Zero data retention (AI vendor terms)

What is zero data retention?

Zero data retention is an arrangement with an AI provider under which your prompt and the model's answer are not kept once the response has been sent. The text passes through the machine, the answer comes back, and nothing lands in a store you could later be asked to hand over.

The word zero deserves a footnote. Anthropic describes it as not storing inputs or outputs except where needed to comply with law or to combat misuse and harm, and says it still keeps the results of its user safety classifiers so it can enforce its usage policy. The text goes; a score saying the text was acceptable stays. Read any provider's version of the promise with that shape in mind.

It is also not a setting you switch on yourself. At Anthropic and at OpenAI it is granted per organisation after approval, through their sales team rather than a checkbox in the console. Worth knowing before you promise a client something you have not been given yet.

Three questions, three different answers

Most conversations about AI and confidential data collapse three separate questions into one. Each has its own answer and its own place in the contract, and any one of them can be yes while the other two are no.

• Does the provider train on my text? Whether what you type becomes part of a future model. On business and API tiers the major providers say no by default, and it sits in the terms rather than on a marketing page.

• How long does the provider store my text? A provider can promise never to train on a word you send and still hold that word for a month in an abuse monitoring log. This is the one that decides what a breach at your supplier would expose.

• Where is my text processed? Whether the machine doing the work stands in the EU, and which company runs it. That is data residency, and no retention promise touches it.

Zero data retention answers the second question only. A provider can keep nothing at all and still process everything in Virginia.

What the providers say about business use, September 2026

What follows is on the vendors' own pages at the time of writing. Those pages move, so the date is part of the fact.

Anthropic. The commercial terms, effective 17 June 2025, say Anthropic may not train models on customer content from the services. Retention is a separate dial: data on commercial products is kept indefinitely unless a custom period is set, and an owner on an Enterprise plan can set one, with a minimum of thirty days. Zero data retention is the separate arrangement that sits on top of that.

OpenAI. The API documentation says data sent to the API is not used to train or improve models unless you explicitly opt in, and has said so since March 2023. Abuse monitoring logs are still generated for all API usage and kept for up to thirty days, unless the law requires longer. Zero data retention takes your content out of those logs, subject to approval.

Microsoft. The Copilot privacy documentation, updated in August 2026, says prompts, responses and data reached through Microsoft Graph are not used to train foundation models. Your interactions are still stored, as Copilot activity history inside your own tenant, with a retention period you set through Purview. EU traffic stays inside the EU Data Boundary, with one exception worth reading twice: models supplied by Anthropic as a subprocessor currently fall outside it.

The free tier and the paid tier are two different products

Why the tier matters sits on one page of Google's Gemini API terms, effective 23 March 2026, which gives opposite answers depending on the quota you are on.

On the unpaid services, including Google AI Studio and the free quota of the Gemini API, Google uses what you submit and what comes back to provide, improve and develop its products, human reviewers may read it, and the terms tell you outright not to submit sensitive, confidential or personal information. On the paid quota of the same API, with the same models behind it and a key that looks identical, Google does not use your prompts or responses to improve its products, and logs them only briefly to catch breaches of its use policy.

Anthropic's consumer side shows the same split from the retention angle. Free, Pro and Max conversations do not go to training unless you switch model improvement on, and if you do, the material sits de-identified in the training pipelines for up to five years. Delete a chat and it leaves the back end within thirty days. A conversation flagged by the automated safety systems keeps its inputs and outputs for up to two years, and the classification scores for up to seven.

So your negotiated terms protect the account, not the person. Shadow AI is what happens in that gap: half a company pasting client files into a personal account, while the contract you are proud of governs a workspace nobody has logged into since the demo.

Features that cannot run under zero data retention

Zero data retention and server-side state are the same question twice. A feature that remembers something between two calls has to write it down, so it cannot sit inside an arrangement where nothing is written down.

OpenAI puts the split in its documentation. Chat completions, responses, embeddings, image generation, audio transcription, realtime and moderation are eligible. Assistants, threads, vector stores, conversations and ChatKit are not, because they hold application state until you delete it. Anthropic makes the same point about its managed agents on Anthropic-hosted sandboxes: a session stores conversation history, sandbox state and outputs on the server, so it is not currently eligible.

If a feature can answer the question "what did we say yesterday", or hand you back a result you asked for an hour ago, something is being stored on the provider's side. Prompt caching, batch jobs, uploaded files and long agent sessions all sit on that side of the line. So the design question is not whether you want zero data retention, it is which parts of your workflow you are willing to rebuild as calls with no memory.

Getting it into a contract, and what to ask

Under the GDPR you are the controller and the AI provider is a processor, so the arrangement belongs in a written processing agreement and not in a reassuring sentence from an account manager. Article 28(3) says what that agreement has to cover: processing only on your documented instructions, confidentiality from staff, the security measures of Article 32, the conditions for engaging another processor, and deletion or return of all personal data at the end of the service, including existing copies. Retention periods and transfers outside the EU belong in the same document.

Then put these questions to the supplier in writing, and keep the answer.

1. Do you train on our inputs or outputs, on the tier we are actually on? Name the tier, not the company.

2. How long do you store prompts and responses, and where is that written down? A number, and a link to the page it came from.

3. What does abuse monitoring keep, for how long, and can a person read it? This is the retention almost nobody asks about, and the one most likely to be holding your client's text.

4. Which sub-processors touch our data, and how are we told when that list changes? Model providers sit underneath products you already pay for.

5. In which region does inference run, and is that a commitment or a default setting? Regions can shift under load unless the contract says they cannot.

6. What happens on deletion, and how long does a backup keep a copy? Gone from the screen and gone from storage are two different dates.

7. If zero data retention is available, which features do we lose? Ask before you build, because the answer decides your architecture.