Zero Data Retention for LLMs: What Providers Keep

Zero data retention (ZDR) is not a default setting. It is a term you request, get approved for, and then verify.

By default, most major LLM providers keep your prompts and outputs for some period, often around 30 days, mainly for abuse monitoring. ZDR changes that. It also has exceptions that you should read before you promise a client “nothing is stored.”

Provider terms change. Treat the table below as a starting point for your questions, not as legal advice, and re-check each page on the day you sign.

What zero data retention for an LLM means and does not mean

What it means. The provider does not store your prompts and responses at rest after the request is processed. OpenAI’s description of its program is aimed at eligible API customers, which tells you the first thing to know: ZDR is something you qualify for, not something you switch on.

What it does not mean:

• Not “the data never leaves your network.” The request still travels to the provider and is processed there, in memory.
• Not “no logs anywhere.” Your own gateway, cloud account, and observability tools may log everything. Metadata such as timestamps, token counts, and error codes often persists.
• Not “no exceptions.” Providers carve out flagged content and legal holds. More on that below.
• Not the same as “not used for training.” Many providers say they do not train on API or business data by default. OpenAI’s enterprise privacy page (updated January 8, 2026) says exactly that, and also says it may retain API inputs and outputs for up to 30 days. Those are two separate promises: no training, and limited retention. ZDR is a third, stricter one.
• Not the same as data residency. Residency is about where data is processed or stored. ZDR is about whether it is stored at all. You can have either without the other.

If you want more on the geography side, see data sovereignty for AI agents.

Default retention by provider type

Here is what I could confirm from provider pages. Each source is linked. Where a page showed no date, I say so.

Provider	Default retention	Abuse monitoring	How to get ZDR or similar	Watch for
OpenAI API	Up to 30 days for API inputs and outputs, per its enterprise privacy page	Logs are generated to identify abuse	ZDR for eligible endpoints with a qualifying use case; the data controls guide (no date shown) says these controls need prior approval	Some features keep state on purpose; flagged image content can be retained
Azure OpenAI (Models sold by Azure)	No fixed number on the current pages I read; set by abuse monitoring status	Automated review, with human review in some cases	Apply for modified abuse monitoring through Limited Access	Stateful features create their own data stores
Anthropic API	Deleted within 30 days of receipt or generation, per its privacy center (dated July 1, 2026)	Flagged content can be kept longer	Zero data retention agreement	Flagged inputs and outputs up to 2 years; services like the Files API keep data longer
AWS Bedrock	Docs say model providers have no access to prompts or completions	Check AWS terms	Ask AWS in writing what is stored and for how long	The docs I read say less about AWS-side retention than the others do
Other hosted providers	Ask	Ask	Ask	Same four questions apply

Three notes on that table.

OpenAI. Under ZDR, per the data controls guide, the store parameter on the Responses and Chat Completions endpoints is treated as false. It also lists data that exists on purpose even in normal use: for example, Responses API application state for 30 days by default, background mode data for about 10 minutes, and audio output state for 1 hour. If your agent uses those features, ZDR and “stateless” are different questions.

Azure. Microsoft’s data privacy page (ms.date May 2026) says prompts and responses are processed in the customer-specified geography unless you use a Global or DataZone deployment, and that features such as the Responses API create a data store to persist message history. Interesting note on how wording moves: in early 2025, a community question on Microsoft Learn pointed out that an explicit “30 days” line had disappeared from the privacy page. The community answer said prompts are kept 30 days for abuse monitoring unless the customer is approved for modified abuse monitoring. That was a community answer, not a contract. It is a good reason to get the number in writing instead of relying on a doc page.

Bedrock. AWS documentation says that because model providers do not have access to the relevant accounts, they do not have access to Bedrock logs or to customer prompts and completions. That is a statement about who can see data. It is not a full retention schedule. Ask for one.

Abuse monitoring exceptions

This is the section most buyers skip, and it is where ZDR claims get tested.

Abuse monitoring is why providers keep data at all. The typical pattern:

1. By default, content may be retained for a period to detect misuse.
2. Content flagged by classifiers can be reviewed, sometimes by humans.
3. Approved customers can opt out of that retention.
4. Flagged content may still be kept, even for approved customers.

Microsoft’s abuse monitoring page (ms.date May 2026) describes automated review first, then human review in some cases by authorized Microsoft employees, with just-in-time access approval. For models deployed in the EEA, those employees are in the EEA. Human review does not happen if the customer is approved for modified abuse monitoring. Customers apply through a Limited Access form.

Anthropic’s privacy center lists exceptions to its 30-day deletion: services with longer retention under your control (such as the Files API), agreements that say otherwise (a ZDR agreement), retention needed to enforce its Usage Policy, and legal requirements. If a chat or session is flagged by automated systems as violating the policy, it says inputs and outputs may be kept up to 2 years and safety classification scores up to 7 years.

OpenAI’s data controls guide says that image and file inputs are scanned for CSAM, and flagged images are retained for manual review even with ZDR or modified abuse monitoring on.

None of that is sinister. Providers have legal duties. But it means “zero” really means “zero, except flagged content and legal holds.” Say that in your own customer documents. Do not write “no data is ever stored.”

What to request in writing

A doc page can change. A signed term or a written confirmation from your account team is stronger. Ask for these:

1. The ZDR scope. Which endpoints, models, and features are covered, by name. Which are not.
2. The abuse monitoring status. Is abuse monitoring data stored for your account? For how long? Is there human review? Is it off for your subscription?
3. The exceptions. In writing, list flagged-content retention, legal holds, and any metadata kept.
4. Stateful features. Whether threads, stored responses, files, caches, background jobs, and fine-tuning data are covered, and what their retention is.
5. Training. A statement that your data is not used to train or improve models.
6. Subprocessors and access. Who can access data, from which locations, under what approval.
7. Region. Where processing happens, and whether data can move between regions “for operational purposes.” Azure’s page uses that phrase, which is worth noticing.
8. Change notice. How much notice you get before retention terms change, and your right to exit.
9. Deletion. How and when deletion happens for anything that is stored, and how you get proof.
10. Incident duties. Notice windows if retained data is exposed.

Put the answer in the contract, a data processing addendum, or at least a written reply from your account manager with a date on it.

Regional processing and residency

Retention and residency are separate questions. Ask both.

• Where is the request processed? Azure’s privacy page says prompts and responses are processed in your chosen geography, but not for Global or DataZone deployment types, and may be processed between regions within a geography for operational reasons such as capacity.
• Where is stored data kept? Azure says data stored at rest for features like the Responses API stays in the customer’s chosen geography.
• Does a “global” endpoint change the answer? Often yes. Global routing can serve a request from any region. If you have a residency requirement, pick the regional option and confirm it in writing.

For regulated work, residency and retention both feed the same checklist. See the HIPAA and SOC 2 checklist for AI agents. If neither retention nor residency terms are acceptable, the alternative is to run the model inside your own cloud or weigh self-hosting.

Verification steps

You cannot audit a provider’s disk. You can check what is checkable.

1. Read the settings on your own resource. On Azure, Microsoft’s page describes checking whether abuse-monitoring storage is off: open the resource’s JSON view in the portal and look for the ContentLogging capability set to false, or run az cognitiveservices account show and read the same value.
2. Test the stateful paths. Send a request with a unique marker string. Then try to retrieve it through any list, get, or thread endpoint. If you can fetch it later, something stored it.
3. Check your own logs. Many “retention” problems are yours. Review gateway logs, tracing tools, vector stores, and error trackers for prompt text. Redact or turn off body logging.
4. Get the confirmation letter. Ask the provider to confirm your ZDR status for your account or org ID, in writing, with a date.
5. Re-check on a schedule. Terms change. Calendar a quarterly review, and a recheck whenever you adopt a new feature or model.
6. Review the provider’s attestation reports (such as SOC 2) under NDA, and ask which controls cover retention.

I’d treat step 2 as mandatory for any agent that handles regulated data.

Contract checklist

Print this and take it to the vendor call.

• ZDR scope lists endpoints, models, and features by name.
• Abuse monitoring: retention and human review status stated for my account.
• Exceptions listed: flagged content, legal holds, metadata.
• Stateful features (files, threads, stored responses, caching, batch) addressed one by one.
• No training on my data, stated in the contract.
• Processing region and storage region named; “global” routing disabled if needed.
• Subprocessors and access controls described.
• Notice period for retention-term changes, plus an exit right.
• Deletion process and proof.
• Written confirmation of my account’s ZDR status, with a date.
• My own logs, traces, and caches audited for prompt text.

Bottom Line

ZDR is a negotiated term with exceptions, not a toggle.

Get scope, exceptions, and stateful features in writing. Then test it yourself with a marker string.

Next step: send the ten questions above to each provider you use this week.

FAQ

What does zero data retention mean? It means the provider does not store your prompts and responses at rest after processing the request. It does not mean your own systems store nothing, and it usually has exceptions such as flagged content and legal holds. Confirm the exact scope in your agreement.

What do providers keep by default? It varies. OpenAI’s enterprise privacy page says it may retain API inputs and outputs for up to 30 days. Anthropic’s privacy center says it deletes API inputs and outputs within 30 days, with exceptions. Azure uses abuse monitoring settings you can change by application. Always confirm the current number with the provider.

How do I get ZDR in writing? Ask your account team for ZDR or modified abuse monitoring and request a written confirmation for your org or subscription. Add a contract clause that lists covered endpoints, exceptions, and a notice period for changes. A doc page alone is not a commitment.

Does ZDR cover logs and abuse monitoring? Often it covers abuse monitoring logs, but not always every log, and flagged content can still be kept. OpenAI’s guide, for example, says flagged images may be retained even with ZDR. Ask about logs, metadata, and human review separately.

How do I verify it? Check the settings on your own resource where possible. On Azure that means the ContentLogging value. Then run a marker-string test through every stateful endpoint, audit your own logs, and get a dated written confirmation from the provider.

Three Ways to Work With TMA

Need an agent built? We deploy production AI agents in your infrastructure. Working pilot. Real data. Measurable ROI. → Schedule Demo

Want to co-build a product? We’re not a dev agency. We’re co-builders. Shared cost. Shared upside. → Partner with Us

Want to join the Guild? Ship pilots, earn bounties, share profit. Community + equity + path to exit. → Become an AI Architect