Vendor record · openai.com

What OpenAI promises about your data.

Where OpenAI publishes its promises, how long it gives you when it adds a sub-processor, and what has changed.

Where it publishes: OpenAI lists its sub-processors at trust.openai.com/ and platform.openai.com/subprocessors. We last read it on October 15, 2026.
What has changed: We've recorded no change to its sub-processor list or data processing agreement between September 10, 2026 and September 15, 2026. Subscribers hear about a change the morning we read it; the public record shows it 30 days later.
Its window: When it adds a sub-processor, its clause at openai.com/policies/data-processing-addendum/ (read October 15, 2026) gives you 30 days to object.

Window: 30
Sub-processors: 23
Pages: 12
Copies: 148

OpenAI DPA

OpenAI's data processing agreement gives 30 days to object to a new sub-processor. Here is the clause, from our October 15, 2026 copy:

days to object

“Customer may object to the use of such additional Sub-processor within 30 days of receiving notice of the change by following the instructions set forth in the Sub-Processor List or by contacting [email address on the vendor's page].”

Found automatically and not yet checked by a person. The quote is exact, and the link goes to the source. Nothing here says whether the term is good or bad, only that OpenAI published it.

openai.com/policies/data-processing-addendum/ · read 2026-10-15 · fingerprint 4f04d6d3bcdedd15…

How it says it sends notice

“OpenAI will notify Customer of any changes to the Sub-Processor List via blog post, notification within the Services or other reasonable means, or via email if Customer subscribes to email notifications on the Sub-Processor List site.”

openai.com/policies/data-processing-addendum/ · read 2026-10-15

Notice windows across every vendor we watch

OpenAI sub-processors

OpenAI publishes a sub-processor list at trust.openai.com/; we last read it on October 15, 2026. We could not read named entries out of it. OpenAI publishes a sub-processor list at platform.openai.com/subprocessors; we last read it on October 12, 2026. It names 23 entries. The first 15, as the list prints them: Accenture International Limited; Amazon Web Services, Inc.; Cerebras; Cinder Technologies, Inc.; Cloudflare, Ltd.; Confluent; CoreWeave, Inc.; Fivetran, Inc.; Google Cloud Platform; Intercom, Inc.; Merge API, Inc.; Microsoft Corporation; Okta, Inc.; OpenAI, OpCo, LLC; OpenAI Ireland Ltd.; and 8 more in the full table below. The public record holds no change to the list read before September 15, 2026. A change we read after September 15, 2026 is published 30 days after we read it.

23 named · full table

Every public change we have recorded · Where vendors publish their lists

How long OpenAI keeps your data

Three statements on retention, quoted from its own pages. OpenAI's privacy policy (developers.openai.com/api/docs/guides/your-data, in the copy read October 13, 2026) says: “Audio outputs application state is stored for 1 hour to enable multi-turn conversations.”

Retention

“Once you choose to delete Personal Data, we will remove it from our systems within 30 days unless we need to retain it for longer as described below, or it has already been de-identified and disassociated from your account when you allow us to use your Content toimprove our models…”

openai.com/privacy · read 2026-10-13

Retention

“By default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days, unless longer retention is required by law, or is reasonably necessary to protect our services or any third party from harm.”

developers.openai.com/api/docs/guides/your-data · read 2026-10-13

Training on customer data

“Read our instructions on how you can opt out of our use of your Content to train our models.”

openai.com/privacy · read 2026-10-13

Training on customer data

“If you do not want us to use your Content to train our models, you can opt out by following the instructions in this article⁠.”

openai.com/terms · read 2026-10-07

Training on customer data

“As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us). ## Types of data stored with the OpenAI API When using the OpenAI API, data may be stored as: - Abuse monitoring logs: Logs generated from your use of the platform, necessary for OpenAI to enforce our Usage Policies…”

developers.openai.com/api/docs/guides/your-data · read 2026-10-13

Training on customer data

“For information about how we collect and use training information to develop our language models that power ChatGPT and other Services, and your choices with respect to that information, please see this policy as well as this help center article.”

openai.com/privacy · read 2026-10-13

Training on customer data

“You decide whether your data is used for training and model improvement.”

openai.com/security · read 2026-10-09

Retention windows vendors publish · What vendors say about training

Stated

What the pages say

Read automatically from the pages below and shown as printed. A missing row is a gap in our reading, not proof it isn’t there.

Sub-processors named · 23 · 5 name an AI provider we list

Accenture International Limited