Zero Data Retention (ZDR)¶
Zero Data Retention (ZDR) refers to a bundle of technical controls and contract terms ensuring customer content (prompts, outputs, files) is not stored at rest by a vendor. ZDR is the cornerstone requirement for enterprise adoption of LLMs in regulated sectors (Healthcare, Finance, Government).
Without ZDR, providers may retain data for model training or abuse monitoring (often for up to 30 days).
ZDR is contractual, not cryptographic
No major AI provider gives cryptographic proof that data was not retained. ZDR is a contractual commitment paired with provider-side engineering, not a technically verifiable enforcement mechanism. Self-hosting remains the only path to hard guarantees.
ZDR Postures by Provider¶
Providers take fundamentally different approaches to data retention.
| Provider | Default Retention | ZDR Mechanism | How to Enable | Compliance |
|---|---|---|---|---|
| AWS Bedrock | None (ZDR default) | Default | No action needed | SOC 2, HIPAA, FedRAMP |
| Fireworks AI | None (ZDR default) | Default | No action needed | SOC 2, HIPAA |
| OpenAI | 30 days (abuse monitoring logs) | ZDR / Modified Abuse Monitoring (MAM) | Sales approval → org/project data controls | SOC 2 |
| Anthropic | Conversation content not retained by default; 30 days for Covered Models; flagged content up to 2 years | ZDR arrangement (per-organization) | Sales / account team | SOC 2, HIPAA-ready BAA |
| Google Vertex AI | 24h cache | Abuse monitoring exception | Support request / invoiced billing | SOC 2, HIPAA, ISO 27001 |
| Azure OpenAI | 30 days (abuse) | Modified Abuse Monitoring opt-out (Limited Access program) | Support ticket (managed EA/MCA required); verify ContentLogging: false |
SOC 2, HIPAA, FedRAMP |
| Groq | 30 days | ZDR toggle | Dashboard Data Controls | SOC 2 |
The June 2026 Covered-Models Shift¶
Anthropic introduced a significant carve-out effective June 9, 2026: Claude Fable 5 and Claude Mythos 5 are designated Covered Models and require 30-day data retention. ZDR is not available for these models on any platform where they are offered — including Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry (retained data stays inside the cloud provider's environment on those platforms).
Operational consequences for ZDR organizations:
- API requests to a Covered Model from an organization whose retention configuration does not meet the 30-day requirement fail with a
400 invalid_request_error. - Organizations can scope the trade-off per workspace: enable 30-day retention on one designated workspace (Claude Console > Settings > Workspaces > Privacy controls) to use Covered Models there, while all other workspaces keep ZDR.
- On Azure, ZDR-configured organizations need a separate subscription to access these models.
This is a bellwether: safety-driven retention requirements on frontier models may erode the assumption that "newest model + ZDR" is always achievable. Architecture reviews should pin model IDs with retention posture in mind.
Feature-Level ZDR Caveats¶
A provider-level ZDR agreement does not blanket every endpoint. Notable exclusions:
Anthropic (Claude API)
- ZDR covers the Messages and Token Counting APIs, plus Claude Code via Commercial API keys or Claude Enterprise.
- Stateful features fall outside ZDR: Batch API (29-day retention), Files API (retained until deleted), code execution containers (up to 30 days), Agent Skills, MCP connector, Managed Agents sessions.
- Structured outputs are "ZDR-qualified": prompts/outputs are not stored, but compiled JSON schemas are cached up to 24 hours.
- CORS is not supported for ZDR organizations — browser apps must proxy through a backend.
- Usage Policy violations: flagged inputs/outputs may be retained up to 2 years even under ZDR.
OpenAI
- ZDR/MAM requires prior approval and is configured per organization or project — it is not a self-serve toggle.
- The Videos API is blocked for ZDR/MAM organizations; image generation is ZDR-compatible only for
gpt-image-*models (not DALL·E 2/3). - CSAM classifier hits are retained for manual review regardless of ZDR/MAM.
- Extended prompt caching is not ZDR-eligible (KV tensors are stored as application state).
Evaluation and Impact¶
ZDR eliminates provider-side risks, ensuring no training data leakage or third-party employee access. However, ZDR alone is not enough; it must be paired with proxy-based PII redaction and secure self-hosted environments for maximum security. For organizations with extreme privacy needs, self-hosting open-weight models (e.g., Llama 4, DeepSeek, Qwen3) remains the only fully trusted path.
Two 2026 developments change the evaluation calculus:
- HIPAA no longer requires ZDR at Anthropic. HIPAA-ready API access (signed BAA + HIPAA-enabled organization) replaces the old "enable ZDR for HIPAA" guidance and unlocks more features because data can be retained with safeguards instead of deleted immediately.
- Frontier-model access and ZDR are diverging (see Covered Models above). Teams must now choose between the newest models and strict no-retention postures, or segregate workloads by workspace.
Sources¶
- Zero Data Retention (ZDR) for LLM Providers — Comprehensive guide to keeping data private when using LLM APIs.
- Anthropic — API and data retention — Official ZDR scope, Covered Models requirements, HIPAA readiness, and per-feature eligibility table. Retrieved 2026-07-07.
- OpenAI — Data controls in the OpenAI platform — Official abuse-monitoring retention, ZDR/MAM approval flow, and endpoint eligibility. Retrieved 2026-07-07.
- Anthropic Privacy Center — ZDR agreement product scope — Which products a ZDR arrangement applies to.
Questions¶
- TBD — How do emerging open-weight reasoning models (like DeepSeek-R1) change the break-even math for self-hosting versus relying on ZDR cloud APIs?
- TBD — What are the performance impacts of strict proxy-based PII redaction on RAG latency?
- TBD — Will other frontier labs follow Anthropic's Covered-Models pattern and tie safety monitoring to mandatory retention windows on their strongest models?