OpenAI wants to convince companies to entrust their most sensitive data to AI

With Private Intelligence, OpenAI brings together privacy safeguards, a zero-data-retention policy, and new private inference technology to win over the most demanding enterprises.

Businesses want artificial intelligence capable of reviewing contracts, analyzing financial records, searching internal documentation, and automating sensitive operations. But as AI models become more capable, one question becomes increasingly important: what happens to the information they access? With Private Intelligence, OpenAI is addressing organizations that want to use its most advanced models without giving up control over their data. The company is bringing together several existing protections and a technology still in preview, designed to provide stronger isolation for information while it is being processed.

This is not the launch of a new AI model. Instead, it represents a shift in how OpenAI presents its enterprise services, placing privacy alongside performance as a central selling point. The issue now extends beyond protecting conversations. It also involves AI agents capable of accessing files, using tools, and taking actions on behalf of an organization. OpenAI had already outlined this direction at DevDay on September 29, 2026. Its new Private Intelligence website formalizes the available protections and highlights collaboration with major customers, including Glean and Coinbase. The Question Is No Longer Just What AI Can Do, but What It Can Access

For an organization, using an advanced AI model sometimes means providing access to information that represents a substantial part of its value: business strategies, source code, customer records, legal documents, financial reports, or confidential projects. That information enables AI to produce relevant answers, but processing it raises questions about retention, access, and how data moves between systems.

OpenAI organizes its offering around four commitments: limiting access to business content, recognizing enterprise data ownership, controlling agent actions, and strengthening information security. In principle, these protections are not entirely new. OpenAI's enterprise products already included contractual guarantees, encryption mechanisms, and administrative controls. Private Intelligence aims to bring those elements together into a clearer proposition for projects where privacy is a prerequisite for deployment.

The company also reiterates that business customers retain ownership of their inputs and outputs. That guarantee should be distinguished from the technical conditions under which data is processed. Owning a document does not necessarily mean that no external infrastructure temporarily accesses its contents. This distinction between ownership, retention, and exposure during computation is precisely where OpenAI is now trying to strengthen its offering. Zero Data Retention: Not Keeping Conversations After Processing

One of the main protections highlighted is Zero Data Retention, or ZDR. For eligible API workflows, this policy means OpenAI does not retain prompts or model responses after processing. It addresses the needs of organizations that do not want lasting records of their interactions stored on the provider's systems.

The scope of that guarantee, however, needs to be understood correctly. It does not mean data never passes through OpenAI's infrastructure, nor does it mean every product and feature automatically receives the same protections. The policy applies to eligible uses under specific technical and contractual conditions. Businesses must therefore examine their application configurations and the services they use before assuming a workflow is covered by Zero Data Retention.

OpenAI also associates this approach with Private Safety Processing, introduced at DevDay 2026. The goal is to support automated safety checks without giving OpenAI personnel access to the underlying content. This attempts to reconcile two requirements that can sometimes conflict: minimizing the retention of sensitive business information while maintaining safeguards against dangerous uses of AI.

That combination is especially relevant for industries handling confidential information and operating under strict security obligations. However, it does not replace a contractual review or an assessment of the risks specific to each organization. Private Inference Aims to Protect Data During Computation

The most significant technical development within Private Intelligence is Private Inference, currently offered in preview. Traditional encryption protects information when it travels across networks or is stored. Confidential computing attempts to extend that protection to the period when information is actually being processed. This is a particularly sensitive stage: to generate a response, an AI model must access the information contained in a request, even when that information is encrypted before and after processing.

OpenAI says its approach combines confidential computing environments with strict, verifiable controls. The principle is to limit access to data while it is being used and provide mechanisms for verifying aspects of the environment responsible for processing it. Rather than simply offering secure storage for documents, the company is aiming to protect the computation itself.

That ambition needs to be distinguished from current availability. Private Inference remains a preview technology, and its public presentation does not fully specify the supported models, deployment requirements, or access conditions. It would therefore be premature to suggest that all professional interactions with OpenAI models now benefit from this level of isolation. The promise is significant, but its practical value will depend on the technical guarantees actually available to customers. Detecting Dangerous Uses Without Exposing Conversations to OpenAI Staff

Monitoring presents another particularly interesting challenge. AI providers need to identify certain dangerous behaviors, including attempts to use their models for prohibited activities. Yet that monitoring can conflict with the requirements of companies that do not want their content retained or