OpenAI and Anthropic Compliance APIs Compared

On June 5, 2026, OpenAI removed its legacy stateful compliance route, forcing every Enterprise and Edu customer onto the new Compliance Logs Platform. A month earlier, Anthropic's Compliance API hit 28 enterprise security integrations after launching in August 2025. Both providers now have compliance APIs in production. They cover different products, expose different data, enforce different retention windows, and use incompatible authentication models.

Running both providers means two separate export pipelines, incompatible schemas, and no shared coverage of API-tier prompt/completion pairs. This guide maps what each API captures, where the gaps are, and how a proxy layer like SHIM turns both into components of a single cross-provider compliance program.

What Each Provider Ships

Anthropic launched its Compliance API in August 2025. It gives Claude Enterprise customers programmatic access to their organization's Activity Feed, the directory of users, roles, and groups, the effective settings in force for each organization, and the underlying chats, files, and projects. Two key types unlock it: a Compliance Access Key (created in claude.ai) that reaches every endpoint, and an Admin API key (created in Claude Console) that reaches the Activity Feed only.

OpenAI ships two separate systems. The ChatGPT Compliance Platform, originally launched July 18, 2024, serves Enterprise and Edu customers. It provides two access patterns: a Compliance Logs Platform for immutable, append-only compliance log events, and a Stateful Compliance API for querying state at the time of request. Separately, the API Platform has its own Admin and Audit Logs API for organizations using the developer API directly.

The new Logs Platform delivers improved reliability, minutes-level latency, and a single ingestion pattern across multiple log categories including Admin Audit, User Authentication, and Codex Usage logs.

What Each API Captures

The ChatGPT Compliance Platform provides a record of time-stamped interactions, including conversations, uploaded files, workspace GPT configuration and metadata, memories, and workspace users. That covers the managed application layer.

The API Platform Audit Logs cover a different surface: the lifecycle of API keys, account invitations, user and service account lifecycle, login and logout failures, organization configuration changes, and project lifecycle. Configuration metadata, not conversation content.

For Anthropic, the content endpoints (chats, files, projects, and project attachments) serve claude.ai data only. Claude Platform (API) customers get the Activity Feed, which logs administrative actions and configuration changes. It does not log prompt text, model responses, or any /v1/messages payloads.

A /v1/messages call made by application code produces no entry in Anthropic's Activity Feed. A /v1/chat/completions call produces no entry in OpenAI's Audit Logs. Both compliance APIs are scoped to their managed applications (ChatGPT and claude.ai) and their admin control planes, not to the developer API tier.

Retention, Keys, and Activation Traps

OpenAI ChatGPT Compliance Logs retain data for 30 days. Organizations needing longer retention must build a system to continuously download all logs and store them according to their own policies. Polling once every 29 days with a one-day overlap keeps data within the window; that is roughly 13 export cycles per year. Miss a window and the data is gone.

OpenAI API Platform audit logs have no fixed retention period or configured TTL. OpenAI retains them on a best-effort basis but does not guarantee permanent availability. Customers needing logs for compliance or eDiscovery must export and store copies in their own systems. Zero Data Retention does not change the availability of API Platform audit logs, since they are administrative metadata, not customer content.

Anthropic's Compliance API shares a single rate limit of 600 requests per minute per parent organization across all /v1/compliance/* endpoints. More critically, logging begins only after activation with no backfill. An organization that waits 60 days loses 60 days of activity-feed history with no recovery path. Unlike OpenAI's 30-day polling cadence, Anthropic requires a one-time activation step, after which the feed streams forward continuously.

Anthropic also draws a clear line between compliance and analytics. The Compliance API returns per-event records for security, legal, and compliance teams, while the Analytics API returns aggregated usage and cost figures for IT and FinOps teams. A FinOps team using a Compliance Access Key to pull cost data is using the wrong API; the Analytics API requires its own key and returns aggregated figures rather than per-event records.

Adoption and Exposure Numbers

Enterprise adoption of Claude grew from 56.2% to 94.9% between April 2025 and April 2026, according to Netskope's AI Index.

Research shows 4% of all Claude prompts disclose some level of private information and 20% of files uploaded to Claude Enterprise contain confidential data. At an organization with 1,000 Claude users sending 50 prompts per day, that 4% rate means roughly 2,000 prompts containing private information every day.

80% of organizations are concerned about sensitive data leaking through generative AI. A Proofpoint report found that nearly 9 in 10 global organizations have moved AI assistants beyond pilot stage, yet 42% have already experienced a suspicious or confirmed AI-related incident.

Integration Partners

OpenAI's original Compliance Platform partners included Forcepoint, Global Relay, Microsoft Purview, Netskope, Palo Alto Networks, Relativity, Smarsh, and Zscaler. The platform connects with eDiscovery, DLP, and SIEM tools, supporting regulations like FINRA, HIPAA, and GDPR.

By May 2026, 28 enterprise security vendors had built integrations with Anthropic covering DLP, SASE, data security, SIEM and security operations, identity, eDiscovery, AI security posture management, and AI observability. Only Microsoft Purview appears in both ecosystems. Purview now extends AI governance visibility from Microsoft Copilot to Claude Enterprise, giving organizations a consolidated view across multiple AI systems.

SailPoint's integration enables organizations to treat AI platform access with the same rigor as a critical application or datastore.

The API-Tier Gap and Where a Proxy Fits

FINRA 17a-4 requires immutable retention of communication content for a minimum of six years. HIPAA audit-log requirements mandate tracking PHI disclosures in each transaction. Neither requirement can be satisfied by the provider compliance APIs for API-tier traffic: OpenAI's ChatGPT logs expire after 30 days, Anthropic has no backfill, and neither captures /v1/chat/completions or /v1/messages payloads at all.

A proxy positioned in the request path can collect the records your retention policy requires, but that requires an explicit content-retention design. SHIM's durable request records exclude raw bodies, while OpenAI Responses continuation mappings are encrypted and tenant-bound; it is not a general immutable archive or a replacement for provider compliance APIs.

For the AI compliance policy layer that sits on top of this data, and how to structure governance frameworks around cross-provider audit trails, the linked guides cover classification rules for flagging PII in captured payloads and access-control patterns at the gateway level. Data governance policies determine what gets retained, redacted, or escalated from the proxy-captured stream.

Cross-Provider Compliance by Regulatory Framework