{
  "$type": "site.standard.document",
  "bskyPostRef": {
    "cid": "bafyreiholqiako3c74u3il3boqi4yhuzwqnjh3342wmf6dc4v7ox5d636u",
    "uri": "at://did:plc:lk3jfj3zq4k4wxnk474axylu/app.bsky.feed.post/3mjttzusnx7u2"
  },
  "path": "/t/openai-and-the-reinvention-of-email/1367724#post_5",
  "publishedAt": "2026-04-19T10:46:37.000Z",
  "site": "https://community.openai.com",
  "tags": [
    "openai",
    "API",
    "@PaulBellow",
    "@jeffvpace",
    "@vb",
    "openai-staff",
    "GPT builders"
  ],
  "textContent": "My view: for a European customer/dev, the top setting is not one switch, it is identity separation first.\n\nIf you want the strongest practical baseline, I would choose this order:\n\n  * Separate identity for openai\n\n\n\nUse a dedicated email/account only for OpenAI/dev work. That reduces blast radius, keeps your audit trail cleaner, and makes account recovery/security management easier. OpenAI’s own guidance is to secure the account with strong authentication and to act quickly on suspected compromise.\n\n  * Passkey + MFA before anything else.\n\n\n\nIf passkeys are available on your account, that is the strongest default OpenAI currently documents for sign-in hardening. If not, enable MFA and review sessions/devices regularly.\n\n  * For enterprise/EU governance: Microsoft/Azure is usually the stronger control plane.\n\n\n\nIf your SAP–Azure contract stays, then from a governance/operations angle I would lean toward a Microsoft-managed identity stack for work: Entra/Defender-style enterprise controls, device compliance, logging, and conditional access are simply easier to operationalize in a business environment. That is my architectural judgment, not an OpenAI policy statement.\n\n  * For personal separation/privacy: Proton is a good isolation layer.\n\n\n\nIf the goal (my goal is 100 % that) is to cut Gmail completely out of your OpenAI footprint, a dedicated Proton address for the standalone OpenAI identity is reasonable. The key point is not “Proton vs Microsoft” as ideology; it is do not mix personal, public, and production identities. That part is my practical recommendation.\n\n  * API side: never let convenience break security.\n\n\n\nOpenAI explicitly recommends unique API keys per member, never shipping keys client-side, using environment variables or a key-management service, and monitoring/rotating keys when needed.\n\n  * On the EU point: you’re also right that the EU AI Act creates a heavier builder environment than the US/UK in practice, because it is a directly applicable EU regulation and adds a structured compliance layer for systems placed on the EU market or used in the EU.\n\n\n\nSo my short question and the option would be:\n\nBest EU default identity:\n\ndedicated OpenAI-only identity, passkey/MFA\n\nseparate work vs personal accounts\n\nAzure/Microsoft stack for enterprise control\n\nProton or other strong VPN only want strict standalone separation from Gmail\n\nstrict API key hygiene from day 1\n\nFor me, cybersecurity today is not optional housekeeping, the most important.\n\nThank you @PaulBellow @jeffvpace @vb for your support!\n\nWith this settings maybe could become the company more customers and market there too.\n\nopenai-staff\n\nGPT builders",
  "title": "OpenAI and the reinvention of email"
}