Every prompt you send to a generative AI tool is data. The loan file you pasted in for summarization, the customer dispute you asked it to rephrase, the vendor contract you wanted reviewed — by default, most providers keep a copy for a while. For a casual user that’s a footnote. For a community bank, a credit union, or a regional lender, it’s the whole ballgame.
That’s the problem Zero Data Retention (ZDR) is built to solve. It has quietly become one of the most requested features in enterprise AI procurement — and one of the most misunderstood. Below is a plain-English look at what it is, how it actually works, which tools offer it, and the honest answer to the question that matters most: does it help?
What zero retention actually means
Under a normal arrangement, when you send a prompt to an AI provider, the inputs and outputs get logged and stored for some period — often up to 30 days — mostly so the provider can monitor for abuse, debug problems, and meet legal obligations.
ZDR removes the storage step. With it enabled, your prompts and the model’s responses are processed in memory just long enough to generate an answer, then discarded. Nothing is written to disk at rest. There’s no log to subpoena, no record for an employee to review, and nothing sitting in a database waiting to be breached.
A useful mental model: ZDR is a superset of “don’t train on my data.” Every serious provider already promises not to train on business API traffic. ZDR goes further and says the data isn’t kept at all. So a tool can disallow training without offering ZDR — but true ZDR always implies no training use.
One boundary worth stating plainly: ZDR is an enterprise feature, not a consumer one. It does not apply to free or consumer-tier apps like standard ChatGPT, Claude, or Gemini. If a staff member is typing into a consumer chatbot, there is no ZDR, no matter what toggles they flip.
How it works under the hood
ZDR is part policy, part plumbing. Three things have to be true for it to be real.
Ephemeral processing
The request hits an endpoint configured so that prompt context and output live only in volatile memory and are flushed the moment the task completes. In agentic systems, session state and any retrieved context are injected into working memory and discarded — never cached.
No human review
Standard abuse-monitoring pipelines often route flagged content to human reviewers. Under ZDR, the content itself is excluded from those logs, so no reviewer ever sees it. Automated checks may still run on metadata.
A contractual backbone
ZDR is almost never a self-service checkbox. It’s negotiated through an enterprise agreement, a data processing addendum, or a sales-approved exception, and the technical enforcement follows from that contract. This is why “just turn on ZDR” rarely works as a quick toggle — eligibility and approval gate it.
The critical nuance: “zero” is rarely truly zero. Most providers still keep the result of a safety classifier (a pass/fail flag) and reserve the right to retain data when legally compelled or when a session is flagged for a serious violation. ZDR means “we don’t keep your content” — not “we keep literally nothing.”
— The Prompt Lifecycle
Standard
Retention
Prompt
Input
Process
Model runs
Response
Output
Stored
~30 days · logs
Zero Data
Retention
Prompt
Input
In-memory
Volatile only
Response
Output
Flushed
Nothing at rest
The difference is the last column. Both paths process a prompt and return a response — but under ZDR the content lives only in volatile memory and is flushed when the task completes, with no log, disk copy, or human review. Only a pass/fail safety-classifier flag may survive.
Which tools really offer it
ZDR availability clusters around the API and enterprise tiers of the major providers. Here’s where things stand.
Anthropic — Claude
Offered to eligible enterprise API customers, subject to approval. Inputs and outputs aren’t stored at rest after the response returns, except to comply with law or combat misuse. Applies to the API and products on a commercial org API key (including Claude Code). Sharp edges: excludes beta products, the Console Workbench, and consumer tiers; files uploaded via the Files API persist until deleted; safety-classifier results are still kept, and flagged sessions can be held up to two years. Standard (non-ZDR) API retention was cut to seven days in September 2025 — already among the tighter defaults.
OpenAI
By default, the API retains inputs and outputs for up to 30 days for abuse monitoring; API, Enterprise, and Team data isn’t used for training. ZDR is available for eligible endpoints with a qualifying use case, requested through sales rather than a portal. With ZDR on, content isn’t stored, logged, or seen by human reviewers. Consumer ChatGPT (Free / Plus) is out of scope. Some features, like web search, may not be covered by the same agreement.
Microsoft Azure OpenAI
Offers both Modified Abuse Monitoring (no human review, no abuse-log store) and full ZDR (nothing stored beyond in-memory processing). Both require approval and are limited to Enterprise Agreement or Microsoft Customer Agreement customers — not pay-as-you-go. You apply through the Limited Access program and deploy to a dedicated resource; it is explicitly not a portal switch.
Google Vertex AI — Gemini and others
ZDR is available on certain endpoints, but Google frames it as something you achieve by closing gaps: request an exception to abuse-monitoring prompt logging, avoid Grounding with Google Search (it stores data for 30 days with no opt-out — use Web Grounding for Enterprise instead), and keep Session Resumption off (it caches data for up to 24 hours). Consumer Gemini retains conversations for 18 months by default.
AWS Bedrock
Strict by default: prompts and responses aren’t stored, and content isn’t used to train the underlying models. Abuse monitoring runs inline, retaining only the pass/fail result rather than the underlying data. For many AWS-native teams this default behavior already approaches what they’d negotiate as ZDR elsewhere.
Gateways & enterprise assistants
AI gateways (e.g., Vercel’s) negotiate ZDR agreements across providers and enforce it team-wide or per request, routing only to compliant endpoints — compliance as infrastructure rather than per-call code. On the application side, assistants like Salesforce’s Einstein Trust Layer and Microsoft Copilot build ZDR-style guarantees into their architecture, processing prompts and outputs without persisting them at the model layer.
Six questions to put to any vendor
ZDR claims vary widely in what they actually cover. Run a prospective provider through these before you treat their guarantee as real.
Is it contractual or best-effort?
A marketing page is not a commitment — get ZDR written into the agreement or data processing addendum.
Which endpoints does it cover?
Confirm it applies to the exact APIs and products you use — not just the flagship model, and never the consumer app.
What’s explicitly excluded?
Watch for carve-outs: file storage, prompt caching, search grounding, and session resumption can each break the guarantee.
How long is flagged content retained?
Sessions tripped by safety classifiers are often kept far longer — ask for the number, in writing.
Where is data processed and stored?
Confirm the regions and whether any third parties touch it, for GDPR and examiner expectations.
What survives a legal hold?
Understand how a preservation order would change retention, and what the provider would be compelled to keep.
Where it isn’t on offer
Just as important as knowing who offers ZDR is knowing where it simply isn’t available — and where marketing language about privacy stops short of a real retention guarantee.
DeepSeek — No ZDR
Does not offer zero data retention, including to enterprise customers. Inputs are retained after processing — the policy permits storage for up to 30 days for abuse detection — data is hosted on servers in China, and the terms allow sharing with third parties such as advertising partners. There is no mechanism for instant data removal after processing. For institutions handling regulated financial or personal data, this is the opposite of what ZDR requires and a poor fit for GDPR or HIPAA obligations.
xAI — Grok — No standing guarantee
No clearly published, standing ZDR tier. Consumer plans (Basic, SuperGrok) train on your interactions by default, and logged-out use of grok.com from outside the EU and UK offers no opt-out at all. The Business and Enterprise tiers market “no training on your data” but still permit use of de-identified usage data for product improvement; xAI indicates business associate agreements and ZDR may be available case-by-case rather than as a defined offering. A 2025 incident in which hundreds of thousands of Grok chats were accidentally exposed to search engines underscores the gap between intent and guarantee.
Consumer & free tiers — Out of scope
ZDR is never available on free or consumer plans, regardless of how strong the vendor’s enterprise story is. Standard ChatGPT (Free / Plus) retains conversations by default, consumer Gemini keeps them for up to 18 months, and Meta AI and consumer Copilot offer no ZDR path. The protection lives exclusively inside enterprise agreements and API contracts — the same brand name does not carry it across to the consumer app.
A note on self-hosted open models
Open-weight models — Llama, Mistral, DeepSeek, Qwen — sit in a different category. Run them on your own infrastructure and the vendor-retention question disappears entirely, because nothing leaves your environment; “ZDR” isn’t a feature you buy, it’s a property of where the model runs. But the moment you call one of these models through a hosted API, you inherit that host’s retention policy — so “we use an open model” is not, by itself, a privacy guarantee.
Does it actually help?
Mostly yes — with real limits that matter. Treating ZDR as a blanket privacy shield is the common, costly mistake.
Where it helps — genuine protection
ZDR meaningfully shrinks your attack surface and legal exposure. Content a provider never stores can’t leak in a breach of that provider, can’t be reviewed by their staff, and can’t be produced in discovery against them.
For regulated data — customer financial records, regulated personal data, anything under examiner scrutiny — it’s often the difference between being able to use a cloud AI tool at all and not.
A 2025 court order forced one major provider to preserve user data indefinitely during litigation, overriding its deletion policy — yet data under ZDR was exempt, because there was nothing stored to preserve. The protection working exactly as advertised.
Where it doesn’t — real limits
It doesn’t override the law. A provider legally compelled to retain or hand over data will — and an aggressive legal hold could suspend ZDR going forward. It’s also a poor fit where regulation requires you to keep records, not destroy them.
It rarely means truly zero: safety-classifier results usually persist, and flagged content can be retained. Bolt on file storage, prompt caching, or search grounding and you can punch a hole straight through the guarantee.
It only covers what the contract covers. ZDR on the API does not extend to the consumer app or a beta feature — a gap where teams get surprised.
— The bottom line
Zero Data Retention is a strong, legitimate control — arguably the highest level of data privacy commercially available from a SaaS AI provider today. For any institution handling sensitive or regulated information, it belongs in the security strategy: negotiated explicitly and verified against the specific endpoints and features you actually use. But its value comes from understanding the carve-outs. Read the fine print, map it to the exact products your team touches, and keep the oldest rule in view: when in doubt, don’t put the sensitive thing into the prompt at all.
