The OpenAI API is private enough for most ecommerce work that carries no customer records: it does not train on API data by default, OpenAI signs a Data Processing Addendum, and small models cost cents per thousand requests. A private LLM in the brand's own cloud account is the better choice when customer records flow through the model every day, when the data has to stay in a chosen region without contract amendments, or when the brand wants a model tuned on its own products and customers, which OpenAI's API no longer offers new users.
What changes for customer data between the OpenAI API and a private LLM?
The table compares the OpenAI API with an open-weight model running on Amazon Bedrock in the brand's own AWS account, using each provider's published terms. Private AI vs public AI covers the same split for ChatGPT plans.
| Question | OpenAI API | Private LLM on Amazon Bedrock |
|---|---|---|
| Used to train the vendor's models? | No since 1 March 2023, unless the customer opts in | No. AWS says model providers have no access to Bedrock prompts or completions |
| Retention | Inputs and outputs kept up to 30 days for abuse monitoring. Zero data retention on request for eligible endpoints | Set by the brand per AWS Region. Mode "none" means zero retention |
| Data residency | Outside the US needs approval for abuse monitoring controls and a Modified Retention amendment. Residency endpoints cost 10% more for models released from 5 March 2026 | The AWS Region the brand chooses |
| Fine-tuning on the brand's own data | Platform being wound down, closed to new users | Available, on a private copy of the base model |
| Contracts and audits | Data Processing Addendum available. API certified SOC 2 Type 2 | Bedrock in scope for ISO and SOC, and usable in compliance with GDPR, per AWS |
On retention, OpenAI's enterprise privacy page is explicit:
Except for certain endpoints and features listed in our platform documentation, OpenAI may securely retain API inputs and outputs for up to 30 days to provide the services and to identify abuse.
Zero data retention is available for eligible endpoints if the customer has a qualifying use case, and OpenAI's platform documentation notes that endpoints not eligible for it may still store application state even when it is enabled. For a brand sending order histories or customer profiles through the API every day, that is a 30-day copy outside its own systems unless the request is approved.
The second change is newer. OpenAI's API pricing page now says:
OpenAI is winding down the fine-tuning platform. The platform is no longer accessible to new users, but existing users of the fine-tuning platform will be able to create training jobs for the coming months.
A brand that wants a model trained on its own product catalog, tone and customer questions can no longer start that on OpenAI's API. On an open-weight model it can: Bedrock tunes a private copy of the base model, and the result stays in the brand's account.
How do the costs compare?
Small models are cheap on both sides, so price per token is rarely what decides this. The table shows published prices per million tokens.
| Model and where it runs | Input | Output |
|---|---|---|
| gpt-6-luna, OpenAI API | $0.10 | $0.50 |
| gpt-6.1-sol, OpenAI API | $2.00 | $10.00 |
| gpt-6-astra, OpenAI API | $10.00 | $50.00 |
| gpt-oss-20b (OpenAI's open-weight model), Amazon Bedrock | $0.09 | $0.39 |
| Qwen3 32B, Amazon Bedrock | $0.20 | $0.78 |
| gpt-oss-120B, Together AI | $0.15 | $0.60 |
A worked example, our arithmetic on those prices: 10,000 support replies a day at about 1,500 input tokens and 300 output tokens each is 15 million input and 3 million output tokens a day. That costs about $91 a month on gpt-6-luna, $77 on gpt-oss-20b on Bedrock and $162 on Qwen3 32B on Bedrock. On gpt-6.1-sol it is about $1,824 a month. Residency endpoints on the OpenAI API add 10% for models released from 5 March 2026.
At this volume the gap between a small OpenAI model and a small open model is tens of dollars a month. The gap that matters is between model sizes, and between running a model on demand and keeping a server busy all day. Amazon Bedrock vs a self-hosted LLM works through when rented GPUs start to win, and what a private LLM costs to run covers the costs beyond tokens.
When is the OpenAI API enough, and when is it not?
The API is enough when prompts carry no customer records, or when personal data is removed before each call: product copy, ad variants, research, internal documents and analysis of aggregated sales data. Sign the Data Processing Addendum, and apply for zero data retention if the workflow qualifies. AI data security on AWS covers the redaction and logging that make this safe.
A private LLM is the better fit when customer records go through the model at volume, such as support replies on order history or segmentation on customer profiles; when EU, UK or Gulf customer data has to stay in one region without extra contract terms; or when the brand wants a model tuned on its catalog and customer language. OpenAI's own open-weight gpt-oss models are listed on Bedrock, so choosing a private LLM does not mean giving up OpenAI's models altogether.
Brand Media Works, an AI consulting and marketing data engineering firm for ecommerce brands, builds private LLMs on open-weight models in the brand's own AWS account. Is ChatGPT Enterprise private enough for customer data? covers the chat product rather than the API, and private AI for business covers when a marketing team needs a private model at all.
Frequently asked questions
Does the OpenAI API train on my data?
No, not by default. OpenAI says data sent to its API has not been used to train or improve its models since 1 March 2023, unless the customer explicitly opts in to share it.
Can I get zero data retention on the OpenAI API?
For some endpoints. OpenAI offers zero data retention on request for eligible endpoints when the customer has a qualifying use case. Endpoints that are not eligible may still store application state even with it enabled.
Can a private LLM use OpenAI's models?
Yes, its open-weight ones. gpt-oss-20b is listed on Amazon Bedrock at $0.09 per million input tokens and $0.39 per million output tokens, and AWS's abuse-detection terms exclude the gpt-oss models from the 30-day retention it applies to flagged traffic on other OpenAI models.