OpenAI API

OpenAI provides a SOC 2 Type II report for its API but it is only downloadable to logged‑in customers via the Trust Portal.

Customers with active trust.openai.com accounts can access the latest report under "Documents."

source

The OpenAI Trust Portal publicly displays the ISO/IEC 27001:2022 certificate and explicitly states it covers the OpenAI API.

OpenAI's ISO/IEC 27001 Certificate is now available at trust.openai.com ... This certificate documents OpenAI's operation an Information Security Management System that conforms to the requirements of ISO/IEC 27001:2022 for OpenAI’s API, ChatGPT Enterprise, and ChatGPT Edu services.

source

The OpenAI security & privacy page publicly states the ISO/IEC 42001 certification, covering its AI products including the API.

OpenAI maintains an ISO/IEC 42001:2023 AI Management System covering OpenAI’s consumer and business AI products and models in its role as an AI producer and AI provider.

source

OpenAI provides a publicly accessible Trust Portal that includes compliance documentation for the API, confirming a maintained trust center.

The 2025 SOC2 Report for OpenAI's ChatGPT Business Products and API is now available to customers at trust.openai.com

source

OpenAI provides a BAA for the API only after a gated email request and review, matching the yes_sales_gated definition.

If you require a BAA before you can use our API, email us at [email protected] ... Our team will respond within 1-2 business days. We review each BAA request on a case‑by‑case basis and may need additional information.

source

OpenAI provides a publicly accessible Data Processing Addendum that includes SCC‑based transfer provisions and authorizes use of a publicly listed Sub‑Processor List, meeting both requirements.

"it will do so on the basis of agreements containing SCCs that ensure appropriate safeguards for the protection of Customer Data are in place or an adequacy decision issued by the European Commission" and "Customer hereby provides a general authorization to OpenAI to engage the Sub-Processors listed in the Sub-Processor List to process Customer Data in connection with the Services."

source

OpenAI's own Help Center page publicly states that API data is not used for training by default, confirming the commitment.

By default, we do not train on any inputs or outputs from our products for business users, including ChatGPT Business, ChatGPT Enterprise, and the API.

source

OpenAI documents a 30‑day default retention and states Zero Data Retention is only available after sales‑gated approval, matching yes_sales_gated.

By default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days... Eligible customers may have their customer content excluded from these abuse monitoring logs, ... by getting approved for the Zero Data Retention ... Currently, these controls are subject to prior approval by OpenAI and acceptance of additional requirements.

source

The OpenAI API data residency feature is documented on OpenAI's own site but is gated: only Enterprise Customers approved for advanced data controls (requires sales contact and prior approval) can use it, making it yes_sales_gated, not publicly self-serve.

Enterprise Customers that have been approved for advanced data controls can enable regional data residency by creating a new Project in the API Platform dashboard and selecting their preferred region.

source

The EC's GPAI Code of Practice signatory list publicly includes OpenAI, confirming the developer is on the list.

OpenAI

source

OpenAI’s official EU AI Act help page publicly states it publishes Article 53 training‑data summaries, satisfying the public publication requirement.

In accordance with our obligations under Article 53(1)(d) of the EU AI Act, OpenAI publishes summaries about the content used to train our general-purpose AI models:

source