Both are worth switching on, and neither is the whole audit trail. The Claude Compliance API and the OpenAI Compliance Platform each give your security, legal and compliance teams a programmatic feed of what happened inside one vendor's product: sign-ins, chats created, files uploaded, admin changes and, on the Enterprise plans, the message content itself. They differ on retention (Anthropic keeps Activity Feed records for 6 years; OpenAI's Compliance Logs Platform keeps data for 30 days), on who is allowed to turn them on, and on how far they reach into coding agents. What neither feed shows is what the same person did in the other vendor's tool, what was redacted on the device before a prompt left it, or a record you hold for the whole audit period. Turn both on. Then plan for what they do not cover.
Last verified: 21 October 2026, against Anthropic's Compliance API documentation on platform.claude.com, Anthropic's help center and blog, OpenAI's help center article on the Compliance Platform, OpenAI's quickstart notebook and announcement page, Microsoft Learn pages for the Purview connectors, and CrowdStrike's press release. OpenAI's help center and announcement pages refused direct requests that day and were read through a text-rendering proxy; OpenAI's API reference sits behind a workspace login and was not read.
What does the Claude Compliance API give you?
Anthropic's documentation describes programmatic access to an organization's Activity Feed and, for Claude Enterprise organizations, to users, roles and groups, the settings in force, the underlying chats, files and projects, and sessions in Claude apps and agents such as Cowork and Claude Code. Every endpoint lives under /v1/compliance/* and shares a limit of 600 requests per minute per parent organization.
Access is narrow by design. For a Claude Enterprise organization, only the primary owner turns the API on, and enablement cascades to every linked organization. The primary owner can create a key covering every organization under the parent; an organization owner can create one limited to their own. A standalone Claude Console organization gets an Admin API key and the Activity Feed only, with no prompt text or responses from API-key workloads. Scopes are fixed when a key is created, with separate scopes for reading the feed, reading content, hard-deleting content, and reading directory data.
Three facts about the feed matter for an audit. Activities are queryable within 1 minute and retained for 6 years. Recording is not retroactive: it starts when the API is first enabled. And the Activity Feed records who did what and when, not prompt text or model responses; those come from the chat, file and session endpoints.
Local sessions, meaning Cowork on the desktop, Claude Code in the terminal, desktop or an IDE, and the Microsoft 365 add-ins, are captured server-side as their requests reach the Claude API while the user is signed in with an Enterprise account. Nothing is installed on the device. Transcripts carry prompts, responses, and tool calls and results, each tool input and result cut at 10,000 bytes by default; they omit thinking blocks, images, the system prompt and tool definitions. In Anthropic's words, a transcript shows "what Claude was asked to do and what it returned, not what occurred on the device". Sessions on a Console API key, on a third-party cloud platform, or in Claude Code cloud sessions are not captured.
Transcripts have their own retention: 6 years by default for local sessions, or your custom conversation retention period, or 30 days where HIPAA readiness is enabled. Chat, file and project content follows your claude.ai retention policy.
Partner coverage is wide. Anthropic's integration guide lists the platforms built on the API, among them CrowdStrike, Microsoft Purview, Splunk, Sumo Logic, Datadog and Cribl; Anthropic announced 28 on 21 May 2026 and now notes the list has passed 100. CrowdStrike's release of the same date says its integration ingests Claude Enterprise activity logs and conversation content into Falcon Next-Gen SIEM.
What does the OpenAI Compliance Platform give you?
OpenAI's help center article, OpenAI Compliance Platform for Enterprise and Edu customers, says the platform is available to ChatGPT Enterprise and Edu workspaces. It describes two access patterns: the Compliance Logs Platform, which provides what the article calls immutable, append-only compliance log events for auditing, and the Stateful Compliance API, which queries state at the time of the request for joining data referenced in events and for legacy data types. The old stateful route for conversations was deprecated when a new conversation logs system shipped on 5 March 2026 and, the article says, removed on 5 June 2026.
The permissions model is more layered than the "owners only" summary that circulates. A workspace owner or admin creates a workspace-scoped Admin key, and either role can grant individual log categories such as audit, authentication or app logs. Only a workspace owner can grant broad compliance access or the Conversation messages permission.
Content is in scope. Conversation message logs are available, messages from locked chats are included, and an account PIN does not prevent authorized access through the platform. Changes made in the Codex Policies and Configurations interface land in workspace audit logs. OpenAI's announcement page carries an update dated 11 December 2025: the Compliance API is now part of the Compliance Logs Platform, which delivers immutable, time-windowed JSONL log files with minutes-level latency, and Admin Audit, User Authentication and Codex Usage logs were added. The original launch text named conversations, uploaded files, GPT configuration, memories and workspace users.
Delivery is pull, like Anthropic's. OpenAI's quickstart notebook lists log files for a workspace or organization under api.chatgpt.com/v1/compliance and downloads each to a JSONL file; it carries a banner saying the recipe is archived, so treat the paths as illustrative. Retention is the number to write down: the Compliance Logs Platform retains data for 30 days, and customers who need longer should download logs continuously and store them under their own policies. Deleted data is not recoverable.
The help article names no partners; it refers to "your eDiscovery, DLP, or SIEM tools" in general terms. Microsoft's Purview connector for ChatGPT Enterprise, in preview, extracts text prompts and responses, and Microsoft notes that because of OpenAI's current API limitations, conversations are ingested 24 hours after they occur.
How do the two compare?
| Attribute | Claude Compliance API (Anthropic) | Compliance Platform (OpenAI) |
|---|---|---|
| Plans covered | Claude Enterprise for the full API; standalone Console organizations get the Activity Feed only. Government deployments use a separate API. | ChatGPT Enterprise and Edu workspaces. |
| Who can enable | The primary owner (Enterprise) or an organization admin (standalone Console). A primary owner's key covers every linked organization. | A workspace owner or admin creates the Admin key and grants log categories. Only a workspace owner grants broad access or Conversation messages. |
| Objects and events exported | Activity Feed (authentication, chat, file, project, administrative, platform events); chats; files; projects; session transcripts; users, roles, groups, settings. | Conversation message logs; audit, authentication and app logs; Codex policy changes; Codex Usage logs per the December 2025 update; stateful endpoints for current state. |
| Content included | Not in the Activity Feed. Yes through content and session endpoints: prompts, responses, file text, tool calls and results. | Yes, conversation messages, including locked chats. Files and memories are named in the launch announcement, not in the help article. |
| Retention | Activity Feed 6 years. Chats, files, projects per your policy (indefinite by default). Local transcripts 6 years by default, 30 days with HIPAA readiness. | 30 days on the Compliance Logs Platform; download continuously for longer. |
| Delivery model | Pull. Cursor or time-window reads, queryable within 1 minute, 600 requests per minute, at-least-once. | Pull. List and download time-windowed JSONL files; minutes-level latency stated. |
| Partner integrations | Listed by Anthropic, including CrowdStrike, Microsoft Purview (preview), Splunk, Sumo Logic, Datadog, Cribl; more than 100 now. | Not named in the help article. Microsoft Purview connector in preview, 24 hours behind. |
| Agent and tool-call coverage | Cowork, Claude Code and Claude for Microsoft 365 stable; Claude Science, Google add-ins, Claude in Chrome in beta. Tool inputs and results, cut at 10,000 bytes. Not captured: Console API keys, Bedrock, Google Cloud, Foundry, cloud and zero-data-retention sessions. | Codex policy changes and Codex Usage logs. Tool calls inside ChatGPT conversations: not documented. |
| Cross-vendor view | No. Claude products only. | No. ChatGPT workspaces only. |
| Device-side redaction evidence | No. On-device activity that never reaches the API is not captured. Inference hooks can deny a prompt before inference, but server-side. | Not documented. |
What does an auditor still ask for?
An auditor, a DPO or an incident responder rarely asks "what happened in Claude". They ask about a person, a dataset or a date range. Three asks recur, and each lands partly outside both feeds.
User-level activity across every tool
"Show me everything this contractor sent to an AI service between the 3rd and the 9th." The Claude feed answers for Claude; join on actor.user_id, which Anthropic says is stable and survives email changes. The OpenAI logs answer for the ChatGPT workspace, and Copilot answers through Purview. A coding agent on a laptop signed into a personal account answers through none of them. The join happens in your SIEM; the gaps are filled by something that watches the device rather than the vendor. Our guide to piping AI audit trails into your SIEM is useful here because it works through the field mapping for these feeds and where each one goes quiet.
DLP decisions, not just content
"Which prompts contained personal data, and what did you do about it?" Both feeds can give you the prompt after the fact, which is evidence of exposure rather than evidence of control. Neither records that a national ID number was replaced with a placeholder before the request left the laptop; neither is on the laptop. Anthropic's inference hooks come closest, letting your security server deny a governed prompt before inference, but on Anthropic's side and for Claude alone. The record an auditor wants pairs each prompt with the classifier that fired, the action taken and the policy behind it, across every tool.
Retention proof for the audit period
"Prove the log is complete and unaltered for the period under review." Here the vendors diverge most. OpenAI gives you 30 days and tells you to keep your own copy. Anthropic gives you 6 years for the Activity Feed, but its integration guide says the list endpoints return no total count or checksum, and it recommends logging cursors, record counts and request IDs for each export run and hashing each record. Good advice for both vendors, and it describes work you do, not work the API does. Our piece on the AI agent audit log is useful here because it sets out the metadata spine and separately governed content store that a cross-vendor archive needs.
What should you do now?
- Turn both on this week. Recording is not retroactive at Anthropic and OpenAI's window is 30 days, so every day without the feeds is a day without evidence. The Claude primary owner enables the API and issues a read-only key; a ChatGPT workspace owner grants Conversation messages on a scoped Admin key.
- Route both to the SIEM, continuously. Poll the Claude Activity Feed on a cursor with an overlap, and pull the OpenAI log files on a schedule that comfortably beats 30 days. Our AI agent detection rules give the queries to run next.
- Record the export itself. Log cursors, counts and request IDs for each run, hash each record, and ingest the compliance_api_accessed events so the SIEM shows who read compliance data.
- Add point-of-use evidence. Put a control on the device that sees every AI tool, including the personal accounts and coding agents the vendor feeds exclude, classifies the prompt before it leaves, redacts or blocks, and writes the decision in the same schema.
- Decide the system of record for Copilot. Choose between Purview's connectors and your SIEM; our control matrix for Copilot and ChatGPT Enterprise walks through that choice. Then re-read both vendors' exclusion lists each quarter.
Where does software stop and judgment begin?
No tool decides whether a prompt was a reportable incident, whether a legal hold applies, or whether 30 days of vendor retention satisfies your regulator. Those calls belong to the DPO, counsel and the audit committee. No log makes you compliant by existing.
What software can do is remove the blind spots between the feeds. AccuroAI sits at the point of use, without TLS interception, and inspects prompts and uploads with 40+ data classifiers before they reach any model: Claude, ChatGPT, Copilot or a coding agent on a personal account. It redacts or blocks in line and records every decision as evidence mapped to 8 frameworks, in one schema your SIEM can join against the vendor feeds. See workforce AI governance for the policy side, and our Claude Cowork and Claude Code security review for the agents these feeds cover.
Frequently asked questions
Does the Claude Compliance API include prompt text?
Not in the Activity Feed. Message content comes from the chat, file and session endpoints, which need a Compliance Access Key with the user-data scope and exist only for Claude Enterprise organizations.
How long does OpenAI keep compliance logs?
30 days on the Compliance Logs Platform, per the help article, which tells anyone who needs longer to download logs continuously and keep them under their own policy.
Can an admin, rather than an owner, set up the OpenAI feed?
Partly. A workspace owner or admin can create the Admin key and grant categories such as audit or authentication. Broad compliance access or the Conversation messages permission takes a workspace owner.
Do these feeds cover Claude Code and Codex?
Claude Code sessions signed into an Enterprise account are captured as transcripts with tool calls, except on a Console API key, a cloud platform, or a cloud session. OpenAI records Codex policy changes in audit logs and announced Codex Usage logs in December 2025.
Which one is immutable?
OpenAI calls its log events immutable and append-only. Anthropic does not use that word; it says recorded activity is not deleted when the API is switched off, while chats, files and projects can be hard-deleted through the delete scope. Either way, the copy that counts is the one you archive with hashes.
This is not legal advice. Vendor documentation changes often; confirm the pages below against the versions in force on your audit date, and ask counsel before relying on any retention figure.
Sources
- Compliance API, Set up, Activity Feed, Session transcripts, Integration patterns and FAQ, Claude Platform Docs
- Access the Compliance API and Get started with Claude Compliance API integrations, Claude Help Center
- Anthropic blog: security and compliance partners (21 May 2026) and Cowork and Claude Code coverage (11 August 2026)
- OpenAI Compliance Platform for Enterprise and Edu customers, OpenAI Help Center
- New compliance and administrative tools for ChatGPT Enterprise, OpenAI, with the 11 December 2025 update
- OpenAI Compliance Logs Platform quickstart, OpenAI Cookbook
- ChatGPT Enterprise connector (preview) and Anthropic Claude (Enterprise), Microsoft Purview, Microsoft Learn
- CrowdStrike Delivers Visibility and Monitoring for Claude Activity, 21 May 2026