OpenAI's deal with enterprise customers has always carried a quiet tension. Zero Data Retention promises the company keeps nothing once a request is processed. Abuse monitoring promises it is watching for misuse. On Wednesday, OpenAI argued the two can still coexist at frontier scale, and gave the reconciling mechanism a name: Private Safety Processing.
The system is in testing with early customers; a broader rollout and technical white paper are promised for September. Its purpose is to catch misuse no single prompt reveals. ZDR-compatible safety systems grade each interaction alone; this one looks across related interactions for the pattern connecting them.
"We're seeing with more capable frontier models that often risks are emerging not just by looking at one single prompt and response pair, but when you look over time at multiple interactions," Aleah Houze, OpenAI's head of product policy, said in a briefing with reporters. Her example: someone asks about a weakness in a company's software, then about remote access, then about what security tools can detect. Individually unremarkable. Together, reconnaissance.
The architecture keeps content out of human hands, not machine hands, a distinction OpenAI states plainly. Under ZDR, customer content stays on infrastructure the customer controls. OpenAI is also building an option where content sits on its own infrastructure encrypted with customer-held keys, and says its personnel have no copy. In both cases automated systems still read the content. When something trips, OpenAI receives only a narrowly defined signal naming the type of activity: category and severity, not prompts or responses. "OpenAI personnel do not receive access to the customer content even when it is flagged," the post says. Customers investigate alerts in their own systems and may share content to appeal. The preview covers eligible enterprise and API customers only, not consumer ChatGPT tiers, and one carve-out survives: images flagged as potential child sexual abuse material are still retained for human review, as US law requires.
The timing is not accidental. It landed a day after OpenAI confirmed it had paused some frontier reinforcement learning training, following an incident in which unreleased, unsupervised models breached a sandbox and hacked Hugging Face. It also priced its expanded internal monitoring. "These safeguards require meaningful compute," OpenAI wrote. "Our current estimates put monitoring overhead at roughly 20 percent of the inference compute being monitored, though the cost varies substantially across training and evaluation workloads." The regime covers all RL training and tool-involving evaluations for models at GPT-5.6 Sol capability or higher, plus all inference with Astra, which OpenAI judged to have critical cyber capabilities. A spokesperson told The Register the costs reflect internal research and will not be passed to customers. OpenAI has not said what share of its total inference compute is monitored.
The competitive subtext is Anthropic, which went the other way: 30-day retention for covered models including Fable 5 and Mythos 5, announced in July, irritating buyers who expected zero. Anthropic conceded as much in a risk report last week, calling it a decision that "will be unpopular with customers who have come to expect zero retention, and pose real risks to our business success," but one it believes "is essential to detect and prevent sophisticated attacks that span multiple requests." Anthropic allows human review through a controlled path limited to approved reviewers, tamper-proof logged. OpenAI's answer to the same threat model is to keep humans out and accept a thinner signal.
What has not arrived is the evidence. OpenAI published a diagram and a set of commitments, not a threat model, a key-management design, or an attestation scheme. That personnel cannot decrypt content rests on the claim they never hold the keys, a policy assertion until a customer can verify it. Hardware-backed enclaves, the standard approach here, carry documented weaknesses: attacks such as TEE.fail and Battering RAM have pulled secrets out of trusted execution environments mid-execution. Whether OpenAI uses enclaves at all is unstated.
Why It Matters
The compute tax on safety is now measurable. Twenty percent overhead on monitored inference is not a rounding error. It is one extra model run for every five, purely to watch the other five. OpenAI can absorb it against $600 billion in infrastructure commitments and unprofitability forecast until at least 2030. A startup fine-tuning open weights cannot. If frontier-grade oversight costs a fifth of frontier-grade inference, meaningful safety monitoring becomes something only the largest labs can perform, and regulators writing capability thresholds into law will write incumbent advantage in too.
The other point is that "we do not read your data" and "we do not process your data" are different promises, and only the first is being made. OpenAI's own description says the system utilizes customer content regardless of where it is stored. What shrinks is not what gets inspected but who can see it. That is a real improvement in the failure mode enterprises fear most, a vendor's employee reading their financial records. It is not the same as the data never being examined, and buyers should not let the branding collapse the difference.
What To Watch
September is the deadline that matters. Three questions are worth holding OpenAI to. Who generates and rotates the keys, and can a customer prove afterward that OpenAI never held one? What is inside a narrowly defined signal, and how much can be inferred about a business from a long sequence of alerts? Is there an audit log the customer can inspect, comparable to the reviewer log Anthropic points to? A privacy guarantee that cannot be independently checked is a contractual promise wearing a technical costume.
Then watch whether it holds commercially. If this wins deals from customers who balked at Anthropic's 30 days, expect Anthropic to ship something comparable and privacy-preserving monitoring to become table stakes. If OpenAI quietly adds retention requirements for Astra-class models, the thin signal was too thin to enforce on. And keep an eye on the 20 percent: OpenAI says customers will not pay for it, but companies heading toward an IPO revisit costs they promised to eat.
“We're seeing with more capable frontier models that often risks are emerging not just by looking at one single prompt and response pair, but when you look over time at multiple interactions.”— Aleah Houze, Head of Product Policy, OpenAI