// Trust & Security Report
DALL-E 3
by OpenAI, Inc.
DALL-E 3 is OpenAI's state-of-the-art image generation model. Available via API, ChatGPT Plus, ChatGPT Enterprise, and ChatGPT Edu. Part of OpenAI's broader AI platform alongside GPT models and other services.
Certifications held
10
Maturity
Enterprise
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on trust.openai.com“Request access to our SOC 2 Report below to learn more about our security controls and compliance activities.”
Verify on trust.openai.com“OpenAI's ISO/IEC 27001 Certificate is now available at trust.”
Verify on trust.openai.com“Our products are also ISO 27001, 27017, 27018, and 27701 certified.”
Verify on trust.openai.com“Our products are also ISO 27001, 27017, 27018, and 27701 certified.”
Verify on openai.com“OpenAI maintains ISO/IEC 27001:2022 and ISO/IEC 27701:2019 certifications for the information security and privacy management systems supporting the OpenAI API, ChatGPT Enterprise, and ChatGPT Edu services.”
Verify on openai.com“ystems supporting the OpenAI API, ChatGPT Enterprise, and ChatGPT Edu services. ISO 42001 OpenAI maintains an ISO/IEC 42001:2023 AI Management System covering OpenAI’s consumer and business AI products and mod”
Verify on openai.com“OpenAI supports our customers’ compliance with privacy laws, including the GDPR, CCPA, HIPAA, and FERPA, and offers a Data Processing Addendum and Business Associate Agreement for customers.”
Verify on openai.com“OpenAI supports our customers’ compliance with privacy laws, including the GDPR, CCPA, HIPAA, and FERPA, and offers a Data Processing Addendum and Business Associate Agreement for customers.”
Verify on trust.openai.com“Party Dependence Yes Hosting Major Cloud Provider Reports Data Flow Diagram SOC 3 Report Network Diagram View more Access Control Access Log Management Bring Your Own Device (BYOD) Data Access View”
Verify on openai.com“liance for the components of ChatGPT that support delegated payment processing. CSA Star Level 1 ChatGPT business product services and the API Platform have been evaluated by the Cloud Security Alliance Secur”
> Show 2 unconfirmed / not-held certifications
source: openai.comThe vendor's pages state this for a different product or company, not for this product.
source: openai.comThe vendor's pages state this for a different product or company, not for this product.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
Multiple: EU (EEA + Switzerland), UK, US, Canada, Japan, South Korea, Singapore, India, Australia, UAE. Data residency available for eligible API customers and ChatGPT Enterprise/Edu customers.
By default, OpenAI does NOT use content submitted by API, ChatGPT Business, or ChatGPT Enterprise customers to improve model performance unless customers have explicitly opted in to share their data. For consumer services (ChatGPT Plus, free tier), OpenAI may use conversations to improve models unless users opt out. Artists can opt-out of having their publicly available work used in DALL-E 3 training via an online form.
// Security controls
Encryption in Transit
Yes - HTTPS/TLS encryption required for all API communication
developers.openai.comAccess Controls
Role-based access control (RBAC), API key management, organization-level controls
openai.comZero Data Retention
NOT available for DALL-E 3. Zero Data Retention compatible only with gpt-image-1, gpt-image-1.5, and gpt-image-1-mini models. For DALL-E 3, inputs/outputs may be retained for abuse monitoring and service improvement.
developers.openai.comAudit Logging
Yes - Audit logs available for enterprise customers; abuse monitoring logs with opt-out options
openai.comData Minimization
OpenAI shares the minimum amount of content needed with trusted service providers; service providers are subject to strict confidentiality and security obligations
openai.comCustomer-Managed Encryption Keys (CMEK)
Available for enterprise customers as part of data security controls
openai.com// Products & data scope
Data it handles: API customers can opt for data residency in multiple regions (EU, UK, US, Canada, Asia-Pacific). NOT zero-data-retention compatible. By default, customer data is not used for training unless opted in.
Supports GDPR DPA and HIPAA BAA (for eligible customers). FedRAMP compliance available. Data retention for abuse monitoring and service improvement applies by default.
Data it handles: Consumer service. OpenAI may use conversations to improve models unless user opts out. Not covered under enterprise certifications.
Consumer-grade privacy controls. Different data handling from API/business products.
Data it handles: Customer data is NOT used for training by default. Data residency available (EU, UK, US, etc.). Enterprise-grade controls available.
Covered under SOC 2 Type 2, ISO certifications, and FedRAMP. Eligible for HIPAA BAA and GDPR DPA.
Data it handles: Designed for educational institutions. Customer data NOT used for training by default.
Covered under enterprise certifications. Eligible for GDPR DPA and HIPAA BAA for healthcare education.
// What to watch
- DALL-E 3 is NOT zero-data-retention compatible, unlike some other OpenAI image models. Prompts and images may be retained for abuse monitoring and service improvement by default, even for business customers.
- HIPAA BAA eligibility requires prior approval from OpenAI and is not automatically available to all customers. Certain use cases may not pass OpenAI's evaluation.
- Data residency and inference residency require customers to be approved for abuse monitoring controls and execute a Zero Data Retention amendment for non-US regions.
- Consumer vs. Enterprise tier distinction is critical: free/Plus tier ChatGPT conversations may be used for training unless opted out; Enterprise/Edu/API customers have no default training use.
- FedRAMP certification applies to ChatGPT Enterprise and API via the FedRAMP 20x program (Moderate level); not all government use cases may qualify.
// At a glance
Pricing model
Pay-as-you-go API pricing per image generation; subscription tiers for ChatGPT Plus, Pro, Enterprise, Edu
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on OpenAI, Inc.'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
trust.openai.com// Trust reports for comparable tools
Other tools in the same category, each with its own sourced report.