OpenAI Zero Data Retention Push Targets Anthropic's 30-Day Rule

Data retention is now a sales pitch

For most of the generative AI boom, enterprise buyers asked one main privacy question: will the vendor train on our data? That is no longer the main question. OpenAI is now competing with Anthropic on a narrower and more technical promise, which is whether it will keep customer prompts and outputs at all. Fortune reports that the two labs are fighting directly over "zero data retention" (ZDR) policies. It also reports that many companies want guaranteed control over their data and are looking at open models and "sovereign AI" as a hedge against both labs.11

This is a security story more than a marketing one. Whether data is retained decides who can be compelled to hand over records, what an attacker or insider could reach, and how a model provider detects misuse of increasingly capable systems. OpenAI and Anthropic have given opposite answers to that last question.

How Anthropic opened the door

The opening came from Anthropic. On June 9, the company launched its most powerful models, Fable 5 and Mythos 5, with a mandatory 30-day retention requirement on all of their traffic. The requirement applied on every platform serving those models, including AWS Bedrock and Google Vertex AI, and it overrode zero-retention agreements some customers had already signed.16 Anthropic said it needed the data to detect misuse, would not train on it, and would delete it after 30 days "in almost all cases."16 Customers cannot opt out for these covered models. Customer-managed encryption keys control how retained data is protected, not whether it is retained.

Anthropic knew this would be unpopular. In its August risk report it acknowledged that requiring 30-day retention on its most capable models would likely upset customers used to zero retention. Its rollout had other problems too. Three days after launch, a US Department of Commerce letter barred non-US nationals from using Fable 5 and Mythos 5. Anthropic revoked customer access worldwide until the controls lifted around June 30.16

The fallout is concrete. The Information, as summarized by BigGo Finance, reported that Nvidia, Palantir and Booz Allen Hamilton have restricted their use of frontier models from both Anthropic and OpenAI over how proprietary data is handled, and traced much of the unease to Anthropic's June change. The same reporting says a large US utility dropped plans to test Fable on core power infrastructure after Anthropic refused to agree to an irrevocable zero-retention policy. Microsoft CEO Satya Nadella has also warned that companies relying on frontier labs risk paying for intelligence twice: once in money, and again in the proprietary knowledge they have to reveal.11

OpenAI's answer: keep nothing, flag only what's needed

OpenAI moved into that gap. In an August 19 post it reaffirmed full ZDR for eligible enterprise and API customers on its frontier models. It also previewed Private Safety Processing (PSP), a way to monitor safety without OpenAI holding readable logs.1116 At DevDay 2026 the company grouped this under a broader program called Private Intelligence. It has two parts: ZDR with PSP, available now, and Private Inference, a confidential-computing system OpenAI says will arrive this fall.4

PSP addresses a real problem. OpenAI has argued that its existing ZDR-compatible safety checks mostly look at one interaction at a time. As models take on longer, more autonomous work, some dangerous behavior only shows up across a sequence of requests.4 Under the new design, content chosen by a safety classifier or an approved sampling policy is encrypted and written to storage the customer controls, such as an S3 bucket, an Azure Blob container or Google Cloud Storage. Automated review happens inside what OpenAI calls a hardware-attested safety runtime that its staff cannot see into.4 Only predefined safety signals and approved metadata leave that environment in plaintext.4 Wired adds that if the system detects abuse, it flags it to the customer organization, and in some cases alerts OpenAI staff without showing them the conversation.

Several explainers frame the two companies as opposites. Anthropic keeps plaintext for 30 days so approved human reviewers can inspect flagged sessions. OpenAI keeps ZDR and sends only a narrow, categorized signal.

The coverage disagrees on what "zero" means

This is where the reporting splits. Some outlets present PSP as meaning no customer data is stored or reviewed at all, with OpenAI seeing nothing but limited safety signals.15 The more technical coverage tells a different story. VentureBeat notes that according to OpenAI's own PSP documentation, protected records go to customer-controlled storage with a 30-day time-to-live, and customers must keep the storage, permissions and key authorization in place for that period.4 A separate analysis of the PSP developer guide says OpenAI keeps an index of operational metadata and a storage reference, requires encrypted PSP records to be kept for at least 30 days, and still retrieves and processes that content during automated review.14 Fortune describes PSP as adding a data-storage element to ZDR.11

The more careful reading is the right one. OpenAI has not removed retention. It has moved custody of the data and limited who can read it. That is a real difference from Anthropic, because an encrypted record in a customer's own bucket is a different risk from a plaintext log on the vendor's servers. But a buyer who takes "zero data retention" literally will be surprised to find a 30-day encrypted copy in their own cloud that their legal and records teams have to account for.4

OpenAI's standard ZDR has gaps as well. Its data-controls guide covers only some endpoints. Conversations, assistants, files, vector stores, fine-tuning and batch endpoints are not eligible and may keep application state even when ZDR is on.13 Image and file inputs that a classifier flags as potential CSAM are kept for manual review regardless.13 ZDR is also something OpenAI approves per organization or project, not a switch any customer can flip.13 Its trusted-access program for cyber defenders, Daybreak, says outright that approval does not include ZDR.1

The cybersecurity tension in the background

The strongest argument for Anthropic's position is about security, and it deserves a fair hearing. Proton points out that attackers want zero retention for the same reason enterprises do. It cites Anthropic's September threat intelligence report, which describes a platform that routed traffic through US infrastructure to get around regional blocks and used a ZDR service to pass along restricted research requests.16 When a model can do serious offensive work, a provider with no archive has fewer ways to reconstruct an attack. Anthropic is betting that human review of retained sessions catches what automated signals miss. OpenAI is betting that attested, automated review is enough. Neither company has stopped monitoring for safety. They disagree on whether that monitoring needs plaintext.

Retention also brings risks that have nothing to do with the vendor's intentions. A preservation order in the New York Times lawsuit once forced OpenAI to keep ChatGPT and API output logs indefinitely. API customers on ZDR were not affected, because their data had never been stored.16 Retained data is also exposed to legal process. Even when content is deleted, metadata such as classifier scores, identifiers and records of which tools were called can survive and show a lot about how a company operates.16 Telecom provider C Spire has said its contracts with both labs still allow collection of technical usage data, which it worries could show which applications the models connect to.

Flagged content follows different rules. Under Anthropic's published terms, inputs and outputs flagged as violations can be kept for up to two years and the related classification scores for up to seven.16 Security Boulevard notes that this applies regardless of ZDR status, including under HIPAA agreements.9 For security teams that red-team their own systems, this matters: legitimate testing can trip a classifier.

Anthropic is already adjusting

Anthropic does not appear to be holding its position unchanged. It has proposed Enterprise Frontier Safeguards, which would keep misuse-monitoring data in customer-controlled cloud infrastructure, with a phased rollout starting later this fall. That looks a lot like OpenAI's PSP design. Proton also reports that Anthropic's newest models ship without the retention requirement imposed on Fable.16 One integrator's documentation, however, still lists Fable 5.1 and Mythos 5.1 among the covered models that require 30-day retention, so buyers should check the current terms themselves.7

The verdict

OpenAI's offer is a clever piece of competitive positioning built on real engineering, but it is not literally "no data kept." It changes who holds the keys and who can read what. In practice that is the question security teams care about, so it is probably a real advantage while Anthropic's equivalent is still being rolled out. The bigger point is Proton's: a vendor can rewrite its terms on its own, as Anthropic did in June.16 That is why companies like Palantir and Nvidia are looking at contractual guarantees and alternatives instead of relying on announcements.4 Private Inference may eventually offer protection that can be verified. Until OpenAI publishes the hardware, threat model and performance figures, enterprises have to rely on OpenAI's word that the guarantees hold.5