---
type: "post"
id: "zdr-with-private-safety-processing-704919"
slug: "zdr-with-private-safety-processing-704919"
title: "ZDR with Private Safety Processing"
description: "OpenAI has documented Zero Data Retention with Private Safety Processing (ZDR with PSP), a design for automated safety review without OpenAI retaining customer prompts or responses."
retrieval_nugget: "OpenAI has documented Zero Data Retention with Private Safety Processing (ZDR with PSP), a design for automated safety review without OpenAI retaining customer prompts or responses. For AI builders assessing sensitive-data deployments, the relevant detail is how selected records can be reviewed asynchronously while remaining in customer-controlled storage and inaccessible to human reviewers."
published_at: "2026-11-02"
updated_at: "2026-11-02"
record_date: "2026-11-02"
date_kind: "published_at"
topics: ["agent-security"]
entities: ["OpenAI","Zero Data Retention with Private Safety Processing","Safety Review Runtime","Enterprise Key Management"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "new_fact"
what_changed: "OpenAI’s documentation now covers Zero Data Retention with Private Safety Processing, adding detail to the previously noted ZDR availability plans."
prior_refs: []
source_url: "https://developers.openai.com/api/docs/guides/private-safety-processing"
source_urls: ["https://developers.openai.com/api/docs/guides/private-safety-processing"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:zdr-with-private-safety-processing-704919"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/zdr-with-private-safety-processing-704919/","markdown":"https://newruntime.com/posts/zdr-with-private-safety-processing-704919.md","json":"https://newruntime.com/posts/zdr-with-private-safety-processing-704919.json"}
markdown_url: "https://newruntime.com/posts/zdr-with-private-safety-processing-704919.md"
---

# ZDR with Private Safety Processing

## Retrieval answer

OpenAI has documented Zero Data Retention with Private Safety Processing (ZDR with PSP), a design for automated safety review without OpenAI retaining customer prompts or responses. For AI builders assessing sensitive-data deployments, the relevant detail is how selected records can be reviewed asynchronously while remaining in customer-controlled storage and inaccessible to human reviewers.

## Summary
OpenAI has documented Zero Data Retention with Private Safety Processing (ZDR with PSP), a design for automated safety review without OpenAI retaining customer prompts or responses. For AI builders assessing sensitive-data deployments, the relevant detail is how selected records can be reviewed asynchronously while remaining in customer-controlled storage and inaccessible to human reviewers.

## What happened
OpenAI’s API guide describes ZDR with Private Safety Processing as a way to perform offline, automated safety review without OpenAI retaining customer prompts or responses. The guide divides the design into two flows. The API Request and Retention flow protects and retains eligible API content in a customer-controlled storage container. The Asynchronous Safety Pipeline retrieves retained records only for approved automated safety review and releases bounded safety decisions.

An interaction means a customer prompt and the corresponding model response. OpenAI says an interaction can be selected through a safety-classifier referral or an approved sampling policy, and it explicitly says that a referral does not establish a policy violation. The selected record is encrypted and written to the customer’s regional cloud storage. The supplied documentation identifies AWS S3, Azure Blob, Google Cloud Storage, and OCI as supported storage locations. It also describes two encryption layers: an OpenAI-managed HPKE layer and a customer-managed Enterprise Key Management layer.

OpenAI retains an index containing operational metadata and a storage reference, rather than a copy of the content itself. Encryption and storage run asynchronously and do not block inference. The retained records have a 30-day TTL, according to the supplied material. ZDR with PSP is enabled per project, but an organization must first be approved for Zero Data Retention. The documentation does not provide a price, a general-availability date, or an approval timetable.

For the review step, encrypted customer content is decrypted only in an approved, hardware-attested Safety Review Runtime with human access disabled. OpenAI frames the system around three principles: customers control content; safety review must not create a route for OpenAI personnel to read protected content; and stored content is retained only for approved safety purposes. Only bounded safety signals and operational metadata leave the protected review in plaintext. Customers control the permissions and customer-managed EKM authorization required to retrieve and decrypt protected safety records. OpenAI says such customer content cannot be used to train models or made available to other groups within OpenAI or its partners.

## What the archive adds
An earlier Telegram post described OpenAI extending Zero Data Retention to frontier models and treated retention controls as part of enterprise deployment architecture. This documentation supplies a new technical fact on that known story: selected interactions may be held in customer-controlled storage for asynchronous automated safety review in a protected runtime. It does not establish that the earlier access conditions, pricing, or eligibility rules have changed.

## Trend signal
This supports [agent security moving to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/). The protection described here is not merely a policy statement: it relies on encryption layers, customer-controlled permissions, an attested review environment, and disabled human access. The evidence is specific to OpenAI’s safety-review path, however, and does not demonstrate a general security model for every agent runtime or application integration.

## Why it matters
For a team handling sensitive prompts, “zero retention” is not a complete architecture answer. A privacy, security, or procurement review still needs to establish what happens if content must enter a safety process, who stores the record, who can authorize decryption, what can emerge from the review environment, and whether the path affects live inference.

This guide gives a more concrete set of claims to examine. Eligible interactions can be selected by classifier referral or approved sampling; their storage is asynchronous; the content is placed in the customer’s regional cloud container; and the automated review environment is described as hardware-attested and inaccessible to people. That can help teams turn a broad vendor assurance into implementation questions for their own threat model, data classification rules, and internal approval process.

It is also a reminder that safety review and retention are separable design choices. OpenAI’s design does not say review disappears under ZDR. Instead, it describes a constrained route for selected records, with bounded outputs returned from the protected runtime. Teams should assess whether those constraints match their required data residency, key-management, audit, and incident-response controls.

## Limits and uncertainty
The source is OpenAI product documentation, not an independent audit, penetration test, or operational measurement. It describes intended system properties but does not quantify how often prompts or responses are selected, publish classifier thresholds, enumerate every safety signal that may leave the runtime, or report false-positive and false-negative rates. It also does not establish performance characteristics beyond saying storage does not block inference.

The supplied material names a 30-day TTL and supported customer storage options, but it does not detail regional availability, configuration steps, approval criteria for ZDR, cost, or a rollout schedule. The guide links to a technical white paper for the full architecture and security model. This note is limited to the claims present in the supplied documentation and should not be read as a deployment guarantee or a substitute for legal and compliance review.

## Skill to build now
Map one sensitive API workflow before treating a retention label as sufficient. Record which prompts and responses could be sampled, which cloud account and regional container would hold them, who controls EKM authorization, and which team can interpret returned safety signals. Then ask whether a 30-day retained-record window and asynchronous review fit the workflow’s data-handling policy. This is a concrete design review even if the organization has not yet obtained ZDR approval.

## Reader takeaway
ZDR with PSP is a defined safety-review architecture, not a claim that safety review vanishes. OpenAI says selected API interactions can stay in customer-controlled storage, be decrypted only inside a hardware-attested runtime with no human access, and return only bounded signals. Teams should validate access, storage, key-control, and approval details before relying on it in production.

## Open question
How frequently are interactions selected under approved sampling policies, and what precise safety decisions and operational metadata can leave the Safety Review Runtime?

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Agent Security](https://newruntime.com/topics/agent-security.md): Explore the agent-security topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)