Vendors · Model makers · OpenAI

OpenAI says it trains on API data only when customers opt in

OpenAI API. Each line below quotes OpenAI’s own pages as kept on 3 Nov 2026.

OpenAI’s questionnaire: nine buyer questions, each answered from these pages.

OpenAI’s record as an AI bill of materials: CycloneDX · SPDX. Not signed.

OpenAI’s status history: every incident on its status page, kept from its own feed.

What the pages say

each value, then the words it is read from
Training on business and API data
Not by default

As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us).

Data controls in the OpenAI platform, kept 24 Oct 2026 · sha256 d0d554ce8d61

How long API data is kept
Up to 30 days in abuse monitoring logs, with listed exceptions

By default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days, unless longer retention is required by law, or is reasonably necessary to protect our services or any third party from harm.

Under “Data retention controls for abuse monitoring”. Application state is kept separately; for /v1/responses the page says “response data will be stored for at least 30 days.” Data controls in the OpenAI platform, kept 24 Oct 2026 · sha256 d0d554ce8d61

Option to keep no data
Zero Data Retention, on approval

Eligible customers may have their customer content excluded from these abuse monitoring logs, subject to the limitations below, by getting approved for the Zero Data Retention or Modified Abuse Monitoring controls.

Data controls in the OpenAI platform, kept 24 Oct 2026 · sha256 d0d554ce8d61

Where data is processed and stored
Data residency controls, for eligible customers

Data residency controls are a project configuration option that allow you to configure the location of infrastructure OpenAI uses to provide services.

The next line reads: “Contact our sales team to see if you’re eligible for using data residency controls.” Data controls in the OpenAI platform, kept 24 Oct 2026 · sha256 d0d554ce8d61

Sub-processors
Uses sub-processors; names Cloudflare for the US and EU endpoints

OpenAI uses sub-processors to provide its services. For requests sent to us.api.openai.com or eu.api.openai.com, OpenAI uses Cloudflare Regional Services so that TLS termination and HTTPS decryption occur within the selected processing region.

Data controls in the OpenAI platform, kept 24 Oct 2026 · sha256 d0d554ce8d61

Certifications and audits
Not stated in the pages kept
Searched: Data controls in the OpenAI platform; Rate limits.
Data processing agreement
Not stated in the pages kept
Searched: Data controls in the OpenAI platform; Rate limits.
Published usage limits
Rate limits by model, organization and project; usage tiers rise with credit purchases

The three paid usage tiers are Build, Launch, and Grow. Your organization’s usage tier upgrades automatically as its total credit purchases reach each threshold.

The page also says: “Rate limits are defined at the organization level and at the project level, not user level.” and “OpenAI sets an approved monthly usage limit for each organization.” Rate limits, kept 3 Nov 2026 · sha256 850e5704abd7

Pages kept

each copy is held with the sha256 of its bytes as served
Page The page’s date Newest copy Checks
Data controls in the OpenAI platformAPI data use and retention none printed 24 Oct 2026, 634 KBsha256 d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95
  • 24 Oct 2026: kept
  • 26 Oct 2026: same text as 24 Oct 2026
Rate limitsAPI rate limits and usage tiers none printed 3 Nov 2026, 472 KBsha256 850e5704abd712706740bd40223a26958bc4579dcb2fc0e361250d2b1a0ad81a
  • 3 Nov 2026: kept

No kept page of OpenAI has changed

first kept on 24 Oct 2026

Pages not kept

no page is kept from behind a sign-in or a refusal

Sources

vendors.csv Every dataset → Status → Glossary →