OpenAI announced Zero Data Retention for its frontier models on 19 August 2026, promising eligible API customers that prompts and responses aren't retained once a request is processed, aren't reviewable by OpenAI staff, and aren't used for training unless a customer explicitly opts in. Alongside it, OpenAI previewed Private Safety Processing, a technique meant to let automated systems flag risk patterns across related conversations without exposing the underlying content to OpenAI personnel, with a technical white paper due in September.
Press coverage framed this explicitly as a contrast with Anthropic. Axios ran it as "OpenAI previews zero-retention safety system as Anthropic requires data logs." That's a direct, named claim, and it's worth Australian businesses understanding what it actually means rather than taking either side's framing at face value.
What zero retention does and doesn't cover
The headline promise is real but narrower than it sounds. OpenAI's own announcement carves out an exception: content flagged for potential child sexual abuse material is retained for manual review and legal reporting regardless of a zero-retention agreement.
That's not a criticism. It's a legal requirement every serious AI vendor operates under, and any vendor claiming otherwise would be making a promise it couldn't keep. But it's a useful reminder that zero retention is a contractual and technical commitment with defined exceptions, not an absolute state.
The trade-off nobody puts in the headline
The more relevant tension for a business evaluating either vendor is retention versus auditability.
A system that retains nothing is harder to misuse after the fact. It's also harder to audit after the fact. If you need to reconstruct what an agent did and why, whether for a compliance review, an incident investigation, or a client dispute, a zero-retention deployment can leave you with less to work with rather than more.
Anthropic's approach, which in some deployments involves data logging, trades some retention-side privacy for auditability. That's a trade Australian businesses in regulated industries often need on the other side of the ledger. An APRA-regulated firm that can't reconstruct how an automated decision was reached has a problem that no amount of vendor-side privacy solves.
Neither position is straightforwardly better. They're different defaults, suited to different risk profiles, and the right question isn't which vendor is more private. It's which failure would hurt your business more: data existing that shouldn't, or data not existing when a regulator asks for it.
What to actually check
Before taking either vendor's data-handling promise at face value, there are three things worth establishing regardless of which model you're using:
What the contract actually commits to, as distinct from what the announcement blog post says. Marketing language and contractual language routinely differ, and only one of them is enforceable.
What audit trail exists if something goes wrong, and whether you can produce it yourself without depending on the vendor's cooperation and timeline.
What happens at the edges: legal holds, safety flags, subpoenas, and law-enforcement requests, where a broad statement about not retaining data quietly stops applying.
A fourth one matters specifically in Australia: where the processing physically happens, and what that means for your obligations under the Privacy Act and any sector-specific rules you operate under. Data residency and data retention are separate questions, and a strong answer on one tells you nothing about the other.
Why this diligence is cheap relative to the alternative
The uncomfortable version of this problem shows up when a client, an auditor, or a regulator asks a question you assumed the vendor had answered. At that point you're reading contract clauses under time pressure, and the gap between what you believed and what you signed becomes a live issue rather than a theoretical one.
Doing it upfront is a comparatively small piece of work. A vendor data-handling and governance review for a business scoping an AI deployment in a regulated Australian industry typically runs A$3,000 to A$6,000, and it produces something durable: a written record of what your vendor has actually committed to, what your own audit position is, and where the exceptions sit.
That document is worth more than the review itself. It's what you hand to a client's procurement team when they ask, and it's what stops the same question being re-answered from scratch every time someone new asks it.
Apply the same standard to everyone
It's worth being clear that this scrutiny should apply to whichever vendor you choose, including the one you're inclined to favour. A named contrast in press coverage is a marketing moment for both parties, and neither vendor's framing of the other is a substitute for reading the terms.
The practical position for most Australian businesses is straightforward. Pick the vendor whose default trade-off matches your regulatory reality, then verify the specifics in the contract rather than the announcement. Both of those steps are necessary, and the second one is the one people skip.
If you're weighing AI vendors for a business that has to answer to a regulator or a client's procurement team, the contract detail is where this gets decided. Book a session and we'll work through what your deployment actually needs to commit to.
