Azure OpenAI: data management and Abuse Monitoring

Question

Hello,

we would like to use Azure OpenAI and would like to clarify some data management aspects. Here is an example use case: We have a B2C web app where users can upload documents. Our system must analyse them via Azure OpenAI and return the results to the user. Therefore, we are interested in understanding in detail how the data uploaded by users is managed, especially given the integration with OpenAI. In summary, it is as if I were using chatGPT by loading a document to obtain an analysis. Only, in this use case, the prompt is always the same, because we always want to obtain the same information.

My questions are related to the management of the user's personal data in the uploaded documents and in the service response:

For the management of the documents uploaded by the users, I imagine they should be historised in an Azure Blob Storage, so here it is possible to set up retention limitations and limit the presence of these documents in my tenant, right?

Instead, for the data in the service response, how is it handled? As I've read about Abuse Monitoring and it seems that the response and prompt are retained for 30 days? Where are they stored, in my tenant? Where do I find them? Is it possible to avoid this? Are they encrypted? (https://learn.microsoft.com/en-us/legal/cognitive-services/openai/data-privacy?tabs=azure-cli#how-does-the-azure-openai-service-process-data)

Also, I found this:

'If the customer's application is approved, Azure OpenAI abuse monitoring will be turned off and will not store any prompts and completions associated with the approved Azure subscription for which abuse monitoring is modified and the human review process is not performed.'

what does it depend on whether my app is accepted?

Thank you,

Francesco

Answer 1

Hi De Ieso Francesco TRI-IS EXTERN,
Hope you are doing well.

The data in the service response, including prompts and completions, is stored in Microsoft's Azure environment and not directly in your tenant. This data is retained for 30 days for abuse monitoring purposes.

Azure OpenAI's abuse monitoring involves several components:

Content Classification: Detects harmful content in prompts and completions.

Abuse Pattern Capture: Monitors usage patterns to detect potential abuse.

Review and Decision: Flagged content undergoes automated or human review to confirm potential abuse.
For more information: Components of abuse monitoring

If your application is approved for modified abuse monitoring, prompts and completions will not be stored. Approval depends on your application's compliance with Microsoft's guidelines.