WARN
Trains on your data by default
= depends (Caution)Business, Enterprise/Edu and API key: no training by default. Personal ChatGPT plans are not covered by that row and were not verified here.
No training on your business data by default.
service openai-codexvendor OpenAIcategory Coding tools
Does OpenAI Codex train on your code?
Depends (Caution)Business, Enterprise/Edu and API key: no training by default. Personal ChatGPT plans are not covered by that row and were not verified here.
- fields
- 1 favourable2 caution4 unverified1 neutral / n/a
- sources cited
- 4 pages
- source monitor
- 4/4 ok on 2026-10-26
- last field check
Evidence log
N/A
Default retention
= follows workspace / API org settings (Neutral / n/a)ChatGPT sign-in follows the ChatGPT Enterprise workspace's retention and residency settings; API-key sign-in follows the API organization's settings. For ChatGPT-authenticated use, audit records are kept up to 30 days for the Compliance API.
For usage authenticated through ChatGPT, OpenAI keeps audit records for up to 30 days so you can retrieve them through the
No fixed period stated, so this tool isn't plotted on the retention chart.
UNVERIF
Zero data retention
= unverified (Unverified)No Codex-level ZDR switch is documented. With API-key sign-in, Codex follows the API organization's retention settings (where ZDR is configured). OpenAI warns that Work Cloud with local computer access does not provide strict ZDR.
no official page stated this clearly
UNVERIF
Abuse-monitoring exception
= unverified (Unverified)Not stated on the Codex pages checked.
no official page stated this clearly
UNVERIF
Data residency / regions
= follows ChatGPT Enterprise settings (Unverified)Codex inherits the workspace's residency settings, but OpenAI notes residency covers only eligible content, workloads, regions and configurations. Regions are not listed on the Codex pages.
Data residency and inference residency cover only eligible content and supported workloads, regions, and configurations.
UNVERIF
SOC 2 / ISO 27001
= unverified (Unverified)No Codex-specific certification statement found.
no official page stated this clearly
OK
HIPAA BAA
= yes (local Codex only) (Favourable)Covered under an OpenAI BAA for the desktop app, IDE extension and CLI with ChatGPT sign-in on HIPAA-eligible workspaces, or API-key sign-in only if the BAA includes API Services with Modified Retention. Codex cloud is excluded.
The BAA doesn’t cover Codex cloud. Don’t use Codex cloud with PHI.
WARN
Self-host option
= partial (local OSS models) (Caution)The CLI can run against a local open-source model through Ollama or LM Studio with --oss. The Codex service itself (cloud tasks, OpenAI models) is hosted only.
Use a local open source model provider.
Source checks
- ✓ OKdevelopers.openai.com/codex/cli/referencefetched 2026-10-26 · Self-host
- ✓ OKdevelopers.openai.com/codex/enterprisefetched 2026-10-26 · ZDR, Abuse mon., SG/APAC, SOC2/ISO
- ✓ OKdevelopers.openai.com/codex/pricingfetched 2026-10-26 · Trains
- ✓ OKlearn.chatgpt.com/docs/hipaa-configurationfetched 2026-10-26 · Retention, HIPAA BAA
Spotted something wrong or out of date? Corrections are welcome; see how to send one. How statuses are assigned.