OpenAI introduced zero-retention security processing and confidential inference preview. Understand what this protects and what controls remain internal.
Direct answer
On September 29, 2026, OpenAI presented Private Intelligence for organizations. The announcement includes Zero Data Retention with Private Safety Processing, which automates OpenAI security reviews without human access to the underlying content, and a preview of Private Inference based on confidential computing and verifiable controls. These mechanisms reduce supplier exposure, but are not a substitute for data minimization, identity, authorization, registration, contract and full flow assessment.
Zero retention reduces a portion of the surface
Not saving content to the service limits persistence, but data may still exist at the source, in integrations, application logs, or exported outputs. The inventory needs to cover the entire chain.
Confidential computing seeks protection during use
Encryption at rest and in transit does not solve processing time alone. Confidential environments seek to restrict access at this stage, with properties that need to be verified in the contracted product.
Automated security demands transparency
Human-free reviews can be important for sensitive data, as long as scope, retention, purpose, false positives, and dispute routes are documented.
Internal permissions remain decisive
A private platform does not prevent a person from sending inappropriate information or a connector from exposing more data than necessary. Least privilege, classification, and auditing remain mandatory.
Nexus Reading
Privacy should be an architectural requirement, not an isolated seal. Mapping origin, processing, tools, logs, output and disposal allows you to decide where each control actually reduces risk.
FAQ
Does zero retention mean no data exists?
No. It means a specific policy on the service; sources, integrations, own logs and derived files still need to be governed.
Is Private Inference widely available yet?
The announcement describes it as expected in fall 2026; Availability and terms must be confirmed in the contract.
Which control comes first?
Minimize data sent, limit tools and permissions, and record who authorized each flow.
Essential guides to delve deeper into the decision
This editorial analysis was produced by Nexus from the official sources below, consulted on October 7, 2026. The text is original and interprets practical implications for companies.
- OpenAI — DevDay 2026 Recap: official description of Private Intelligence, ZDR, Private Safety Processing and Private Inference.
- OpenAI — Enterprise privacy: official commitments to privacy, control and processing of business data.
Date reported by the main source: September 29, 2026.