after approval, OpenAI can switch specific models back to retention ('Safety Retention') for severe-risk investigations, with advance written notice.
we reserve the right to make models ineligible for Zero Data Retention or Modified Abuse Monitoring for specific customers if reasonably necessary to investigate or prevent severe risk activity
Per-project regions. Singapore (sg.api.openai.com) and the United Kingdom (gb.api.openai.com) give regional storage only, not regional processing; the same is true for AU, CA, JP, IN and KR. Regional processing is listed only for the US, EU and UAE. Non-US regions require MAM or ZDR approval and a Modified Retention amendment.
To use data residency with any region other than the United States, you must be approved for abuse monitoring controls, and execute a Modified Retention amendment. … United Kingdom* | gb.api.openai.com | Yes | No | Yes
SOC 2 Type 2 for the API Platform. ISO 27001 not confirmed on the pages checked.
Our API Platform has been audited and certified for SOC 2 Type 2 compliance.
BAA available on request; only BAA-eligible endpoints may process PHI.
We are able to sign Business Associate Agreements (BAA) in support of customers’ compliance with the Health Insurance Portability and Accountability Act (HIPAA).
API models are hosted only. OpenAI separately publishes open-weight gpt-oss models (120B and 20B, Apache 2.0) that you can run yourself.
Open reasoning models designed to run locally on desktops, laptops, and in data centers—available in 120B and 20B parameters.
Spotted something wrong or out of date? Corrections are welcome; see how to send one. How statuses are assigned.