---
title: "OpenAI API (OpenAI, OpCo, LLC)"
url: "https://ailawframework.com/software/openai-api"
type: "software_profile"
site: "AI Law Framework"
id: "openai-api"
vendor: "OpenAI, OpCo, LLC"
category: "General-purpose"
segment: "General-purpose assistants"
confidence: "high"
last_reviewed: "2026-10-10"
---

# OpenAI API (OpenAI, OpCo, LLC)

> Developer platform. No training by default. Default abuse-monitoring logs retain prompts/responses up to 30 days unless ZDR or Modified Abuse Monitoring is approved. Australia supports storage, not regional processing.

Canonical page: https://ailawframework.com/software/openai-api  
Last reviewed: 2026-10-10

Site index for agents: https://ailawframework.com/llms.txt

Plan covered: Direct API organisation, project, model snapshot and endpoints, including ZDR/MAM and regional storage. Astra for Law (gpt-6-astra-law) was announced as coming soon to the API.

## Capabilities

- Document summarisation
- Contract drafting
- Knowledge search
- Agentic workflows
- Legal research

## Key facts

| Fact | Value |
| --- | --- |
| Deployment | SaaS |
| Hosting regions | Australia, United States, European Union / EEA |
| Australian region | Australian region available |
| Model providers | OpenAI |
| Assurance | SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018, ISO 27701, CSA STAR |
| Training on customer content | No |
| Retention | By default, abuse-monitoring logs retain customer content up to 30 days (longer if required by law or to protect the service). ZDR excludes content from those logs and forces store=false on chat/responses. Assistants, files, vector stores, batches, fine-tuning and several tools still store application state until deleted even with ZDR. Australia: storage yes, processing no; requires MAM or ZDR. |
| Integrations | chat completions, responses, assistants, vector stores, files, fine-tuning, MCP tools, web search tool |
| Legal content coverage | Astra for Law's US legal search index (230 million+ URLs; Free Law Project / CourtListener) is described for the ChatGPT Trusted Access offering. API name gpt-6-astra-law is announced as coming soon. Australian primary law is not described. |
| Pricing | Token/usage pricing on the API pricing page (not extracted line-by-line in this pass). ZDR/MAM and regional endpoints are configuration, not a separate public SKU. |
| Australian presence | Unknown. Regional table: Australia au.api.openai.com supports storage, not regional processing. Requires MAM or ZDR. Inference for AU-stored projects may occur outside Australia. Checked 2026-10-10. Vendor page: “Eligible ChatGPT Enterprise, ChatGPT Edu, ChatGPT for Healthcare, and API platform customers can store sensitive customer content at rest in the U.S., Europe, UK, Japan, Canada, South Korea, Singapore, Australia, India, and the UAE to help support compliance with local data sovereignty requirements.” (https://openai.com/business-data/). Recorded as Australian region available. |
| Website | https://openai.com/api/ |

## What the research found

| Topic | Status | Finding | Open question | Sources |
| --- | --- | --- | --- | --- |
| API org and projects | Public claim only | This profile is the API platform, not ChatGPT Business/Enterprise/Edu/consumer. Controls are organisation- and project-level (ZDR, MAM, or None). Astra for Law will appear in the API as gpt-6-astra-law; at 17 September 2026 it was initially offered via Trusted Access in ChatGPT and Codex, coming soon to the API. Harvey and Legora are named as API customers who will be able to build on it. | Which org/project, model snapshots and endpoints are in production, and is gpt-6-astra-law actually provisioned? | [OpenAI developers — Data controls / your data](https://developers.openai.com/api/docs/guides/your-data); [Introducing Astra for Law (17 September 2026)](https://openai.com/index/astra-for-law/) |
| AU storage, not processing | Public claim only | Regional table: Australia (au.api.openai.com) Storage Yes, Processing No, requires MAM or ZDR. If the selected region does not support regional processing, OpenAI may process and temporarily store Customer Content outside the region. US and EU prefixed domains use Cloudflare Regional Services for TLS termination in-region. Checked 2026-10-10. Vendor page: “Eligible ChatGPT Enterprise, ChatGPT Edu, ChatGPT for Healthcare, and API platform customers can store sensitive customer content at rest in the U.S., Europe, UK, Japan, Canada, South Korea, Singapore, Australia, India, and the UAE to help support compliance with local data sovereignty requirements.” (https://openai.com/business-data/). Recorded as Australian region available. | Is our project set to Australia storage with MAM or ZDR, and do we accept out-of-region inference? | [OpenAI developers — Data controls / your data](https://developers.openai.com/api/docs/guides/your-data); [OpenAI — Business data privacy, security, and compliance](https://openai.com/business-data/) |
| Endpoints | Public claim only | Chat/completions and responses are ZDR-eligible with limits. Assistants, threads, vector stores, files, fine-tuning, batches, evals, agents, videos are not ZDR-eligible and keep application state until deleted (assistants objects 30 days after API deletion, otherwise indefinitely). Web search and remote MCP tools are listed for AU storage. | Which endpoints and tools are enabled, especially files, vector stores and web search? | [OpenAI developers — Data controls / your data](https://developers.openai.com/api/docs/guides/your-data) |
| Australia | Public claim only | AU storage is documented. AU processing is not. Astra for Law's corpus is US case law/statutes. Trusted Access is described for eligible law firms (US-centric announcement). | Is Astra for Law licensed for an Australian API org, and does the index include any Australian authorities? | [OpenAI developers — Data controls / your data](https://developers.openai.com/api/docs/guides/your-data); [Introducing Astra for Law (17 September 2026)](https://openai.com/index/astra-for-law/) |
| Pricing | Not confirmed | Public usage pricing exists; line items were not extracted here. ZDR/MAM require prior approval and additional requirements. | Rate card, ZDR eligibility, and any Astra for Law surcharge. | [OpenAI API product page](https://openai.com/api/) |
| Keys and apps | Not confirmed | The application operator controls key storage, logging, RAG stores and third-party tools. Admin and Audit Logs APIs are advertised on the business-data page for the API platform. | Where are API keys stored, and which of our apps call which endpoints? | [OpenAI — Business data privacy, security, and compliance](https://openai.com/business-data/) |
| Support | Not confirmed | Platform status and help exist. No public Sev-1 SLA extracted. | Support tier for production legal workloads? | [OpenAI API product page](https://openai.com/api/) |
| Astra bench | Public claim only | OpenAI reports Astra for Law at 54.0% all-pass on 200 US Vals AI Legal Research Bench questions vs 38.7% for GPT-6 Astra with web search. Vendor-reported, US-only. API model was not generally available at announcement. | May we re-run an Australian gold-set if/when gpt-6-astra-law is enabled? | [Introducing Astra for Law (17 September 2026)](https://openai.com/index/astra-for-law/) |
| Task fit | Not confirmed | Fit depends on the wrapping application. Raw API is not a lawyer UI. Astra for Law is configured for US legal research; still requires review of answers and sources. Application state on non-ZDR endpoints can retain client text indefinitely until deleted. | Which tasks hit ZDR-eligible endpoints only? | [OpenAI developers — Data controls / your data](https://developers.openai.com/api/docs/guides/your-data); [Introducing Astra for Law (17 September 2026)](https://openai.com/index/astra-for-law/) |
| Client data | Not confirmed | Trusted Access: eligible lawyers and people working under their supervision; ZDR on the API for eligible firms; ChatGPT Enterprise usage excluded from human review by default (that last point is ChatGPT, not the API default). The wrapping app may still store prompts. | Is our use under Trusted Access, and what does the wrapping app retain? | [Introducing Astra for Law (17 September 2026)](https://openai.com/index/astra-for-law/) |
| OpenAI models | Public claim only | OpenAI is the model provider. Astra for Law = GPT-6 Astra plus legal search index and instructions; API id gpt-6-astra-law (coming soon). Hosting subprocessors are not substitute model vendors. | Pin model snapshots in production and whether any request is routed elsewhere. | [Introducing Astra for Law (17 September 2026)](https://openai.com/index/astra-for-law/); [OpenAI sub-processor list](https://openai.com/policies/sub-processor-list/) |
| Subprocessors | Public claim only | Published list at openai.com/policies/sub-processor-list/. Regional processing uses Cloudflare Regional Services on us/eu prefixed domains. Microsoft, AWS, GCP, Oracle, CoreWeave, Cerebras appear as infrastructure. | Which subprocessors apply to our region and endpoints, with notice rights? | [OpenAI sub-processor list](https://openai.com/policies/sub-processor-list/); [OpenAI developers — Data controls / your data](https://developers.openai.com/api/docs/guides/your-data) |
| No training unless opt-in | Public claim only | Services Agreement 4.2: OpenAI will not use Customer Content to develop or improve the Services unless Customer explicitly agrees. Endpoint table: Data used for training = No across listed endpoints. API dashboard opt-in (feedback/evals) is the exception. Fine-tuned models are not shared with other customers (Enterprise sibling; confirm for our org). | Confirm the org has no data-share opt-in and that fine-tunes stay private. | [OpenAI Services Agreement](https://openai.com/policies/services-agreement/); [OpenAI developers — Data controls / your data](https://developers.openai.com/api/docs/guides/your-data); [OpenAI — Business data privacy, security, and compliance](https://openai.com/business-data/) |
| Playground opt-in | Public claim only | API customers can opt in by providing feedback in the Playground or evals. Default is opted out. | Is playground/eval sharing off for production keys? | [OpenAI — Business data privacy, security, and compliance](https://openai.com/business-data/) |
| 30-day logs vs ZDR | Public claim only | Default abuse-monitoring logs up to 30 days. ZDR or MAM (prior approval) exclude customer content from those logs, with image/file exceptions. ZDR forces store=false. Responses API otherwise stores ~30 days when store=true. Assistants/files/vector stores retain until deleted (assistants 30 days after delete, else indefinitely). Videos blocked for MAM/ZDR. | Is the production project ZDR, MAM or default 30-day, and which stateful endpoints are used? | [OpenAI developers — Data controls / your data](https://developers.openai.com/api/docs/guides/your-data) |
| Deletion | Public claim only | Customer must delete application-state objects via API/dashboard. Assistants-related objects: 30 days after delete. DPA deletion/return applies to the signed copy. No public deletion certificate. | Who deletes files/vector stores/fine-tunes on matter close, and within what SLA? | [OpenAI developers — Data controls / your data](https://developers.openai.com/api/docs/guides/your-data) |
| Human review | Public claim only | Default abuse monitoring may involve review of flagged content. ZDR/MAM: OpenAI may still retain and human-review content on models made ineligible for severe-risk investigation, with written notice. Astra Trusted Access: ChatGPT Enterprise usage excluded from human review by default — that is not the unmodified API default. | Is Eyes Off / Safety Retention / Trusted Access provisioned for our org ID? | [OpenAI developers — Data controls / your data](https://developers.openai.com/api/docs/guides/your-data); [Introducing Astra for Law (17 September 2026)](https://openai.com/index/astra-for-law/) |
| Org and project | Public claim only | Organisation- and project-level retention controls. Admin API and Audit Logs API advertised. Key hygiene is the customer's job. | Show project isolation, key rotation and that production is ZDR. | [OpenAI developers — Data controls / your data](https://developers.openai.com/api/docs/guides/your-data); [OpenAI — Business data privacy, security, and compliance](https://openai.com/business-data/) |
| Encryption | Public claim only | Business-data / Edu pages state AES-256 at rest and TLS 1.2+. Confirm for API in the DPA/trust reports. | Encryption and CMK for regional storage projects? | [OpenAI — Business data privacy, security, and compliance](https://openai.com/business-data/) |
| Assurance | Public claim only | CSA STAR, SOC 2 Type 2, ISO 27001/27017/27018/27701 on the business-data page covering the API platform. Reports not inspected. | Current reports scoped to the API, including ZDR. | [OpenAI — Business data privacy, security, and compliance](https://openai.com/business-data/) |
| Services Agreement | Public claim only | Services Agreement 4.2 no-training unless explicit agreement; 4.3 customer evaluates Output. DPA at openai.com/policies/data-processing-addendum/. ZDR/MAM require additional approved terms. Astra Trusted Access is a separate eligibility programme. | Signed SA, DPA, ZDR addendum and Trusted Access terms, with liability and law/forum. | [OpenAI Services Agreement](https://openai.com/policies/services-agreement/); [OpenAI developers — Data controls / your data](https://developers.openai.com/api/docs/guides/your-data); [Introducing Astra for Law (17 September 2026)](https://openai.com/index/astra-for-law/) |
| AU store / process elsewhere | Public claim only | Australia: storage yes, processing no. Content may be processed and temporarily stored outside AU to deliver the service. us/eu prefixed domains keep TLS termination in-region via Cloudflare. | APP 8 assessment of AU storage with non-AU inference. | [OpenAI developers — Data controls / your data](https://developers.openai.com/api/docs/guides/your-data) |
| Incidents | Public claim only | DPA exists (sibling Enterprise scrape: without undue delay). Confirm the executed API DPA clock. | Numbered notice period and NDB cooperation? | [OpenAI Services Agreement](https://openai.com/policies/services-agreement/) |
| Changes | Public claim only | OpenAI may make models ineligible for ZDR/MAM with prior written notice. Regional support tables change. New endpoints may store state even under org-level ZDR. | How are we notified of ZDR-eligibility or regional-table changes? | [OpenAI developers — Data controls / your data](https://developers.openai.com/api/docs/guides/your-data) |
| Exit | Not confirmed | Customer-controlled deletion of files, vector stores, fine-tunes and assistants. Application copies in our systems are separate. DPA return/deletion on the signed copy. | Runbook to revoke keys, delete stateful objects and certify provider deletion. | [OpenAI developers — Data controls / your data](https://developers.openai.com/api/docs/guides/your-data) |
| Tools | Public claim only | Responses File Search, Web Search, Code Interpreter, Remote MCP server tool are listed even for AU storage. Third-party tools follow their own terms and may retain state. ZDR does not make those endpoints ZDR-eligible. | Which tools are enabled, and is web search/MCP off for privileged matters? | [OpenAI developers — Data controls / your data](https://developers.openai.com/api/docs/guides/your-data) |
| Web search tool | Public claim only | AU regional table lists /v1/responses Web Search as a storage-supported service. Astra for Law uses a legal search index plus (in the bench) comparison against web search. Tool output leaves the closed prompt. | Is the web-search tool disabled on production projects? | [OpenAI developers — Data controls / your data](https://developers.openai.com/api/docs/guides/your-data); [Introducing Astra for Law (17 September 2026)](https://openai.com/index/astra-for-law/) |
| Agents and MCP | Not confirmed | /v1/agents is not ZDR-eligible and stores state until deleted. Remote MCP is listed. The wrapping application decides whether tools can write to DMS or email. | Which agent/MCP tools can take external actions, and with whose approval? | [OpenAI developers — Data controls / your data](https://developers.openai.com/api/docs/guides/your-data) |
| Oversight | Public claim only | SA 4.3: customer is solely responsible for evaluating Output. Astra help (ChatGPT) still requires review of answers and cited sources. No API-enforced lawyer gate. | What evaluation and logging does our application enforce before a lawyer relies on output? | [OpenAI Services Agreement](https://openai.com/policies/services-agreement/); [Introducing Astra for Law (17 September 2026)](https://openai.com/index/astra-for-law/) |

## Notes

Default 30-day abuse logs unless approved ZDR/MAM. AU storage without AU processing. Astra for Law API (gpt-6-astra-law) announced coming soon; not generally available at 17 Sep 2026. Stateful endpoints (files, vector stores, assistants) are not ZDR-eligible. Sibling: chatgpt-enterprise.

## Sources

- [OpenAI developers — Data controls / your data](https://developers.openai.com/api/docs/guides/your-data) (checked 2026-09-21)
- [OpenAI Services Agreement](https://openai.com/policies/services-agreement/) (checked 2026-09-21)
- [Introducing Astra for Law (17 September 2026)](https://openai.com/index/astra-for-law/) (checked 2026-09-21)
- [OpenAI — Business data privacy, security, and compliance](https://openai.com/business-data/) (checked 2026-09-21)
- [OpenAI sub-processor list](https://openai.com/policies/sub-processor-list/) (checked 2026-09-21)
- [OpenAI API product page](https://openai.com/api/) (checked 2026-09-21)

A product profile is research to support questions. It does not approve a product for any firm. Public product information supports questions; it does not approve a product for your firm. Verify the exact plan, settings and signed terms.