Zero Data Retention (ZDR)

Zero data retention (ZDR) is an arrangement in which an AI vendor processes your prompts and outputs in memory to serve the request and then stores nothing — no prompt logs, no completions, no copies kept on disk once the response is returned. It is one of the first questions an enterprise security reviewer asks when a team wants to send customer data through a third-party model API, because the default on most consumer-tier AI products is the opposite: requests are retained for a window (thirty days is a common figure) for abuse monitoring, and sometimes longer. Read the specific claim carefully, because "zero retention" is used loosely. The strong version means the provider never writes your content to durable storage at all. The weaker and more common version means the provider retains for a short abuse-monitoring window and deletes on a schedule — which is not zero, and matters if your obligation is that the content never lands in a particular jurisdiction. A third version applies ZDR to the model API only, while the surrounding product — the chat interface, the evaluation dashboard, the support tooling — still logs conversations. Checks worth making before you sign: is ZDR the default on your plan or an option that must be enabled per workspace or per API key; does it cover uploaded files and images as well as text; is it written into the data processing agreement rather than a marketing page; and does turning it on disable capabilities you actually need, because prompt caching, batch processing, fine-tuning and usage analytics frequently depend on retention to function. Note also that retention and training are separate commitments: a vendor can hold your data for thirty days and never train on it, or hold nothing and still have trained on an earlier corpus.