Registry / compare
OpenAI API vs Azure OpenAI Service
The same dimension can grade differently depending on who serves the model. Every cell links to its source; grades are evidence grades, not endorsements.
| Dimension | OpenAI API | Azure OpenAI Service |
|---|---|---|
| SOC 2 Type II | ◐Yes, sales-gated OpenAI provides a SOC 2 Type II report for its API but it is only downloadable to logged‑in customers via the Trust Portal. | ◐Yes, sales-gated Microsoft states SOC 2 reports are available via the gated Service Trust Portal, confirming the report exists but is not publicly downloadable. |
| ISO 27001 | ●Yes, public The OpenAI Trust Portal publicly displays the ISO/IEC 27001:2022 certificate and explicitly states it covers the OpenAI API. | ●Yes, public The recorded value no_public_evidence contradicts the cited page, which is Microsoft's own (learn.microsoft.com) public documentation stating Azure and in-scope services are... |
| ISO 42001 | ●Yes, public The OpenAI security & privacy page publicly states the ISO/IEC 42001 certification, covering its AI products including the API. | ●Yes, public The Microsoft Azure blog publicly announces ISO/IEC 42001:2023 certification for Azure AI Foundry Models and explicitly includes Azure OpenAI models, satisfying the question... |
| Trust center | ●Yes, public OpenAI provides a publicly accessible Trust Portal that includes compliance documentation for the API, confirming a maintained trust center. | ●Yes, public The Microsoft Service Trust Portal (servicetrust.microsoft.com) is Microsoft's own authoritative compliance/trust portal, and the cited document (Azure OpenAI PIA) and its... |
| HIPAA BAA | ◐Yes, sales-gated OpenAI provides a BAA for the API only after a gated email request and review, matching the yes_sales_gated definition. | ●Yes, public Microsoft’s official Q&A page confirms that Azure OpenAI Service is HIPAA‑eligible, and Microsoft’s HIPAA offering states they will sign a BAA for in‑scope services. |
| GDPR DPA | ●Yes, public OpenAI provides a publicly accessible Data Processing Addendum that includes SCC‑based transfer provisions and authorizes use of a publicly listed Sub‑Processor List, meeting... | ●Yes, public Confirmed the recorded value on Microsoft's own page: the EU Model Clauses are provided via a publicly downloadable DPA (aka.ms/DPA, no gate) that incorporates the SCCs and... |
| No-training default | ●Yes, public OpenAI's own Help Center page publicly states that API data is not used for training by default, confirming the commitment. | ●Yes, public The commitment is openly published on Microsoft's own Learn page with no gate, NDA, or portal login, so the default no-training commitment is publicly verifiable: yes_public,... |
| Retention / ZDR | ◐Yes, sales-gated OpenAI documents a 30‑day default retention and states Zero Data Retention is only available after sales‑gated approval, matching yes_sales_gated. | ○No public evidence Official Microsoft documentation of retention and zero-data-retention is behind an authentication gate, so no publicly accessible evidence exists. |
| Residency | ◐Yes, sales-gated The OpenAI API data residency feature is documented on OpenAI's own site but is gated: only Enterprise Customers approved for advanced data controls (requires sales contact and... | ●Yes, public Microsoft’s own Azure OpenAI deployment documentation explicitly states that data can be pinned to a single Azure geography (e.g., an EU region) via Standard or Regional... |
| GPAI Code | ●Yes, public The EC's GPAI Code of Practice signatory list publicly includes OpenAI, confirming the developer is on the list. | ●Yes, public OpenAI, the model developer for Azure OpenAI Service, is listed among the signatories on the European Commission's authoritative GPAI Code of Practice page. |
| Art. 53 summary | ●Yes, public OpenAI’s official EU AI Act help page publicly states it publishes Article 53 training‑data summaries, satisfying the public publication requirement. | ●Yes, public The model developer (OpenAI) states on its own help.openai.com page that it publishes Art. 53(1)(d) training-content summaries and links public per-model summaries (e.g.,... |