Vendors · Questionnaire · OpenAI
Read OpenAI’s own answers to nine buyer questions
OpenAI API. Each answer quotes OpenAI’s own page or feed as kept on the day shown. Each question cites the NIST text that asks it. The answers are not a score and not a verdict.
Q1
Does the vendor train its models on business and API customers’ data?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
Not by default
As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us).
Data controls in the OpenAI platform, kept 24 Oct 2026 · sha256 d0d554ce8d61
Q2
Does the vendor train its models on free and consumer use of its products?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
Not read
The vendor record does not read this point for OpenAI.
Q3
How long does the vendor keep the data that customers send?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
Up to 30 days in abuse monitoring logs, with listed exceptions
By default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days, unless longer retention is required by law, or is reasonably necessary to protect our services or any third party from harm.
Under “Data retention controls for abuse monitoring”. Application state is kept separately; for /v1/responses the page says “response data will be stored for at least 30 days.” Data controls in the OpenAI platform, kept 24 Oct 2026 · sha256 d0d554ce8d61
Q4
Can a customer have the vendor keep none of its data?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
Zero Data Retention, on approval
Eligible customers may have their customer content excluded from these abuse monitoring logs, subject to the limitations below, by getting approved for the Zero Data Retention or Modified Abuse Monitoring controls.
Data controls in the OpenAI platform, kept 24 Oct 2026 · sha256 d0d554ce8d61
Q5
Where does the vendor process and store customer data?
NIST AI 600-1, action GV-6.1-009: “Update and integrate due diligence processes for GAI acquisition and procurement vendor assessments to include intellectual property, data privacy …”
NIST AI RMF 1.0, GOVERN 6.1
Data residency controls, for eligible customers
Data residency controls are a project configuration option that allow you to configure the location of infrastructure OpenAI uses to provide services.
The next line reads: “Contact our sales team to see if you’re eligible for using data residency controls.” Data controls in the OpenAI platform, kept 24 Oct 2026 · sha256 d0d554ce8d61
Q6
Which other companies process customer data for the vendor?
NIST AI 600-1, action GV-6.1-007: “Inventory all third-party entities with access to organizational content and establish approved GAI technology and service provider lists.”
NIST AI RMF 1.0, GOVERN 6.1; NIST AI RMF 1.0, MANAGE 3.1
Uses sub-processors; names Cloudflare for the US and EU endpoints
OpenAI uses sub-processors to provide its services. For requests sent to us.api.openai.com or eu.api.openai.com, OpenAI uses Cloudflare Regional Services so that TLS termination and HTTPS decryption occur within the selected processing region.
Data controls in the OpenAI platform, kept 24 Oct 2026 · sha256 d0d554ce8d61
Q7
Which independent audits or certifications does the vendor name?
NIST AI 600-1, Appendix A.1.3: “statement on standards for attestation engagement (SSAE) reports to help with third-party transparency and risk management for GAI systems”
NIST AI RMF 1.0, GOVERN 6.1
Not published in the pages kept
Searched: Data controls in the OpenAI platform; Rate limits. Not kept, so not searched: Privacy policy; Terms of use; Sub-processor list; Data processing addendum.
Q8
Does the vendor publish a history of its service incidents?
NIST AI 600-1, action GV-6.2-007: “Service Level Agreements (SLAs) in vendor contracts that address incident response, response times, and availability of critical support.”
NIST AI RMF 1.0, GOVERN 6.2
Yes: a status history feed, with 106 incidents kept since 2026-07-28
Status history feed, kept 1 Nov 2026 · sha256 88638b2719ba. The record.
Q9
Does the vendor publish the dates on which it retires its models?
NIST AI 600-1, action GV-6.2-007: “Review vendor contracts and avoid arbitrary or capricious termination of critical GAI technologies or vendor services …”
NIST AI RMF 1.0, GOVERN 6.2
Yes: OpenAI (“Deprecations”), with 171 dated retirements kept
OpenAI, “Deprecations”, kept 26 Oct 2026 · sha256 2aa6645af207. The record.
- OpenAI, Data controls in the OpenAI platform, kept 24 Oct 2026.
- OpenAI, Status history feed, kept 1 Nov 2026.
- OpenAI, Deprecations, kept 26 Oct 2026.
- NIST, NIST AI 600-1, 2024-07. Republished courtesy of the National Institute of Standards and Technology.