OpenAI built a safety system that catches misuse without storing your data
Private Safety Processing flags abuse across conversations. Staff get a category and severity score, never the prompt itself.
OpenAI's new system reads chats to catch misuse, then tells staff only a category and severity score.
OpenAI announced Private Safety Processing on Wednesday at 20:59 UTC, extending its existing Zero Data Retention policy to catch misuse patterns that only show up across multiple conversations, not a single prompt, without OpenAI staff ever seeing the underlying content. It is running with a small group of early customers now, with a wider rollout and a technical white paper planned for September.
What actually gets reported
The mechanism is the interesting part. Automated systems inspect a customer's interactions in place and return only a narrow safety signal to OpenAI staff: a category and a severity level for the concern, never the prompts or responses that triggered it. Where OpenAI-provided storage is used at all, the content sits encrypted with keys the customer controls, so OpenAI's own personnel cannot read it even if they wanted to.
Risks often only become apparent over the course of multiple conversations.
That is the gap Private Safety Processing closes: a single-prompt filter misses patterns that only read as abuse once stitched across several conversations. The move also reads as a pitch straight at Anthropic's enterprise customers, since Anthropic requires 30 days of retention on its most capable models for safety review. One exception survives regardless of a customer's settings: content flagged as suspected CSAM is retained, because 18 U.S.C. Section 2258A requires it. Zero Data Retention was never going to mean zero.
Why a build studio cares
This is the exact conversation our Deep Audit runs into. A vendor's privacy page says something like the server cannot read your data, and the client wants to know if that survives contact with how the system actually moves information. Deep Audit's data-flow map exists for this: trace what crosses the boundary and who holds the decryption keys, rather than taking the vendor's claim as the audit result.
The CSAM carve-out is the detail worth keeping on file too. Any client leaning on a zero-retention promise for a compliance case, DPDPA readiness included, needs the legal exceptions inside that promise mapped, not assumed away. Full Audit's governance pass exists to write down exactly which laws override a vendor's default settings, and when.
Next step: read The Decoder's writeup and The Register's report before September's white paper lands, then write down which signal categories your own AI vendor actually exposes to its staff. If a vendor's privacy claim needs verifying before you sign, write to us at hello@gattyworks.com.