lagindicator

Zero Data Retention at OpenAI: No Switch, Only Approval (Nov 2026)

AI & Models

OpenAI's own documentation says zero data retention (ZDR) requires prior approval granted through Sales, and the console toggle only appears afterwards. This note quotes the exact language, separates 'pay-as-you-go' from buying API credits, and shows why an API account under roughly $10k/month has no documented route to ZDR at all.

There is no switch in the OpenAI API console that turns on zero data retention (ZDR). The setting exists only for organizations that OpenAI has already approved, and the approval is not a purchase or a plan change — it is a discretionary grant from OpenAI, requested through Sales.

That is the whole answer, but the interesting part is how carefully OpenAI’s documentation avoids saying it. OpenAI publishes no eligibility rule and no price, and the only documented request path is a sales contact form that the same help article frames as being for larger spenders. What it publishes is a sequence: ask Sales, be approved, accept extra requirements, then configure a tab that appears only after approval. This note collects the exact language and works out what it means for an individual API user.

What ZDR actually changes

By default, OpenAI generates abuse-monitoring logs for all API traffic and keeps them for up to 30 days. ZDR removes customer content from those logs and forces store to false on the two main inference endpoints. From Data controls in the OpenAI platform:

“Zero Data Retention excludes customer content from abuse monitoring logs in the same way as Modified Abuse Monitoring.

Additionally, Zero Data Retention changes some endpoint behavior: the store parameter for /v1/responses and v1/chat/completions will always be treated as false, even if the request attempts to set the value to true.”

Two limits matter. First, ZDR is not a blanket guarantee: endpoints marked “No” in OpenAI’s table — Assistants objects, threads, /v1/files, /v1/batches, vector stores, fine-tuning jobs — still keep application state even when ZDR is on. Second, OpenAI reserves the right to withhold it: “we reserve the right to make models ineligible for Zero Data Retention or Modified Abuse Monitoring for specific customers, as notified in advance to the impacted customers in writing.”

The gate, in OpenAI’s own words

The API data-controls page:

“Currently, these controls are subject to prior approval by OpenAI and acceptance of additional requirements.”

“Get in touch with our sales team to learn more about these offerings and inquire about eligibility.”

And the console state before approval:

“Once your organization has been approved for data retention controls, you’ll see a Data Retention tab within Settings → Organization → Data controls.”

The help center repeats the same gate with instructions, and adds the sentence that closes the “can’t I just delete my data?” loophole — from How can I contact sales?:

“They require prior approval from OpenAI and acceptance of additional requirements. Contact our Sales team to inquire about eligibility.”

“ChatGPT data export or account deletion does not enable these API controls.”

The marketing pages use the same qualifying language. Business data: “Qualifying organizations are able to configure how long OpenAI retains business data, including opting for our zero data retention policy in the API platform.” Enterprise privacy: “You can also request zero data retention (ZDR) for eligible endpoints if you have a qualifying use-case.”

What “turning it on” looks like

  1. Ask OpenAI through the sales contact form. There is no other documented request channel, and the console offers no documented way to request it.
  2. Be approved and accept “additional requirements.”
  3. In Settings → Organization → Data controls → Data retention, choose ZDR or Modified Abuse Monitoring at the organization level.
  4. Optionally override per project: default, ZDR, MAM, or None.

The newest variant, ZDR with Private Safety Processing, does not create a self-serve path either: “Organizations already approved for Zero Data Retention can set up ZDR with PSP directly in the API console. If your organization isn’t approved for ZDR, see the eligibility and approval requirements.” PSP also requires you to connect your own cloud storage (S3, Azure Blob, GCS, or OCI) and validate it.

The individual and small-account problem

No OpenAI page uses the word “individual” in this context, and no page states a spend threshold for ZDR eligibility. What the pages do is route the request:

  • ZDR and Modified Abuse Monitoring require approval obtained by contacting Sales.
  • Sales, in the same help article, is described as the channel for API customers with “a monthly spend of approximately $10,000 or more.”
  • “For customers with lower usage needs: You can start immediately with a pay-as-you-go API plan.”

The derivation, which I am labelling because it is not a quote: an account below roughly $10k/month is told that Sales is for larger spenders and that its own path is pay-as-you-go — a plan with no retention controls. So there is no documented way for such an account to enable ZDR. That is weaker than “OpenAI will refuse you”: the eligibility criteria are unpublished, so a small account could still submit the form. But nothing in the documentation promises it a route, and the same article’s enterprise section warns that “Our Sales team may not respond to every inquiry.”

Practitioner reports match the documentation. In an OpenAI community thread running from 2024 through 2025, developers with healthcare and financial use cases describe exactly this loop: no settings in the account portal, sales requests submitted repeatedly, no response for months. Those posts are directional, not verified, but they are consistent with the published flow. Zero Data Retention Information.

It is also not automatic above the threshold. Approval is discretionary, comes with extra requirements, and can be narrowed later by OpenAI’s Safety Retention provisions.

“Pay-as-you-go” is not a ZDR tier

The phrase shows up in the routing paragraph, and it is easy to misread as a plan you can buy your way out of. It is not. OpenAI’s help center treats “pay-as-you-go” as a billing arrangement, and for new accounts that arrangement is implemented as prepaid credits — the “Buy credits / Add to credit balance” money:

“Prepaid billing lets you purchase credits before using the API. Your credit balance decreases as you use the API.” — Prepaid API billing

“New API accounts use prepaid billing.” — same article

Credits have their own rules: the minimum purchase is $5 (default $10), auto-reload is on by default, purchased credits expire after one year, and they are non-refundable except for narrow exceptions. API billing is not always prepaid, though — some individual and team accounts are charged on a card at usage thresholds or monthly, while Enterprise customers get invoices: “API billing is not always postpaid. Accounts can use prepaid credits or automatic card payments, while Enterprise API customers receive invoices.” (Invoice dates and API billing).

None of this touches retention. Buying credits changes your balance, not your approval status; there is no documented spend level at which ZDR unlocks, and topping up to imitate a large account is a bad trade given the one-year expiry and no-refund rule.

What is still retained after ZDR is on

ZDR is a logs-level control, not a storage off-switch:

  • Assistants, threads, /v1/files, /v1/batches, vector stores, and fine-tuning jobs keep application state until deleted, even under ZDR.
  • Prompt caching can hold encrypted key/value tensors in GPU-local storage for up to 24 hours.
  • Safety Retention and Private Retention with Private Safety Processing let OpenAI keep encrypted copies for specific customers or models, excluded from human review but not from storage.

If you are a small API user

There is no ZDR for you today, but three things are worth knowing:

  • A few endpoints show abuse-monitoring retention of None by default, without any approval: /v1/audio/transcriptions, /v1/audio/translations, and /v1/moderations. That is not ZDR and does not cover chat or embeddings, but it is the only retention relief available off the shelf.
  • Other providers implement retention differently, and that is the next part of this research. Do not assume “enterprise-friendly” marketing equals a self-serve ZDR switch.
  • If nothing else works, the honest options are redaction before the request, self-hosting an open-weight model, or not sending the data at all.

The bottom line

At OpenAI, zero data retention is a contract you are granted, not a setting you enable. The documentation is consistent about this in four places, and it never publishes who qualifies or what qualifies them. The practical consequence is an asymmetry: a large customer gets a sales conversation, and a small customer gets a pricing page and a 30-day log retention default.

Caveats

  • No OpenAI page says “individuals cannot enable ZDR.” The claim in this note is narrower and derived: there is no self-serve path, and the only documented request channel is described as being for roughly $10k/month and up.
  • The $10,000 figure is sales-routing guidance, not a published eligibility rule. Treat “no documented route” as different from “provably impossible.”
  • Documentation changes quickly; this is a dated snapshot (2026-11-01).
  • help.openai.com blocks scripted fetches with HTTP 403, so those articles were read through a reader proxy on the canonical URLs; the developer docs and marketing pages were fetched directly.
  • Community reports are directional, not verified.

Sources