OpenAI launches Private Intelligence for enterprises: Zero Data Retention, Private Inference preview and agent approval controls

Background and pain points

When companies hand contracts, code and customer data to models and agents, the main worry is who can see that content and how long it is kept. As agents such as Codex read and write systems and call tools, the question grows from whether data trains models to what agents are allowed to do. OpenAI said on X that privacy should advance as fast as intelligence and that it built these protections with some of its largest customers.

Architecture highlights

According to the official page, Private Intelligence has four parts. Access restrictions strictly limit OpenAI's access to business content and provide Zero Data Retention (ZDR) and Private Inference for eligible workflows. Data ownership means customers own their inputs and outputs. Agent action controls let businesses decide in advance which data agents can access, which tools they can use, which actions they can take and when they need approval. Data security covers encryption in transit, access controls and ongoing threat detection. Private Inference is an API preview that OpenAI describes as confidential computing with strict, verifiable controls. VentureBeat separately reports that under ZDR, safety review records are stored encrypted in the customer's own cloud storage for 30 days.

Benchmarks

This is a privacy and security offering, not a model, and OpenAI has not published performance overhead or pricing. For compliance, OpenAI lists SOC 2 Type 2 audits, ISO certifications, HIPAA support through Business Associate Agreements, and FedRAMP support for designated government offerings.

Getting started

Enterprise teams can configure app connections, supported actions, automation permissions and role-based access in ChatGPT Work. API users should check whether ZDR covers the endpoints they use and contact OpenAI sales about the Private Inference preview. Before deploying agents, write data scope, tool lists and approval steps into policy first, then widen permissions gradually.