OpenAI is previewing Private Safety Processing, a system designed to close a gap that has quietly shaped enterprise AI adoption: how do you monitor for misuse across multiple interactions when your customer legally can’t let you see their data? The answer, at least in this early test, is automated pattern detection that runs on encrypted content and returns only narrow signals — never the underlying prompts or responses.
The problem is real and getting sharper. As models take on longer agentic tasks, risks can emerge only across sequences: a bad actor probing safeguards across accounts, a system continuing to act after a user says stop. Existing Zero Data Retention (ZDR) safety tools evaluate each interaction in isolation, which misses those patterns. Private Safety Processing extends the protections across related interactions, whether customer content lives on infrastructure the customer controls or on OpenAI storage encrypted with keys the customer holds. OpenAI personnel never get those keys.
When a risk is flagged, OpenAI receives a narrowly defined signal about the type of activity involved — similar to what existing safety systems already send — and can decide whether enforcement is warranted. Crucially, even flagged content stays inaccessible to OpenAI staff. Customers investigate alerts using their own systems and can choose to share information if they want to appeal a decision or support an abuse investigation.
Early customers are testing it now. Arvind Jain at Glean put the stakes plainly: enterprise adoption depends on customer control of data. The fact that OpenAI is previewing this rather than shipping it suggests the technical challenges are nontrivial — encrypted pattern detection across distributed infrastructure is a hard problem. But the direction matters. Frontier-model providers have sometimes required customers to allow content retention for safety monitoring. OpenAI is betting it can offer both. If it works, ZDR stops being a tradeoff and becomes a default.
