Zero data retention (ZDR): Zero data retention (ZDR) is an arrangement in which an AI provider does not store your prompts or the model's responses after the request is processed, so nothing is kept for training, debugging, or later review. Mainly offered on API and enterprise plans.
AI providers usually keep a copy of what you send them, at least briefly. Consumer plans may use conversations to improve models unless you opt out. Business and API plans typically promise not to train on your data but still retain it for a limited period, commonly a few weeks to a month, for abuse monitoring and support. Zero data retention goes a step further: the provider processes the request, returns the answer, and discards both, keeping only minimal metadata.
ZDR is a contractual and technical commitment, not a checkbox in a consumer app. Major vendors offer it to qualifying API and enterprise customers, usually after a review of the use case, and it is documented in a data processing agreement. Read that agreement closely. It should say which products and endpoints are covered, whether third-party tools connected to the model are covered, what happens to content caught by safety filters, and how legal holds are handled.
There are tradeoffs. Features that depend on stored state, such as persistent memory, saved threads, or uploaded file libraries, may be unavailable or work differently under ZDR. And ZDR protects data at the vendor; it does nothing about your own logs, the notes tool that captured the output, or the employee who pasted the data in the first place. It is one layer of a privacy setup, not the whole thing.
Example at work
A healthcare billing company wants to use a language model to draft appeal letters from claim records that contain patient information. Before any pilot, its compliance officer requires a signed business associate agreement plus zero data retention on the API account, confirms in writing which endpoints it covers, and limits the workflow to those endpoints.
Why it matters
For anyone handling regulated or client-confidential data, retention terms decide whether an AI tool is usable at all. Knowing the difference between "we do not train on your data" and "we do not keep your data" lets you ask the vendor the right question.
Related terms
- Data privacyData privacy, in the context of AI, is the set of rules and practices that govern what information you put into an AI system, who can see it, how long the vendor keeps it, and whether it is used to train future models.
- Personally identifiable information (PII)Personally identifiable information (PII) is any data that can identify a specific person on its own or in combination with other data, such as a name, address, Social Security number, email, phone number, photo, or account ID.
- Shadow AIShadow AI is the use of AI tools inside an organization without the knowledge or approval of IT, security, or leadership: personal ChatGPT accounts, browser extensions, and AI features quietly switched on inside existing software.
- Workplace AI policyA workplace AI policy is a written set of rules that tells employees which AI tools they may use, what data they may put into them, how to verify and disclose AI-assisted work, and who to ask when unsure.
- API (application programming interface)An API (application programming interface) is a way for one piece of software to talk to another. An AI API lets your own tools, spreadsheets, or automations send a prompt to a model and receive the response, without a person typing in a chat window.