Data retention - verified
Does OpenAI store your API prompts?
Default retention: up to 30 days, abuse monitoring. Trains on your API data: No. Zero data retention: by approval (Zero Data Retention or Modified Abuse Monitoring, after OpenAI approval). Regional processing: US, EU and UAE.
Scope: OpenAI API Platform (not ChatGPT consumer or ChatGPT business workspaces)
Read from developers.openai.com, openai.com. Compare every AI API's data retention
- Trains on data
- No
- ZDR
- By approval
- Regions
- US, EU and UAE
- Verified
- 2026-10-18
How long are prompts kept by default?
- Default retention
Up to 30 days, abuse monitoring
Abuse monitoring logs (may contain prompts and responses) are generated for all API usage and retained up to 30 days by default; some stateful endpoints keep application state until deleted.
“By default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days, unless longer retention is required by law, or is reasonably necessary to protect our services or any third party from harm.”
developers.openai.com “Except for certain endpoints and features listed in our platform documentation, OpenAI may securely retain API inputs and outputs for up to 30 days to provide the services and to identify abuse. After 30 days, API inputs and outputs are removed from our systems, unless we are legally required to retain them.”
openai.com - Duration
up to 30 days
- Purpose
abuse monitoring / enforcing Usage Policies (and to provide the services, per the enterprise privacy page)
Does it train on your API data?
No
Not used for training unless the customer explicitly opts in (since March 1, 2023).
“As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us).”
“By default, we do not use your business data for training our models.”
Zero data retention (ZDR)
- Availability
By approval: the provider must approve your request
Zero Data Retention or Modified Abuse Monitoring, after OpenAI approval
- Who can get it
Prior approval by OpenAI plus acceptance of additional requirements; contact sales. Approved customers choose Zero Data Retention or Modified Abuse Monitoring at org or project level (Settings > Organization > Data controls > Data Retention).
- Not covered
Endpoints marked not ZDR-eligible (e.g. /v1/conversations, /v1/chatkit/threads, /v1/agents, /v1/assistants, /v1/threads, /v1/vector_stores, /v1/files, /v1/fine_tuning/jobs, /v1/evals, /v1/batches, /v1/audio/voices) may still store application state. Image/file inputs flagged as potential CSAM are retained for manual review even under ZDR. OpenAI reserves the right to make specific models ineligible for ZDR/MAM for specific customers (Private Retention with PSP, Safety Retention).
- From the docs
“Eligible customers may have their customer content excluded from these abuse monitoring logs, subject to the limitations below, by getting approved for the Zero Data Retention or Modified Abuse Monitoring controls. Currently, these controls are subject to prior approval by OpenAI and acceptance of additional requirements.”
developers.openai.com “Additionally, Zero Data Retention changes some endpoint behavior: the store parameter for /v1/responses and v1/chat/completions will always be treated as false, even if the request attempts to set the value to true.”
developers.openai.com “Besides those specific behavior changes, the endpoints and capabilities listed as No for Zero Data Retention Eligible in the table below may still store application state, even if Zero Data Retention is enabled.”
developers.openai.com “If the classifier detects potential CSAM content, the image will be retained for manual review, even if Zero Data Retention, Modified Abuse Monitoring, or Private Retention with PSP is enabled.”
developers.openai.com
Features kept longer
Stateful features hold your content until a job finishes, a window expires or you delete it, often regardless of the default above.
| Feature | Retention | The docs say |
|---|---|---|
| Responses API (/v1/responses) stored responses | 30 days by default or when store=true ("at least 30 days") | “Except as noted below, the Responses API has a 30 day Application State retention period by default, or when the store parameter is set to true. In those cases, response data will be stored for at least 30 days.”developers.openai.com |
| Responses API background mode | roughly 10 minutes on disk for polling | “Background mode stores response data to disk for roughly 10 minutes to enable polling.”developers.openai.com |
| Audio outputs (chat completions and responses) | 1 hour | “Audio outputs application state is stored for 1 hour to enable multi-turn conversations.”developers.openai.com |
| Prompt caching (extended) | not retained after 24-hour expiration (GPU-local storage) | “Prompt caching may store encrypted key/value tensors in GPU-local storage as application state. This data is stored on the local GPU machines and is not retained after the 24-hour expiration.”developers.openai.com |
| Conversations (/v1/conversations, /v1/conversations/items) and ChatKit threads | Until deleted (both abuse monitoring and application state, per table) | “| /v1/conversations | No | Until deleted | Until deleted | No | No |”developers.openai.com |
| Assistants, Threads, Vector stores | Indefinitely unless deleted; removed 30 days after deletion | “Objects related to the Assistants API are deleted from our servers 30 days after you delete them via the API or the dashboard. Objects that are not deleted via the API or dashboard are retained indefinitely.”developers.openai.com |
| Files (/v1/files) | Until deleted, or automatic deletion via expires_after | “Files can be manually deleted via the API or the dashboard, or can be automatically deleted by setting the expires_after parameter.”developers.openai.com |
| Batches, fine-tuning jobs, evals, agents, audio voices | Application state until deleted (table) | “| /v1/batches | No | 30 days | Until deleted | No | No |”developers.openai.com |
| Fine-tuning training data | Until the customer deletes the files | “Data submitted to fine-tune a model is retained until the customer deletes the files.”openai.com |
| GPT-Live sessions (/v1/live/sessions) with session storage | 30 days when store: true (storage disabled by default) | “Session storage is disabled by default. For projects with session storage enabled, store: true retains the completed session recording for 30 days so that it can be downloaded or used to start a forked session.”developers.openai.com |
| Hosted containers (Code Interpreter, Hosted Shell, hosted skills) | Until the container expires or is deleted | “Container data is deleted when the container expires or is explicitly deleted.”developers.openai.com |
| Audio transcriptions/translations, moderations | No abuse monitoring retention (table shows None) | “| /v1/audio/transcriptions | No | None | None | Yes | No |”developers.openai.com |
Where is your data stored and processed?
- Regional processing
US, EU and UAE
Processing in the US, EU and UAE; storage only in 7 more regions. Approval needed outside the US
- Stated location
- Not stated
- Processing regions
- United States
- Europe (EEA + Switzerland)
- United Arab Emirates
- Storage-only regions
- Australia
- Canada
- Japan
- India
- Singapore
- South Korea
- United Kingdom
- How to choose
Eligibility via sales. Region is selected when creating a new project; requests then use the regional domain prefix. Alternatively, per-request regional processing by using the prefixed domain with an API key from a Global project. Non-US regions require approval for abuse monitoring controls (MAM or ZDR) and a Modified Retention amendment; UAE needs extra approval. 10% uplift for eligible models released on or after March 5, 2026.
- What it covers
Storage at rest of customer content (to the extent the endpoint persists data) in all listed regions; inference (processing) only in regions that support regional processing (US, EU, UAE per table). Does not cover system data.
- From the docs
“If you use the supported endpoints, models, and snapshots listed below, your customer content (as defined in your services agreement) for that project will be stored at rest in the selected region to the extent the endpoint requires data persistence to function (such as /v1/batches).”
developers.openai.com “If you select a region that supports regional processing, as specifically identified below, the services will perform inference for your Customer Content in the selected region as well.”
developers.openai.com “If your selected Region does not support regional processing, as identified below, OpenAI may also process and temporarily store Customer Content outside of the Region to deliver the services.”
developers.openai.com “To use data residency with any region other than the United States, you must be approved for abuse monitoring controls, and execute a Modified Retention amendment.”
developers.openai.com “Data residency endpoints are charged a 10% uplift for models released on or after March 5, 2026, that are eligible for data residency.”
developers.openai.com
Regional endpoints
- United States
us.api.openai.comSource: developers.openai.com
- Europe (EEA + Switzerland)
eu.api.openai.comSource: developers.openai.com
- Australia
au.api.openai.comSource: developers.openai.com
- Canada
ca.api.openai.comSource: developers.openai.com
- Japan
jp.api.openai.comSource: developers.openai.com
- India
in.api.openai.comSource: developers.openai.com
- Singapore
sg.api.openai.comSource: developers.openai.com
- South Korea
kr.api.openai.comSource: developers.openai.com
- United Kingdom
gb.api.openai.comSource: developers.openai.com
- United Arab Emirates
ae.api.openai.comSource: developers.openai.com
Certifications
- SOC 2 Type 2 (API Platform)
- HIPAA BAA available
“Our API Platform has been audited and certified for SOC 2 Type 2 compliance.”
“We are able to sign Business Associate Agreements (BAA) in support of customers’ compliance with the Health Insurance Portability and Accountability Act (HIPAA).”
Research notes
- Modified Abuse Monitoring (MAM) excludes customer content from abuse logs but keeps full platform capability; ZDR additionally forces store=false.
- When ZDR is not enabled, all queries use extended prompt caching for supported models.
- Extended prompt caching in storage-only regions may process and temporarily store content outside the region.
- chat/completions cannot set store=true in non-US regions.
- Tracing is not currently EU data residency compliant for /v1/realtime.
- Videos API shut down September 24, 2026 (previously 48h download + 30 days abuse monitoring).
FAQ
Does OpenAI store your API prompts?
Up to 30 days, abuse monitoring. Abuse monitoring logs (may contain prompts and responses) are generated for all API usage and retained up to 30 days by default; some stateful endpoints keep application state until deleted. The provider says: "By default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days, unless longer retention is required by law, or is reasonably necessary to protect our services or any third party from harm."
Does OpenAI train on your API data?
No. The provider says: "As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us)."
Does OpenAI offer zero data retention?
By approval (Zero Data Retention or Modified Abuse Monitoring, after OpenAI approval). Prior approval by OpenAI plus acceptance of additional requirements; contact sales. Approved customers choose Zero Data Retention or Modified Abuse Monitoring at org or project level (Settings > Organization > Data controls > Data Retention).
Where does OpenAI process your data?
Regional processing options: US, EU and UAE (processing in the US, EU and UAE; storage only in 7 more regions. Approval needed outside the US). Stated processing location: Not stated.
Sources
Last verified from OpenAI's own pages below. Quotes are verbatim.
This page summarizes what each provider's own pages say. It is not legal advice; your contract, data processing addendum and the provider's current terms govern what happens to your data.
Newsletter
Know when a provider changes its data terms
One email per week. New model releases, pricing and policy changes, and what they mean for what you build.