What is the difference between Anthropic EFS and OpenAI Private Safety Processing?

Both detect misuse patterns across multiple interactions without giving vendor staff access to customer content. Anthropic's Enterprise Frontier Safeguards (September 1, 2026) stores monitoring data only in the customer's own S3, Azure Blob or GCS account under customer keys, and routes every flag to the customer's security team. OpenAI's Private Safety Processing (previewed August 19, 2026) keeps content on customer infrastructure for ZDR deployments or, optionally, on OpenAI storage encrypted with customer-held keys, and returns a narrow safety signal to OpenAI that can trigger enforcement.

Which is better for a bank or regulated company, EFS or Private Safety Processing?

As of September 2026 EFS is the more fully specified option for regulated buyers: it was co-designed with the CISOs of the largest US banks, explicitly guarantees no Anthropic human review, and ships with equivalent controls on Bedrock, Google Cloud and Microsoft Foundry. Private Safety Processing is still in early-customer testing with a technical white paper promised for September, so its final guarantees are less settled. Either way, treat vendor claims as contractual only once they appear in your signed terms.

Does OpenAI or Anthropic still offer zero data retention in 2026?

OpenAI offers ZDR to eligible API customers on its frontier models including GPT-6 Astra, and says Private Safety Processing is designed so it can keep offering it. Anthropic dropped ZDR for its most capable tier starting with Claude Fable 5 in favour of 30-day retention, but eligible customers get ZDR on Fable 5 and Fable 5.1 as a bridge until EFS reaches them.

Do EFS or Private Safety Processing cost extra?

Anthropic charges nothing for EFS and it does not change model pricing or rate limits; you pay your cloud provider for storage, reads, writes and egress. OpenAI has not announced pricing for Private Safety Processing as of September 2026 — it is in preview with early customers.

Quick Answer

Anthropic EFS vs OpenAI Private Safety Processing 2026

Published: September 9, 2026

The Short Answer

By September 2026 both frontier labs concede the same point: serious misuse — stolen credentials, agents that keep acting after being told to stop, attacks spread across accounts — is invisible one request at a time. Each now offers a way to correlate across sessions without its own staff reading your data. The designs differ in where the data sits, who holds the keys, and what the vendor gets back.

	Anthropic EFS	OpenAI Private Safety Processing
Announced	September 1, 2026	Previewed August 19, 2026
Where content lives	Customer’s own S3 / Azure Blob / GCS	Customer infrastructure (ZDR), or OpenAI storage encrypted with customer keys
Who holds keys	Customer (CMEK, opt-in)	Customer; OpenAI holds no copy
Who sees a flag	Customer’s security team only; no Anthropic human review	OpenAI receives a narrow signal of activity type; can trigger enforcement; no content access
Cloud partners	Bedrock, Google Agent Platform, Microsoft Foundry — equivalent controls	Not specified in the preview
Cost	Free; cloud storage/egress billed by provider	Not announced
Status	Phased rollout, broad availability targeted fall 2026	Early-customer testing; rollout + white paper promised for September
Bridge for ZDR buyers	ZDR on Fable 5 / 5.1 until EFS arrives	ZDR already available on frontier models incl. GPT-6 Astra

If you must sign today and your regulator cares who reads the logs, EFS is the more concrete offer. If ZDR on the frontier tier is the hard requirement, OpenAI already has it — and is building detection around it rather than replacing it.

The Problem They Both Solve

Anthropic introduced 30-day retention with Claude Fable 5 in July 2026, explicitly for cross-session detection. OpenAI took the opposite line in August, keeping ZDR on GPT-6 Astra and framing retained-data requirements as something “some recent frontier-model deployments” impose. Regulated buyers were stuck: Anthropic’s most capable model came with a vendor holding their prompts; OpenAI’s came with single-interaction safety checks that miss slow, distributed abuse.

Both August–September announcements are attempts to escape that trade-off.

Where the Data Lives

EFS is unambiguous: activity data used for monitoring goes to a bucket in the customer’s own cloud account, governed by the customer’s encryption keys, access policies and audit logging. Anthropic never holds it. That was a direct ask from the Analysis and Resilience Center for Systemic Risk, whose members include the CISOs of Goldman Sachs, Morgan Stanley, Citi, Bank of America and Wells Fargo.

Private Safety Processing has two modes. For ZDR deployments, content stays on infrastructure the customer controls. OpenAI is also developing an option where content sits on OpenAI storage encrypted with keys the customer controls — OpenAI personnel have no copy. Functionally similar, but the second mode means OpenAI operates the storage, which some data-residency policies treat differently from a customer-owned bucket.

Who Reviews a Flag

This is the sharpest difference.

EFS: automated systems analyse a rolling window for offensive cyber/bio development and stolen-credential signals, and “those flags go directly to the customer and their people take it from there — no human review by Anthropic employees is required.” The alert queue is yours to staff. That is a feature for firms whose staff are already cleared to see privileged material, and a cost for firms that are not.

Private Safety Processing: when a risk is identified, OpenAI receives a narrowly defined signal indicating the type of activity, which “can be used to determine whether enforcement is necessary.” Personnel do not see content even when flagged; customers can choose to share information to appeal or support an investigation. OpenAI keeps the enforcement decision; Anthropic hands it to you.

What Is Still Unsettled

Window length. Neither vendor has published how long the rolling correlation window runs — which matters if you are reasoning about what an attacker could hide by spacing activity out.
PSP specifics. OpenAI’s preview promises a technical white paper and rollout in September 2026; until it lands, the guarantees above are preview language, not terms.
Third-party resellers. Anthropic says it is “working to support third-party offerings”; the cloud-partner promise covers AWS, Google Cloud and Azure only.

How to Choose

Start from your contract, not the blog post. Confirm which workloads qualify and whether the guarantee is contractual.
Decide who you want staffing the alert queue. If the answer is “us,” EFS. If you would rather the vendor own enforcement, PSP.
Check the cloud path. Buying through Bedrock, Google Cloud or Foundry? EFS explicitly ships equivalent controls there; regional endpoints still carry roughly a 10% token premium.
Use the bridge. Anthropic customers waiting on EFS get ZDR on Fable 5.1; OpenAI customers have ZDR on Astra today.