What Is Zero Data Retention (ZDR)?

How it works

When you send a prompt to an AI service, the provider often keeps a copy of the prompt and the response for a while. Reasons include showing you your chat history, investigating misuse, and troubleshooting. Under ZDR, the provider still receives and processes your request and returns the answer, but it does not save the prompt or the output to lasting storage. Some providers may still hold data briefly in memory, for example to speed up repeated requests, and many keep a few stated exceptions, covered below.

ZDR is usually set for a whole account, organization, or project rather than chosen chat by chat, so check exactly which ones it covers. It is most often available on enterprise plans or for companies that connect to a model through an API (a way for their own software to send requests straight to the model).

Keep two related promises separate. A no-training commitment means your data won’t be used to improve the provider’s models. Zero data retention means your prompts and outputs aren’t stored after processing. A provider can offer the first without the second, so “we don’t train on your data” does not mean nothing is stored.

What ZDR may not cover

ZDR sounds absolute, but the details vary by provider and plan. Check the fine print for these common gaps:

• Features that need stored data. Saved conversation history, uploaded files, memory features that remember details across chats, and some jobs that run in the background or in bulk depend on keeping data. Under ZDR these may be unavailable or covered by separate terms.
• Built-in tools and connectors. Features such as web search, or connectors that send data to other services, may follow different retention rules, even on a ZDR account.
• Stated exceptions. Some providers reserve the right to keep certain data, for example when the law requires it or when a request is flagged for possible abuse.
• Account and usage records. Request counts, timestamps, and safety-check results may still be kept even when prompt content is not.
• Other companies in the chain. If you buy an AI app built on another company’s model, ZDR at one layer does not automatically apply to the other.
• Your own systems. Your applications, logging tools, or an AI gateway may record prompts and responses on your side.
• People using other accounts. ZDR covers only the accounts under your agreement. A staff member pasting client data into a personal chatbot account is outside it, which is a shadow AI problem.

How to confirm it

Don’t rely on a sales slide, an FAQ, or a line on a pricing page. Confirm ZDR in three places: the contract, the data processing terms (often called a data processing agreement or addendum), and the provider’s own documentation. If they disagree, ask which one governs.

Questions worth getting answered in writing:

• Is ZDR active on every account and project we use, and how can we verify it?
• Which products, features, and API services does it cover, and which does it exclude?
• What exceptions allow the provider to keep data, and for how long?
• Does the commitment extend to subprocessors (other companies that handle your data on the provider’s behalf), including any AI model provider the vendor uses?
• Will turning on a new feature later change what is stored?

Recheck at renewal and whenever you add a new AI feature, since provider terms and product features change over time.

Where ZDR fits in your AI policy

ZDR is one item on a broader enterprise-grade AI checklist, alongside access controls, audit logs, security certifications, and admin settings. It addresses one specific risk: copies of sensitive data sitting on a provider’s systems after the work is done.

It does not stop people from entering information they shouldn’t, check whether outputs are accurate, or replace AI guardrails that limit what an AI system can say or do. On its own, it does not make a tool compliant with any particular regulation; your legal or compliance team still needs to review the full setup. It also does not remove your own record-keeping duties. In regulated industries, you may be required to keep some client communications yourself, including AI-drafted messages, so pair ZDR at the provider with your own retention policy.

There are trade-offs, too. You may lose chat history or file features, and the provider can’t look up a past request if you report a problem. You might require ZDR for client records, health information, legal matters, or other confidential data, and accept standard retention terms for lower-risk tasks such as drafting public marketing copy.

Further reading

• AI Fluency AssessmentA free assessment of where your business stands on AI adoption, useful background before you decide which AI tools your team may use.
• AI Training & SpeakingExecutive sessions and team training for organizations that want leaders and staff on the same page about using AI at work.