Registry / OpenAI API
OpenAI API
OpenAI's first-party API platform for GPT-family models. No training on API business data by default, documented ~30-day abuse-monitoring retention with approval-gated Zero Data Retention, regional data-residency options, and a trust portal (trust.openai.com) covering SOC 2 Type 2 and ISO certifications for the API Platform.
Watch-outs 4
The cells where this offering is not a clean public yes. This is what to check before you sign.
- SOC 2 Type II: Yes, sales-gated Report only accessible to authenticated customers (requires login)
- HIPAA BAA: Yes, sales-gated requires email request to obtain BAA
- Retention / ZDR: Yes, sales-gated Zero Data Retention requires prior approval by OpenAI and sales contact
- Residency: Yes, sales-gated Only approved/eligible enterprise customers can enable EU data residency; not publicly self‑service for all API users.
OpenAI’s Trust Portal confirms a SOC 2 Type II report exists but is gated behind a customer login.
Customers with active trust.openai.com accounts can access the latest report under "Documents."
OpenAI's own public trust portal explicitly states the ISO/IEC 27001:2022 certification covers the API, confirming public evidence.
This certificate documents OpenAI's operation an Information Security Management System that conforms to the requirements of ISO/IEC 27001:2022 for OpenAI’s API, ChatGPT Enterprise, and ChatGPT Edu services.
OpenAI’s public security and privacy page explicitly states the ISO/IEC 42001:2023 AI Management System certification, confirming the yes_public claim.
OpenAI maintains an ISO/IEC 42001:2023 AI Management System covering OpenAI’s consumer and business AI products and models in its role as an AI producer and AI provider.
The provider hosts an openly accessible Trust Portal page confirming a maintained compliance portal.
Welcome to our Trust Portal for OpenAI's ChatGPT services, including ChatGPT Enterprise and ChatGPT Edu.
OpenAI states a BAA for the API is available but must be requested via email, making it sales‑gated.
If you require a BAA before you can use our API, email us at [email protected] with details about your company and use case.
OpenAI’s publicly available DPA contains SCC language and references a publicly accessible Sub‑Processor List, confirming the required DPA with SCCs and subprocessor list are publicly provided.
it will do so on the basis of agreements containing SCCs that ensure appropriate safeguards for the protection of Customer Data are in place
The OpenAI help article publicly states that by default API data is not used to train models, fulfilling the commitment.
By default, we don’t use inputs or outputs from ChatGPT Business, ChatGPT Enterprise, ChatGPT Edu, or our API to improve our models.
OpenAI documents retention policies and states Zero Data Retention is gated behind sales approval, confirming the yes_sales_gated value.
Eligible customers may have their customer content excluded from these abuse monitoring logs, subject to the limitations below, by getting approved for the Zero Data Retention or Modified Abuse Monitoring controls. Currently, these controls are subject to prior approval by OpenAI and acceptance of additional requirements. Get in touch with our sales team to learn more about these offerings and inquire about eligibility.
OpenAI’s own documentation states data residency is limited to eligible/approved customers, confirming the offering is sales‑gated.
Enterprise Customers that have been approved for advanced data controls can enable regional data residency by creating a new Project in the API Platform dashboard and selecting their preferred region.
The EU Commission’s public GPAI Code of Practice signatory list on the referenced page lists OpenAI as a signatory.
- OpenAI
OpenAI hosts a publicly accessible PDF titled 'Public Summary of Training Content for GPT-6 Astra' on its own domain, satisfying the Article 53 training‑data summary requirement.
Public Summary of Training Content for GPT-6 Astra
Spotted an error? Submit a correction with evidence, corrections with a primary source are folded in and credited in the changelog.