AI Vendor Directory · Foundation model APIs
Does OpenAI API train on your data?
No — does not train on your data by default. Vendor-stated default: no (API Platform, all business/API usage). Per OpenAI's API data guide: 'data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us).' Most endpoints keep abuse-monitoring logs ~30 days by default; stateful endpoints (Conversations, Assistants) store content until deleted. Eligible customers can request Zero Data Retention / modified abuse monitoring (with ZDR, the 'store' parameter is forced false). Consumer ChatGPT Free/Plus/Pro differ: the 'improve the model for everyone' setting defaults to on there.
By the Shieldra Compliance Team · Last updated 2026-07-29
What is OpenAI API (API Platform)?
OpenAI's developer platform for GPT and o-series models. SMBs use it to embed chat, extraction, summarization, and agent features in their own products and internal tools.
Key facts
- Vendor: OpenAI — https://platform.openai.com
- Trains on customer data by default: no (API Platform, all business/API usage)
- Source for the training answer: https://developers.openai.com/api/docs/guides/your-data
- Data residency: US; EU (EEA+CH); UK; CA; JP; IN; SG; KR; AU; AE
- Last verified: 2026-07-29
What certifications does OpenAI API hold?
- SOC 2 Type 2
- ISO/IEC 27001:2022
- ISO/IEC 27017
- ISO/IEC 27018
- ISO/IEC 27701:2019
- ISO/IEC 42001:2023
- CSA STAR
Security, DPA, and subprocessor links
- Security / trust page: https://trust.openai.com/
- Data processing agreement (DPA): https://openai.com/policies/data-processing-addendum/
- Subprocessor list: https://openai.com/policies/sub-processor-list/
What is your EU AI Act role when you build on OpenAI API?
Building your own feature on the API typically makes you the provider of that downstream AI system under the EU AI Act; Article 50 transparency duties (disclosing AI interaction, marking synthetic content) fall on you, not OpenAI, which holds the GPAI model-provider obligations.
What to record in your AI registry
- Provider: OpenAI
- Model type: third party api
- Data typically flowing to the vendor: prompts, completions, uploaded files, embeddings, fine-tuning data
Sources
- https://developers.openai.com/api/docs/guides/your-data
- https://openai.com/enterprise-privacy/
- https://openai.com/security-and-privacy/
- https://trust.openai.com/
- https://openai.com/policies/data-processing-addendum/
- https://openai.com/policies/sub-processor-list/
Disclaimer
Curated from vendor-published pages on the date above. Vendor terms change - verify against the cited sources before relying on a profile for a procurement decision. Last verified 2026-07-29.
Frequently asked questions
Does OpenAI API train AI models on your data?
No — does not train on your data by default. Vendor-stated default: no (API Platform, all business/API usage). Per OpenAI's API data guide: 'data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us).' Most endpoints keep abuse-monitoring logs ~30 days by default; stateful endpoints (Conversations, Assistants) store content until deleted. Eligible customers can request Zero Data Retention / modified abuse monitoring (with ZDR, the 'store' parameter is forced false). Consumer ChatGPT Free/Plus/Pro differ: the 'improve the model for everyone' setting defaults to on there.
What certifications does OpenAI API hold?
Per the vendor's published pages as of 2026-07-29: SOC 2 Type 2; ISO/IEC 27001:2022; ISO/IEC 27017; ISO/IEC 27018; ISO/IEC 27701:2019; ISO/IEC 42001:2023; CSA STAR.
Where does OpenAI API store your data?
Vendor-listed data residency options as of 2026-07-29: US; EU (EEA+CH); UK; CA; JP; IN; SG; KR; AU; AE.
What is your EU AI Act role when you build on OpenAI API?
Building your own feature on the API typically makes you the provider of that downstream AI system under the EU AI Act; Article 50 transparency duties (disclosing AI interaction, marking synthetic content) fall on you, not OpenAI, which holds the GPAI model-provider obligations.
