Subprocessor OpenAI
Last updated: Nov 3, 2026
Fluid Attacks uses OpenAI as an AI service provider to process specific customer requests. This page explains how OpenAI processes customer data. For more details, read the OpenAI documentation.
What information is sent
Fluid Attacks sends to OpenAI only the information that is necessary to generate a response. This information can include text, vulnerability information, or source code.
How the data is used
OpenAI processes the data only to generate a response to the request of Fluid Attacks. Fluid Attacks configures the OpenAI API with Zero Data Retention. This means:
- OpenAI does not store requests and responses in its systems.
- OpenAI does not create a conversation history or a long-term state in its systems.
- Customer content is not included in the abuse monitoring logs of OpenAI.
Model training
OpenAI does not use the customer data that it receives through its API to train or improve its models.
Zero Data Retention
Fluid Attacks has Zero Data Retention enabled. Thus, the customer content that Fluid Attacks sends through the API is not included in the abuse monitoring logs of OpenAI. OpenAI processes the data in memory and does not write it to a persistent database or disk.
Encryption and security
OpenAI applies industry-standard cryptography to protect data:
- Encryption at rest: OpenAI encrypts the data in its systems with AES-256 or an equivalent strong algorithm.
- Encryption in transit: OpenAI encrypts the data between your systems and OpenAI with TLS 1.2 or higher, to protect it from interception on the network.
Certifications and compliance
- SOC 2 Type II
- SOC 3
- ISO/IEC 27001 - Information Security Management
- ISO/IEC 27017 - Cloud Security Controls
- ISO/IEC 27018 - Protection of Personal Data in Cloud Services
- ISO/IEC 27701 - Privacy Information Management
- ISO/IEC 42001 - Artificial Intelligence Management System (AI governance & risk).
- CSA STAR (Level 1 - Self-Assessment)
- TX-RAMP
- CCPA
- GDPR
For more information, read the OpenAI Trust Portal.
Other privacy measures
Manual for the NDR
Information registered by Fluid Attacks in Colombia's National Database Registry (NDR), including data controller details and data subject rights.
OTR messaging
Fluid Attacks uses Off-the-Record messaging with end-to-end encryption and daily chat history resets to prevent internal communications leaks.