OpenAI details Private Intelligence protections for business data

OpenAI says it built protections to let users bring advanced intelligence to sensitive work, under the name Private Intelligence.[1] The company describes the offering as designed for business content across ChatGPT, Codex and the API.[3] OpenAI said it was developing the protections in close collaboration with some of its largest customers.[2] OpenAI says its protections are built to let users bring advanced intelligence to sensitive work and are designed for business content across ChatGPT, Codex and the API.[1][3]

OpenAI says businesses own their data, including inputs and outputs, and that the company places strict limits on its own access to business content.[1] It also says it uses encryption, strict access controls and ongoing threat detection to protect business data.[1] For agent use, businesses can decide what agents access, which actions they take and when those actions require approval.[1] These controls give organizations decisions to consider when configuring agent workflows, including which tasks to permit and where to require review.[1]

Zero Data Retention is available for eligible API workflows; OpenAI says prompts and model responses are not retained after processing in those workflows.[1] OpenAI says Zero Data Retention with Private Safety Processing enables automated safety reviews without giving its personnel access to the underlying content.[4] The company says API interactions may be referred for safety review when a classifier flags them or an approved sampling policy selects them.[5] Its stated asynchronous sampling rate can reach 100% of traffic, but the maximum varies by product and may be significantly lower.[5]

OpenAI labels Private Inference an API preview and describes it as combining confidential computing with controls designed to protect prompts and responses while a model processes them.[1] The company says Private Inference is optional and extends operator-access protections and attestation to eligible safety-inference workloads.[5] For Private Safety Processing, customer-controlled storage must retain encrypted customer content for at least 30 days.[5] OpenAI lists SOC 2 Type 2 audits, ISO certifications, HIPAA support through Business Associate Agreements for eligible services, and FedRAMP support for designated government offerings among its safety and assurance credentials.[1]