OpenAI's Private Intelligence adds a Private Inference API preview

OpenAI has quietly moved Private Inference from a DevDay promise to a live listing on its own Private Intelligence page, which now offers an API preview that processes prompts inside confidential-computing runtimes. The same page confirms Zero Data Retention for eligible API workflows. A closed lab adopting the hardware-attestation architecture that decentralized inference networks stake their pitch on changes the calculus for anyone deciding where sensitive workloads should run.

Key facts

• OpenAI's Private Intelligence page lists "Private Inference (preview)" as combining "confidential computing with strict controls designed to protect your prompts and responses while the model processes them."
• Zero Data Retention is "available for eligible API workflows," where OpenAI says it does not retain prompts or model responses after processing.
• VentureBeat's DevDay 2026 coverage reported Private Inference "coming this fall"; the page now carries an "API Preview" tag on the Private Inference step of its architecture diagram.
• Under Private Safety Processing, content selected for safety review goes to customer-controlled storage with a 30-day time-to-live, decrypted only inside a "hardware-attested safety runtime" per OpenAI's documentation.
• The page names SOC 2 Type 2, ISO certifications, HIPAA support through BAAs, and FedRAMP support among its compliance claims.
• Chutes, a decentralized network, publishes a TEE catalog showing 10 of 17 models flagged confidential_compute on Intel TDX confidential VMs and NVIDIA CC-mode H100s — a checkable counterpoint to OpenAI's provider-described controls.

What happened

OpenAI's Private Intelligence bundle now has two legs listed on its own site. The first, Zero Data Retention, is described as available for eligible API workflows: OpenAI says it does not retain prompts or model responses after processing. The second, Private Inference, is now tagged as an API preview on the page's architecture diagram, described as "confidential computing, strict verifiable controls" applied while a prompt is processed.

When VentureBeat reported the bundle from DevDay 2026 on September 29, Private Inference was presented as "coming this fall," while ZDR with Private Safety Processing was available immediately. The page's current state — an "API Preview" tag on the Private Inference node — is the first on-domain evidence that the confidential-computing leg has entered customer hands. OpenAI has not, as of October 31, published a separate help-center or API-docs page detailing the preview's coverage, and this article describes the capability as OpenAI presents it.

The ZDR leg comes with an asterisk that matters. OpenAI's Private Safety Processing documentation describes a pipeline in which content flagged by a safety classifier, or drawn by approved sampling, is encrypted into storage the customer controls (an S3 bucket, Azure Blob container, or Google Cloud Storage) with a 30-day time-to-live. OpenAI says it keeps only an index of operational metadata, that the encrypted records can be decrypted solely inside a hardware-attested safety runtime, and that OpenAI personnel cannot view the underlying content. That is "zero retention" in the sense of control, not in the sense of zero copies existing anywhere: the customer hosts the encrypted copy for 30 days so automated safety review can run.

The page also leans on compliance framing: SOC 2 Type 2 audits, ISO certifications, HIPAA support via Business Associate Agreements for eligible services, and FedRAMP support for designated government offerings. Those are certifications OpenAI holds or supports, per the page — they are not independent verification of the Private Inference preview's specific guarantees. The same neutrality standard DeAI applies to every provider's attestation claims applies here: OpenAI's control descriptions are claims until the attestation documentation itself is public and checkable.

Why it matters

Confidential computing was, until recently, the differentiated pitch of exactly the networks this publication covers. NEAR AI's cloud pairs TEEs with private inference, Cohere's Model Vault runs deployment-isolated models on attested hardware, and Chutes' checkable TEE catalog lets anyone confirm which models report confidential_compute before routing traffic. When the largest closed API vendor adds the same architectural layer (hardware-attested processing, verifiable controls), two things shift at once.

For enterprise buyers who would never evaluate a decentralized network, TEE-backed inference is now available from the default vendor, which lowers the barrier to requiring attestation everywhere. For decentralized providers, "we're the only ones who can technically prove the operator can't read your prompts" stops being a unique selling point and becomes table stakes. Neither shift makes any provider faster, cheaper, or more private than another on our data; the latency and price cost of enclave execution on OpenAI's preview is not yet published, and that number is what will decide real workloads.

There is also a verification asymmetry worth naming. OpenAI's page promises "verifiable controls," but the artifact a customer could actually check, a remote-attestation quote measured against expected values, is not yet published for this preview. On Chutes, an attestation report is a documented, checkable artifact before execution. That is not a ranking; it is a reminder that "verifiable" is a spec, not an adjective. Builders evaluating any provider's confidential-inference claims should ask for the attestation evidence, not the marketing line.

Background

TEE-backed inference has been building across the industry for two years, and DeAI has tracked the arc from explainer to incident file. Our confidential AI inference primer covers what remote attestation does and does not prove: it binds a workload to measured code and configuration, but whoever controls the root of trust and the host still sits outside the enclave — the same open question OpenAI's preview now carries, with OpenAI itself as the host.

OpenAI previewed Private Safety Processing in August, framing it as a way to run automated safety review over ZDR traffic without granting personnel access to customer content. VentureBeat's DevDay reporting placed the bundle in a market where Palantir, Nvidia, and Booz Allen Hamilton were restricting model use over data-exposure concerns, per The Information — the demand signal behind the whole initiative. Policy-level retention promises remain fragile in parallel: Anthropic's 30-day retention requirement landed in June and is being walked back after customer pushback, and our zero-data-retention explainer documents how differently "retention" is defined across vendors.

What's next

The preview's missing documents are the watch list: which models and regions Private Inference covers, what the attestation report looks like and whether customers can check it independently, what latency and price the enclave adds, and when — or whether — the preview's terms reach the API docs. If OpenAI publishes checkable attestation evidence, confidential computing becomes an enterprise-table-stakes requirement across the industry, and every provider's "verifiable controls" claim gets held to the same standard. If it does not, the preview remains a policy promise wrapped in hardware language — and the decentralized networks' checkable attestations keep the verification high ground by default.