LLM API OpenAI API
Headquarters: United States. Trust center or security page: openai.com. Checked 2026-10-29. API prices: price tracker.
Certifications and attestations
| Name | Scope | Source |
|---|---|---|
| SOC 2 Type 2 | This service | openai.com |
| ISO/IEC 27001:2022 | This service | openai.com |
| ISO/IEC 27017 | This service | openai.com |
| ISO/IEC 27018 | This service | openai.com |
| ISO/IEC 27701:2019 | This service | openai.com |
| ISO/IEC 42001:2023 | This service | openai.com |
| CSA STAR Level 1 | This service | openai.com |
Reports are usually available under NDA from the trust center. A company-wide certificate doesn't always cover every AI product; check the report's scope.
HIPAA: BAA / HIPAA eligible
“offers a Data Processing Addendum and Business Associate Agreement for customers”
Source: openai.com
Zero data retention: On request / approval
“Currently, these controls are subject to prior approval by OpenAI and acceptance of additional requirements.”
Source: platform.openai.com
Training on API data: Not used for training by default
“As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us).”
Source: platform.openai.com
Default retention: Abuse monitoring logs up to 30 days
“abuse monitoring logs are generated for all API feature usage and retained for up to 30 days”
Source: platform.openai.com
EU data residency: Yes
EU (EEA+CH) regional storage and processing via eu.api.openai.com; requires approval and ZDR/Modified Abuse Monitoring; +10% for models released on/after 2026-03-05.
Source: platform.openai.com
From the BranoLabs price tracker provider registry.
Data processing agreement: mentioned at openai.com.
Something changed or wrong? Use the bug link in the footer. Back to all providers.