Zero Data Retention (ZDR)

What is zero data retention?

Zero data retention (ZDR) is a promise from an AI provider that it will not store the prompts you send or the answers it returns once a request is done. The data is used to produce the answer and is then dropped.

It is different from a promise not to train. A provider can promise never to train on your data and still keep it for weeks. ZDR is about storage, not training. Vercel's AI Gateway documentation puts it simply: ZDR is "a superset of disallowing prompt training," because data that is never kept cannot be trained on.

ZDR matters most when the provider sits behind another vendor. Many SaaS tools send your data to a model provider to power their AI features. Whether that provider keeps the data depends on the deal your vendor has with it, not on anything you signed.

ZDR is often a special arrangement, not the default

For some providers, ZDR is something a customer has to request and be approved for. OpenAI's API data controls page says customers must be approved before ZDR is turned on. Its business data page says "qualifying organizations" can set how long OpenAI keeps business data, including zero data retention on the API platform.

Some routing services offer it by plan. Vercel says its AI Gateway offers ZDR to Pro and Enterprise users, and only routes those requests to providers it has ZDR agreements with.

What it looks like in a vendor's terms

A typical clause reads like this:

Our AI providers operate under zero data retention: they do not store your Inputs or Outputs after processing. This does not apply to features that save content by design, to content flagged for possible misuse, or where retention is required by law.

• "Our AI providers" means the promise is about the providers behind your vendor. Ask which ones, and check your vendor's subprocessor list.
• "Features that save content by design" covers things like chat history, stored files or saved assistants. Those cannot work if nothing is kept.
• "Content flagged for possible misuse" is the abuse monitoring exception, explained below.
• "Required by law" covers court orders and similar demands.

Real exclusions can be long. OpenAI's API documentation lists endpoints that are not ZDR eligible, including files, vector stores, fine-tuning jobs and batches.

Abuse Monitoring Retention

Abuse monitoring retention is when an AI provider keeps your prompts and answers for a set time so it can look for misuse, such as attempts to create malware or other banned content. It is one reason "zero" retention may not be quite zero.

By default, OpenAI's API data controls page says abuse monitoring logs are kept "for up to 30 days, unless longer retention is required by law." ZDR removes customer content from those logs. Even then, the same page describes a "Safety Retention" practice: for certain models, OpenAI may keep and have people review content its classifiers flag as possibly violating its policies.

Some models do not offer ZDR at all. Vercel's AI Gateway documentation notes one Anthropic model that does not support ZDR on any provider, because "some misuse patterns only become visible across cumulative requests." Its prompts and completions are kept for 30 days, and are not used for training.

When a vendor says it uses ZDR, ask whether abuse monitoring retention still applies, for how long, and whether people at the provider can read flagged content.

A real change we caught

Venpo flagged this change in Anthropic's Service Specific Terms on June 8, 2026: Anthropic can override zero-data-retention rules. The update added a category called Covered Models. For any model Anthropic designates as covered, inputs, outputs and usage data may be kept for safety review, even where a zero data retention commitment exists. So a ZDR arrangement may not cover every model a provider offers.

Why it matters to you

Stored data can be exposed. Every copy of a prompt is something that can be breached, subpoenaed or read. If your team pastes customer records into an AI feature, retention at the provider adds one more place that data lives.

Your promises to customers depend on it. If your DPA or security answers say AI providers keep nothing, you need your vendor's ZDR terms to back that up.

The fine print changes per model and feature. A vendor can add a new model or feature that falls outside ZDR without changing its headline claim. Your data retention picture can shift without anyone telling you.

What to check

• Ask which model providers your vendor uses, and whether each one runs under ZDR for your data.
• Check whether ZDR applies to every AI feature you use, or only some endpoints and models.
• Ask whether abuse monitoring retention still applies, for how many days, and whether flagged content gets human review.
• Check what the provider keeps by design, such as files, chat history or fine-tuning data.
• Ask for the ZDR commitment in your DPA or AI terms, along with notice if a provider or model falls out of it.

How Venpo helps

Venpo watches your vendors' AI terms, privacy policies, DPAs and subprocessor lists, and emails you when a retention promise is narrowed or a new AI provider appears. The Fine Print Scan answers, for each vendor, how long it keeps your data.