> For the complete documentation index, see [llms.txt](https://docs.bsure.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bsure.io/user-guides/settings/system/ai-chat/how-to-set-up-openai.md). # How to set up OpenAI ## OpenAI Setup Guide With the **OpenAI** provider, you connect your own OpenAI account with an API key. Bsure uses that key to send your questions to OpenAI and return the answer inside the app. The models run under **your** OpenAI account, **your** billing, and **your** contract with OpenAI. See [AI Chat](/user-guides/settings/system/ai-chat.md) for the bring-your-own-key model that applies to both providers. *** ### Before you start In addition to the [common prerequisites](/user-guides/settings/system/ai-chat.md), you will need: * **An OpenAI account on the API platform** at [platform.openai.com](https://platform.openai.com/). This is the developer platform, *not* ChatGPT. A personal ChatGPT subscription does not provide an API key. * **Billing enabled on the OpenAI account.** Without a payment method or prepaid credits, the key authenticates but calls fail with a quota error. Set this up under **Settings → Billing** in the OpenAI platform. {% hint style="warning" %} **Use an organization account, not a personal one.** OpenAI's Data Processing Addendum can only be executed by a business or organization account. Personal accounts cannot sign it. Create the account under a shared, company-owned email rather than an individual's. {% endhint %} *** ### Part 1: Create an OpenAI API key {% stepper %} {% step %} #### Sign in to the OpenAI API platform Go to [platform.openai.com](https://platform.openai.com/) and sign in with your organization account. {% endstep %} {% step %} #### Open **API keys** In the left navigation, open **API keys**. {% endstep %} {% step %} #### Stay on the **Project API Keys** tab Do **not** use the **User API Keys (Legacy)** tab. Project keys are scoped to a project and are the supported type. {% endstep %} {% step %} #### Create a new secret key Click **+ Create new secret key**. {% endstep %} {% step %} #### Give the key a clear name For example `Bsure AI Chat `. A clear name keeps the key easy to find, monitor, and revoke later. {% endstep %} {% step %} #### Restrict permissions and set a spend limit This is recommended. Restrict the key's permissions and set a monthly spend limit on the project, so AI Chat usage stays within a known budget. {% endstep %} {% step %} #### Click **Create** OpenAI shows the full secret key **once**. {% endstep %} {% step %} #### Copy the key now Store it somewhere safe, such as a password manager or your secrets store. You cannot view it again after closing the dialog. If you lose it, create a new one. {% endstep %} {% endstepper %} {% hint style="danger" %} The key looks like `sk-...`. Treat it like a password. Anyone with the key can spend on your OpenAI account. {% endhint %}

Project API keys in the OpenAI platform

*** ### Part 2: Configure AI Chat in Bsure 1. In Bsure, open **System Settings → System** and select the **AI Chat** tab. 2. **Provider**: select **OpenAI**. 3. **Model**: choose the model used for chat responses. The default is the current recommended model, for example `gpt-5.5`. A more capable model usually improves answer quality and cost. 4. **Mini Model**: choose the smaller model used for lightweight internal steps. The default is the current recommended mini model, for example `gpt-5.4-nano`. 5. **API Token**: paste the secret key from Part 1. 6. Click **Validate**. Bsure makes a test call to OpenAI with the key. On success the field shows **✓ Confirmed** with a short fingerprint of the key. The fingerprint confirms which key is stored without exposing the secret. 7. Click **Save**. AI Chat is now active on OpenAI. The token is masked from now on, and only the fingerprint is shown. ### Rotating or replacing the key To rotate the key, on a schedule or after staff changes, create a new key in the OpenAI platform, paste it into **API Token**, **Validate**, and **Save**. Then delete the old key in the OpenAI platform so it can no longer be used. *** ### Data sharing This section covers what data leaves your environment, where it goes, and how to put the right contract in place. It is written for a data protection officer or security lead as much as for an administrator. #### Who is the processor Because AI Chat uses **your own OpenAI API key and your own OpenAI account**, OpenAI processes the data under **your organization's contract with OpenAI**, not under Bsure's. In data protection terms: * **You** (the customer) are the **controller** of your Microsoft 365 and Entra data. * **OpenAI** acts as a **processor** for the data sent through the API, under the contract between you and OpenAI. * **Bsure** transmits your question and the supporting context to OpenAI using the key you provided, and returns the answer. Bsure does not hold a separate OpenAI contract on your behalf. This is why you, not Bsure, execute the OpenAI DPA (see below). #### What data is sent to OpenAI When you ask a question in AI Chat, the following is sent to the OpenAI API: * The **question text** you type. * The **context Bsure assembles** to answer it, which may include governance data drawn from your tenant: for example, user and group attributes, role and permission assignments, license information, and sign-in and audit signals relevant to the question. Data **not** sent to OpenAI: * Your OpenAI API key, which authenticates the call and is not part of the prompt content. * Credentials, secrets, and Bsure's own configuration. Answers can include personal data about users in your tenant. Treat AI Chat prompts as personal-data processing and document them in your records of processing, with a DPIA if your risk assessment calls for one. #### How OpenAI handles API data The points below reflect OpenAI's published policy for the **API platform** (their business path), current as of OpenAI's enterprise-privacy update of January 8, 2026. The consumer ChatGPT Free and Plus tiers have different defaults. * **No training by default.** Since March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI's models unless you opt in. ([source](https://openai.com/policies/how-your-data-is-used-to-improve-model-performance/)) * **Short retention for abuse monitoring.** By default, API inputs and outputs may be retained for up to 30 days for abuse and misuse monitoring, then deleted, unless a longer period is legally required. ([source](https://developers.openai.com/api/docs/guides/your-data)) * **Automated safety classification.** OpenAI may run business data through automated classifiers and safety tools. The resulting classifications are metadata about the data, not copies of the data itself. ([source](https://openai.com/enterprise-privacy/)) * **Zero Data Retention (ZDR).** Available for eligible enterprise API use. With ZDR, eligible content is processed without being written to storage and is excluded from abuse-monitoring logs and human review. Availability is subject to OpenAI's approval. ([source](https://platform.openai.com/docs/guides/your-data)) #### Executing the OpenAI DPA To process personal data through the OpenAI API in line with GDPR (Art. 28), execute OpenAI's **Data Processing Addendum**. The DPA is not applied automatically. You conclude it yourself. 1. Open OpenAI's DPA page: [**openai.com/policies/data-processing-addendum**](https://openai.com/policies/data-processing-addendum/). 2. Use the **DPA form** linked from that page (an online signing flow). Provide your legal entity name, OpenAI organization ID, and an authorized signatory. 3. Submit. OpenAI countersigns and returns the executed document, usually within minutes. 4. **Store the executed DPA** where your legal and DPO functions can retrieve it. Notes: * The DPA applies **organization-wide for your OpenAI Org ID**. You do not sign it per project or per key. * The **EU Standard Contractual Clauses (SCCs)** are incorporated into the DPA, so a separate SCC agreement is not required for EU-to-US transfers. The EU contracting party is OpenAI Ireland Ltd. ([source](https://openai.com/policies/data-processing-addendum/)) * A personal OpenAI account cannot execute the DPA, which is another reason to use an organization account. #### Recommended controls * Set a **monthly spend limit** on the OpenAI project to cap cost and contain abuse of a leaked key. * **Name and rotate keys** so you can attribute and revoke access cleanly. * Decide whether your risk profile warrants requesting **ZDR** from OpenAI. * Record AI Chat in your **processing inventory** and assess the need for a **DPIA**. *** ### Troubleshooting | Symptom | Likely cause | Fix | | ------------------------------------------ | ---------------------------------------------------- | ------------------------------------------------------------------------ | | **Validate** fails immediately | Wrong key, key revoked, or pasted with extra spaces | Re-copy the key from the OpenAI platform and paste again | | Validate succeeds but chat returns errors | No billing or out of credits on the OpenAI account | Add a payment method or credits under OpenAI **Settings → Billing** | | Used a key from **User API Keys (Legacy)** | Legacy key type | Create a new key under **Project API Keys** instead | | Chat works, then stops | Key rotated or deleted in OpenAI, or spend limit hit | Paste a current key and revalidate, then check the project's spend limit | *** ### Sources and further reading * [OpenAI: How your data is used to improve model performance](https://openai.com/policies/how-your-data-is-used-to-improve-model-performance/) * [OpenAI: Data controls in the API platform](https://platform.openai.com/docs/guides/your-data) * [OpenAI: Enterprise privacy](https://openai.com/enterprise-privacy/) * [OpenAI: Data Processing Addendum](https://openai.com/policies/data-processing-addendum/) * [OpenAI: Security and privacy](https://openai.com/security-and-privacy/) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.bsure.io/user-guides/settings/system/ai-chat/how-to-set-up-openai.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.