Data controls in the OpenAI platform changed OpenAI, Sep 24, 2026

1. +Added: Abuse monitoring logs: Logs generated from your use of the platform, necessary for OpenAI to enforce our Usage Policies and agreements and mitigate harmful uses of AI.
2. -Removed: Abuse monitoring logs: Logs generated from your use of the platform, necessary for OpenAI to enforce our API data usage policies and mitigate harmful uses of AI.
3. +Added: Abuse monitoring logs may contain certain customer content, such as prompts and responses, as well as metadata derived from that customer content, such as classifier outputs. By default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days, unless longer retention is required by law, or is reasonably necessary to protect our services or any third party from harm.
4. +Added: Eligible customers may have their customer content excluded from these abuse monitoring logs, subject to the limitations below, by getting approved for the Zero Data Retention or Modified Abuse Monitoring controls. Currently, these controls are subject to prior approval by OpenAI and acceptance of additional requirements. Approved customers may select between Modified Abuse Monitoring or Zero Data Retention for their API Organization or project.
5. -Removed: Abuse monitoring logs may contain certain customer content, such as prompts and responses, as well as metadata derived from that customer content, such as classifier outputs. By default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days, unless we are legally required to retain the logs for longer.
6. -Removed: Eligible customers may have their customer content excluded from these abuse monitoring logs by getting approved for the Zero Data Retention or Modified Abuse Monitoring controls. Currently, these controls are subject to prior approval by OpenAI and acceptance of additional requirements. Approved customers may select between Modified Abuse Monitoring or Zero Data Retention for their API Organization or project.
7. +Added: Zero Data Retention excludes customer content from abuse monitoring logs in the same way as Modified Abuse Monitoring.
8. -Removed: Zero Data Retention excludes customer content from abuse monitoring logs, in the same way as Modified Abuse Monitoring.
9. +Added: Zero Data Retention with Private Safety Processing enables OpenAI to perform automated safety monitoring while preserving Zero Data Retention protections. Endpoint and feature limitations listed on this page still apply.
10. +Added: Customers using ZDR with PSP must configure customer-controlled storage and meet additional technical and operational requirements described in the ZDR with Private Safety Processing guide .
11. +Added: For customers approved for Zero Data Retention or Modified Abuse Monitoring, we reserve the right to make models ineligible for Zero Data Retention or Modified Abuse Monitoring for specific customers, as notified in advance to the impacted customers in writing. In this instance, customer content will be retained in encrypted abuse monitoring logs in OpenAI-managed infrastructure, but such content will be excluded from human review unless required by applicable law. For additional information, see Appendix A of the Private Safety Processing technical whitepaper .
12. +Added: For customers who have executed an OpenAI Business Associate and Healthcare Addendum, once your org ID is provisioned with Private Retention with Private Safety Processing, BAA-eligible endpoints can be used for processing PHI, even if data is retained. Endpoint and feature limitations listed on this page still apply.
13. +Added: For customers approved for Zero Data Retention or Modified Abuse Monitoring, we reserve the right to make models ineligible for Zero Data Retention or Modified Abuse Monitoring for specific customers if reasonably necessary to investigate or prevent severe risk activity, as notified in advance to the impacted customers in writing. In this instance, we may retain and human review customer content when using these models that our classifiers detect as potentially violating our Usage Policies or your agreement. Otherwise retention will not be affected. For customers who have executed an OpenAI Business Associate and Healthcare Addendum, once your org ID is provisioned with Safety Retention, BAA-eligible endpoints can be used for processing PHI, even if data is retained.
14. +Added: The table below indicates when application state is stored for each endpoint. Zero Data Retention eligible endpoints do not retain any customer content for application state, subject to the limitations below. Zero Data Retention ineligible endpoints or capabilities may retain application state when used, even if you have Zero Data Retention enabled.
15. -Removed: The table below indicates when application state is stored for each endpoint. Zero Data Retention eligible endpoints will not store any data. Zero Data Retention ineligible endpoints or capabilities may store application state when used, even if you have Zero Data Retention enabled.
16. +Added: Prompt caching may store encrypted key/value tensors in GPU-local storage as application state. This data is stored on the local GPU machines and is not retained after the 24-hour expiration. For gpt-5.5 and gpt-5.5-pro , setting prompt_cache_retention to in_memory returns an error. For GPT-5.6 models and later model families, prompt_cache_options.ttl controls the minimum cache lifetime, not this maximum application-state retention period. To learn more, see the prompt caching guide .
17. +Added: Except as noted below, the Responses API has a 30 day Application State retention period by default, or when the store parameter is set to true . In those cases, response data will be stored for at least 30 days.
18. +Added: Background mode stores response data to disk for roughly 10 minutes to enable polling. For projects using Modified Abuse Monitoring , including enhanced Modified Abuse Monitoring, foreground requests follow standard retention when store is omitted or set to true . Background responses follow the standard retention period only when the request explicitly sets store=true . If store is omitted or set to false for a background request, the response is deleted after the temporary polling period.
19. -Removed: Extended prompt caching requires storing key/value tensors to GPU-local storage as application state. This storage requirement means that requests leveraging extended prompt caching are not Zero Data Retention eligible. To learn more, see the prompt caching guide .
20. -Removed: The Responses API has a 30 day Application State retention period by default, or when the store parameter is set to true . Response data will be stored for at least 30 days.
21. -Removed: Background mode stores response data for roughly 10 minutes to enable polling, so it is not compatible with Zero Data Retention even though background=true is still accepted for legacy ZDR keys. Modified Abuse Monitoring (MAM) projects can continue to use background mode.
22. +Added: Hosted containers used by Hosted Shell and Code Interpreter may write temporary application state to the container filesystem (backed by ephemeral block storage) while the container is active. Container data is deleted when the container expires or is explicitly deleted.
23. +Added: When Zero Data Retention is not enabled for an organization, all queries use extended prompt caching for all supported models.
24. +Added: For server-side compaction, no data is retained when store="false" .
25. +Added: We support Skills in two form factors, both local execution and hosted container-based execution. Hosted skills follow the same container lifecycle as hosted shell: mounted skills and container files remain available while the container is active and are discarded when the container expires or is deleted.
26. +Added: Data transmitted to third-party services over network connections is subject to their data retention policies.
27. -Removed: The Code Interpreter tool cannot be used when Zero Data Retention is enabled. Code Interpreter can be used with Modified Abuse Monitoring instead.
28. +Added: Image generation is Zero Data Retention compatible when using gpt-image-2.5-sunburst , gpt-image-2.5-sunburst-2026-09-08 , gpt-image-2.5-flare , gpt-image-2.5-flare-2026-09-08 , gpt-image-2 , gpt-image-1.5 , gpt-image-1 , and gpt-image-1-mini .
29. -Removed: Image generation is Zero Data Retention compatible when using gpt-image-1 , gpt-image-1.5 , and gpt-image-1-mini , not when using dall-e-3 or dall-e-2 .
30. +Added: Before the September 24, 2026 shutdown, the Videos API documentation specified 48 hours for downloading generated videos, followed by 30 days of retention for abuse monitoring. These periods describe the policy documented before shutdown; they do not promise download access after shutdown. See the Videos API shutdown notice .
31. +Added: Images and files may be uploaded as inputs to /v1/responses (including when using the Computer Use tool), /v1/chat/completions , and /v1/images . Image and file inputs are scanned for CSAM content upon submission. If the classifier detects potential CSAM content, the image will be retained for manual review, even if Zero Data Retention, Modified Abuse Monitoring, or Private Retention with PSP is enabled.
32. +Added: Web Search with live internet access is not HIPAA eligible and is not covered by a BAA. Web Search in offline/cache-only mode ( external_web_access: false ) is eligible to be covered by a BAA when used with an API key from a ZDR-enabled project within a ZDR organization. This HIPAA/BAA guidance applies only to the Responses API web_search tool. Note: Preview variants ( web_search_preview ) ignore this parameter and behave as if external_web_access is true . We recommend using web_search .
33. -Removed: The v1/videos is not compatible with data retention controls. If your organization has data retention controls enabled, configure a project with its retention setting set to None as described in Configuring data retention controls to use /v1/videos with that project.
34. -Removed: Images and files may be uploaded as inputs to /v1/responses (including when using the Computer Use tool), /v1/chat/completions , and /v1/images . Image and file inputs are scanned for CSAM content upon submission. If the classifier detects potential CSAM content, the image will be retained for manual review, even if Zero Data Retention or Modified Abuse Monitoring is enabled.
35. -Removed: Web Search is ZDR eligible, but Web Search is not HIPAA eligible and is not covered by a BAA.
36. +Added: Contact our sales team to see if you're eligible for using data residency controls. Data residency endpoints are charged a 10% uplift for models released on or after March 5, 2026, that are eligible for data residency.
37. -Removed: Contact our sales team to see if you're eligible for using data residency controls.
38. +Added: Data residency does not apply to system data, which may be processed and stored outside the selected region. System data means account data, metadata, and usage data that do not contain Customer Content, which are collected by the services and used to manage and operate the services, such as account information or profiles of end users that directly access the services (for example, your personnel), analytics, usage statistics, billing information, support requests, and structured output schema.
39. +Added: OpenAI uses sub-processors to provide its services. For requests sent to us.api.openai.com or eu.api.openai.com , OpenAI uses Cloudflare Regional Services so that TLS termination and HTTPS decryption occur within the selected processing region.
40. +Added: Data residency does not apply to: (1) any transmission or storage of Customer Content outside of the selected region caused by the location of an End User or Customer's infrastructure when accessing the services; (2) products, services, or content offered by parties other than OpenAI through the Services; or (3) any data other than Customer Content, such as system data.
41. -Removed: Data residency does not apply to system data, which may be processed and stored outside the selected region. System data means account data, metadata, and usage data that do not contain Customer Content, which are collected by the services and used to manage and operate the services, such as account information or profiles of end users that directly access the services (e.g., your personnel), analytics, usage statistics, billing information, support requests, and structured output schema.
42. -Removed: Data residency does not apply to: (a) any transmission or storage of Customer Content outside of the selected region caused by the location of an End User or Customer's infrastructure when accessing the services; (b) products, services, or content offered by parties other than OpenAI through the Services; or (c) any data other than Customer Content, such as system data.
43. +Added: To use data residency with any region other than the United States, you must be approved for abuse monitoring controls, and execute a Modified Retention amendment.
44. -Removed: To use data residency with any region other than the United States, you must be approved for abuse monitoring controls, and execute a Zero Data Retention amendment.
45. +Added: For requests to projects with data residency configured, add the domain prefix as defined in the table below to each request.
46. +Added: As an alternative to creating a region-specific project, you can select regional processing for an individual request by using the prefixed domain with an API key from a project having Global geography.
47. +Added: Existing eligibility and data retention control requirements still apply. The selected endpoint and model must also support regional processing, as shown in the table below.
48. +Added: The following example reuses one client and an API key from a Global project for global, US, and EU requests:
49. -Removed: For requests to projects with data residency configured, add the domain prefix as defined in the table below to each request. For regions where the prefix is marked as optional, including the prefix may help improve response latency for your requests.
50. +Added: Use Support by region to compare regional capabilities and expand the services available in each region. Use API Endpoint, tool and model support for complete model lists and a detailed service view. Support for regional storage does not imply support for regional processing.
51. +Added: For GPT-6 Sol and Luna, EU data residency is available only with Standard processing for Responses and Chat Completions.
52. +Added: gpt-5.4-pro-2026-03-05 gpt-5.2-pro-2025-12-11 gpt-5-pro-2025-10-06 gpt-5.6-sol gpt-5.6-terra gpt-5.6-luna gpt-5.5-2026-04-23 gpt-5.4-2026-03-05 gpt-5-2025-08-07 gpt-5.4-mini-2026-03-17 gpt-5.4-nano-2026-03-17 gpt-5.2-2025-12-11 gpt-5.1-2025-11-13 gpt-5-mini-2025-08-07 gpt-5-nano-2025-08-07 gpt-4.1-2025-04-14 gpt-4.1-mini-2025-04-14 gpt-4.1-nano-2025-04-14 o3-2025-04-16 o4-mini-2025-04-16 o1-pro o1-pro-2025-03-19 o3-mini-2025-01-31 o1-2024-12-17 gpt-4o-2024-11-20 gpt-4o-2024-08-06 gpt-4o-mini-2024-07-18 gpt-4-turbo-2024-04-09 gpt-4-0613 gpt-3.5-turbo-0125
53. +Added: Modes: Text, Audio, Voice, Image *
54. -Removed: Table 1: Regional data residency capabilities
55. +Added: ** Requires Zero Data Retention, Modified Abuse Monitoring, Private Retention with PSP, or Safety Retention.
56. +Added: Filter by service, endpoint, tool, or model snapshot.
57. +Added: gpt-5.5-pro-2026-04-23 gpt-5.4-pro-2026-03-05 gpt-5.2-pro-2025-12-11 gpt-5-pro-2025-10-06 gpt-5.6-sol gpt-5.6-terra gpt-5.6-luna gpt-5.5-2026-04-23 gpt-5.4-2026-03-05 gpt-5-2025-08-07 gpt-5.4-mini-2026-03-17 gpt-5.4-nano-2026-03-17 gpt-5.2-2025-12-11 gpt-5.1-2025-11-13 gpt-5-mini-2025-08-07 gpt-5-nano-2025-08-07 gpt-4.1-2025-04-14 gpt-4.1-mini-2025-04-14 gpt-4.1-nano-2025-04-14 o3-2025-04-16 o4-mini-2025-04-16 o1-pro o1-pro-2025-03-19 o3-mini-2025-01-31 o1-2024-12-17 gpt-4o-2024-11-20 gpt-4o-2024-08-06 gpt-4o-mini-2024-07-18 gpt-4-turbo-2024-04-09 gpt-4-0613 gpt-3.5-turbo-0125
58. +Added: For GPT-6 Sol and Luna, EU data residency is available only with Standard processing.
59. +Added: gpt-5.6-sol gpt-5.6-terra gpt-5.6-luna gpt-5.5-2026-04-23 gpt-5.4-2026-03-05 gpt-5.4-mini-2026-03-17 gpt-5.4-nano-2026-03-17 gpt-5.2-2025-12-11 gpt-5.1-2025-11-13 gpt-5-2025-08-07 gpt-5-mini-2025-08-07 gpt-5-nano-2025-08-07 gpt-4.1-2025-04-14 gpt-4.1-mini-2025-04-14 gpt-4.1-nano-2025-04-14 o3-mini-2025-01-31 o3-2025-04-16 o4-mini-2025-04-16 o1-2024-12-17 gpt-4o-2024-11-20 gpt-4o-2024-08-06 gpt-4o-mini-2024-07-18 gpt-4-turbo-2024-04-09 gpt-4-0613 gpt-3.5-turbo-0125
60. +Added: Supported when used with base64 file uploads.

25 more changed paragraphs are on the page itself.