How to set up OpenAI
OpenAI Setup Guide
With the OpenAI provider, you connect your own OpenAI account with an API key. Bsure uses that key to send your questions to OpenAI and return the answer inside the app. The models run under your OpenAI account, your billing, and your contract with OpenAI. See AI Chat for the bring-your-own-key model that applies to both providers.
Before you start
In addition to the common prerequisites, you will need:
An OpenAI account on the API platform at platform.openai.com. This is the developer platform, not ChatGPT. A personal ChatGPT subscription does not provide an API key.
Billing enabled on the OpenAI account. Without a payment method or prepaid credits, the key authenticates but calls fail with a quota error. Set this up under Settings → Billing in the OpenAI platform.
Use an organization account, not a personal one. OpenAI's Data Processing Addendum can only be executed by a business or organization account. Personal accounts cannot sign it. Create the account under a shared, company-owned email rather than an individual's.
Part 1: Create an OpenAI API key
Sign in to the OpenAI API platform
Go to platform.openai.com and sign in with your organization account.
The key looks like sk-.... Treat it like a password. Anyone with the key can spend on your OpenAI account.
Part 2: Configure AI Chat in Bsure
In Bsure, open System Settings → System and select the AI Chat tab.
Provider: select OpenAI.
Model: choose the model used for chat responses. The default is the current recommended model, for example
gpt-5.5. A more capable model usually improves answer quality and cost.Mini Model: choose the smaller model used for lightweight internal steps. The default is the current recommended mini model, for example
gpt-5.4-nano.API Token: paste the secret key from Part 1.
Click Validate. Bsure makes a test call to OpenAI with the key. On success the field shows ✓ Confirmed with a short fingerprint of the key. The fingerprint confirms which key is stored without exposing the secret.
Click Save.
AI Chat is now active on OpenAI. The token is masked from now on, and only the fingerprint is shown.
Rotating or replacing the key
To rotate the key, on a schedule or after staff changes, create a new key in the OpenAI platform, paste it into API Token, Validate, and Save. Then delete the old key in the OpenAI platform so it can no longer be used.
Data sharing
This section covers what data leaves your environment, where it goes, and how to put the right contract in place. It is written for a data protection officer or security lead as much as for an administrator.
Who is the processor
Because AI Chat uses your own OpenAI API key and your own OpenAI account, OpenAI processes the data under your organization's contract with OpenAI, not under Bsure's. In data protection terms:
You (the customer) are the controller of your Microsoft 365 and Entra data.
OpenAI acts as a processor for the data sent through the API, under the contract between you and OpenAI.
Bsure transmits your question and the supporting context to OpenAI using the key you provided, and returns the answer. Bsure does not hold a separate OpenAI contract on your behalf.
This is why you, not Bsure, execute the OpenAI DPA (see below).
What data is sent to OpenAI
When you ask a question in AI Chat, the following is sent to the OpenAI API:
The question text you type.
The context Bsure assembles to answer it, which may include governance data drawn from your tenant: for example, user and group attributes, role and permission assignments, license information, and sign-in and audit signals relevant to the question.
Data not sent to OpenAI:
Your OpenAI API key, which authenticates the call and is not part of the prompt content.
Credentials, secrets, and Bsure's own configuration.
Answers can include personal data about users in your tenant. Treat AI Chat prompts as personal-data processing and document them in your records of processing, with a DPIA if your risk assessment calls for one.
How OpenAI handles API data
The points below reflect OpenAI's published policy for the API platform (their business path), current as of OpenAI's enterprise-privacy update of January 8, 2026. The consumer ChatGPT Free and Plus tiers have different defaults.
No training by default. Since March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI's models unless you opt in. (source)
Short retention for abuse monitoring. By default, API inputs and outputs may be retained for up to 30 days for abuse and misuse monitoring, then deleted, unless a longer period is legally required. (source)
Automated safety classification. OpenAI may run business data through automated classifiers and safety tools. The resulting classifications are metadata about the data, not copies of the data itself. (source)
Zero Data Retention (ZDR). Available for eligible enterprise API use. With ZDR, eligible content is processed without being written to storage and is excluded from abuse-monitoring logs and human review. Availability is subject to OpenAI's approval. (source)
Executing the OpenAI DPA
To process personal data through the OpenAI API in line with GDPR (Art. 28), execute OpenAI's Data Processing Addendum. The DPA is not applied automatically. You conclude it yourself.
Open OpenAI's DPA page: openai.com/policies/data-processing-addendum.
Use the DPA form linked from that page (an online signing flow). Provide your legal entity name, OpenAI organization ID, and an authorized signatory.
Submit. OpenAI countersigns and returns the executed document, usually within minutes.
Store the executed DPA where your legal and DPO functions can retrieve it.
Notes:
The DPA applies organization-wide for your OpenAI Org ID. You do not sign it per project or per key.
The EU Standard Contractual Clauses (SCCs) are incorporated into the DPA, so a separate SCC agreement is not required for EU-to-US transfers. The EU contracting party is OpenAI Ireland Ltd. (source)
A personal OpenAI account cannot execute the DPA, which is another reason to use an organization account.
Recommended controls
Set a monthly spend limit on the OpenAI project to cap cost and contain abuse of a leaked key.
Name and rotate keys so you can attribute and revoke access cleanly.
Decide whether your risk profile warrants requesting ZDR from OpenAI.
Record AI Chat in your processing inventory and assess the need for a DPIA.
Troubleshooting
Validate fails immediately
Wrong key, key revoked, or pasted with extra spaces
Re-copy the key from the OpenAI platform and paste again
Validate succeeds but chat returns errors
No billing or out of credits on the OpenAI account
Add a payment method or credits under OpenAI Settings → Billing
Used a key from User API Keys (Legacy)
Legacy key type
Create a new key under Project API Keys instead
Chat works, then stops
Key rotated or deleted in OpenAI, or spend limit hit
Paste a current key and revalidate, then check the project's spend limit
Sources and further reading
Last updated
Was this helpful?