OpenAI Enterprise privacy page (retention, training defaults, access to stored API data, compliance attestations)

Vendor statement, cited as a claim not a measurement. Business data (API platform, post-1 March 2023) is not used for training by default unless explicitly opted in. Deleted conversations are removed from systems within 30 days unless legally required to be retained. Access to stored API business data is limited to authorised employees (engineering support, abuse investigation, legal compliance) and confidentiality-bound third-party contractors reviewing for abuse. SOC 2 audit completed; AES-256 at rest; TLS 1.2+ in transit. Page states it was updated 8 January 2026.