Summarize this article with:

summary

ZDR is not the same as “no training on your data.” A provider can exclude your data from model training while still storing prompts, files, and outputs in logs for days or weeks.
Default AI API retention creates vendor-side risk. Stored prompts and outputs can increase breach, subpoena, and compliance exposure, especially for legal, healthcare, finance, and HR use cases.
Data minimization is required, but not enough. You can remove unnecessary personal data before the API call, but you still need ZDR to control what the vendor retains after processing.
ZDR must be verified contractually. Check the DPA or MSA for covered endpoints, models, retention window, inputs and outputs, error logs, retries, and subcontractors.

A healthcare software company connects an AI API to summarize patient support tickets. The integration works well, response quality is strong, and engineers move fast. Only later does the compliance team realize that every prompt and output may have been stored by the provider for 30 days.

That is the core issue with Zero Data Retention for AI APIs. For teams working under GDPR, HIPAA, SOC 2, ISO 27001, or internal data protection requirements, understanding how AI API data is stored is now a production-readiness requirement, not just a legal detail.

This article explains what Zero Data Retention for AI APIs means, why it matters for enterprise and regulated use cases, how it differs from “no model training,” what it protects, what it does not protect, and which technical, legal, and vendor controls you should verify before deploying AI APIs in production.

What is Zero Data Retention (ZDR) in AI APIs?

Zero Data Retention in AI APIs means that the provider processes customer inputs and outputs only to complete the API request, then does not retain that content after the response is returned.

For teams using LLM APIs, generative AI APIs, OCR APIs, speech-to-text APIs, or document processing APIs, this usually applies to sensitive inference data such as prompts, completions, uploaded files, extracted text, embeddings, metadata, and model responses.

At the infrastructure level, Zero Data Retention means the request may pass through the provider’s systems, but it should not be written to persistent storage. In practice, this means:

No raw prompts stored in application logs
No uploaded files saved in object storage
No model outputs stored in databases
No customer data reused in analytics, evaluation, fine-tuning, or training pipelines

This is why “processed in-memory only” should not be misunderstood. It does not mean the vendor never handles the data. It means the data is handled temporarily for request execution and should not persist afterward. For regulated or security-sensitive use cases, this difference matters because retained prompts, files, or outputs can still create compliance, confidentiality, and breach risks, even if the provider does not use that data to train models.

ZDR is also different from “no training on your data.” A provider may commit not to use customer data for model training while still keeping prompts, outputs, files, or metadata for debugging, abuse monitoring, service improvement, or legal compliance.

For companies operating under GDPR, HIPAA, SOC 2, ISO 27001, financial services rules, or internal data protection policies, that retained data can still be a risk that needs to be reviewed before production deployment.

Zero Data Retention only covers the vendor side of the AI API integration. Your own application, backend, proxy, observability stack, error monitoring tools, data warehouse, or customer support system can still log prompts and outputs if configured that way. To enforce ZDR end to end, teams still need internal logging rules, redaction, access controls, data minimization, retention policies, and monitoring of where AI request data flows inside their own infrastructure.

Default Retention	Zero Data Retention
Prompts, files, and outputs may be stored by the provider.	Content is processed temporarily and not persistently stored.
Retention may last days, weeks, or longer.	Content is deleted immediately or within a defined short window.
Data may be excluded from training but still kept in logs.	Content does not enter logs, analytics, evaluation, or training pipelines.
Audit trails may include sensitive request data.	Audit trails rely on metadata instead of raw content.
A breach may expose retained customer data.	Breach impact is reduced because less data remains stored.

What Happens to Your Data Without ZDR

Without ZDR, your AI provider may keep customer data after the API call is complete. For example, OpenAI’s API may retain inputs and outputs for up to 30 days to provide the service and detect abuse.

In practice, this means prompts, uploaded files, and model responses can remain in provider-controlled systems even after your application has received the answer.

Retained data can still create training and model improvement risk

The key question is not only “Does the provider train on our data?” It is also “Can our data be stored, reviewed, evaluated, or reused in any improvement workflow?”

Some providers exclude API data from training by default. Others require a specific enterprise agreement, opt-out setting, or ZDR option. For decision-makers, this means every vendor contract should clearly state whether prompts, files, outputs, feedback, and logs can be used for training, evaluation, fine-tuning, or model improvement.

Stored data increases breach and subpoena exposure

If customer data is stored, it becomes discoverable, accessible, and potentially exposed.

A legal team sending contract clauses to an AI API, a healthcare company processing patient messages, or an HR platform analyzing candidate notes is not just using a model. It may also be creating a temporary copy of sensitive data inside a third-party system. That data can become relevant in a breach, internal access review, legal request, subpoena, or discovery process.

Default retention can conflict with GDPR data minimization

For European companies, default AI API retention can also raise GDPR data minimization questions. GDPR Article 5 requires personal data to be adequate, relevant, and limited to what is necessary for the processing purpose.

If an AI API only needs customer data to generate a response, storing the same prompts, files, or outputs for 30 days may be difficult to justify in regulated use cases. This is especially sensitive when the API processes customer data, employee data, financial records, legal documents, healthcare information, or other personal data.

Serious GDPR infringements can lead to fines of up to €20 million or 4% of global annual turnover, whichever is higher. That does not mean every retention issue creates the same level of risk, but it does mean data retention should be reviewed before AI APIs are deployed in production.

ZDR and Compliance: GDPR, HIPAA, and the EU AI Act

Regulation	Why AI API retention matters	How ZDR helps
GDPR	Personal data should not be stored longer than necessary.	Reduces unnecessary retention of prompts, files, and outputs containing personal data.
HIPAA	PHI handled by vendors and subcontractors can create business associate and breach notification risk.	Limits how much PHI remains inside the AI provider’s environment after processing.
EU AI Act	High-risk AI systems need stronger data governance, traceability, and oversight.	Reduces uncontrolled retention of sensitive operational data in the AI supply chain.

GDPR: ZDR supports storage limitation and privacy by design

ZDR addresses two core GDPR requirements: Article 5(1)(e) on storage limitation and Article 25 on data protection by design and by default. Article 5(1)(e) requires personal data to be kept only as long as necessary, while Article 25 requires systems to minimize personal data exposure by design.

Penalty exposure is material. GDPR infringements can reach €20 million or 4% of global annual turnover, whichever is higher. In 2025, European data protection authorities issued roughly €1.2 billion in GDPR fines.

ZDR helps by ensuring prompts, files, and outputs containing personal data are not retained by the AI vendor after processing.

HIPAA: ZDR reduces PHI exposure in vendor environments

ZDR supports HIPAA controls around protected health information, Business Associate Agreements, and the Breach Notification Rule under 45 CFR §§ 164.400-414.

HIPAA penalties vary by culpability. In 2026, civil penalties range from $145 per violation to $2,190,294 for the most serious willful neglect violations, with annual caps per violation category.

ZDR helps reduce how much PHI remains inside a vendor or subcontractor environment, which lowers breach exposure and simplifies business associate risk review.

EU AI Act: ZDR supports cleaner AI supply chain governance

For high-risk AI systems, ZDR supports Article 10 data governance requirements and broader controls around data quality, traceability, and system oversight.

Penalty exposure under the EU AI Act can reach €35 million or 7% of worldwide annual turnover for prohibited practices, and €15 million or 3% for many other non-compliance cases. The Act entered into force in August 2024, with GPAI obligations applying from August 2025 and most obligations from August 2026.

ZDR helps limit uncontrolled retention of sensitive operational data in the AI supply chain.

If you operate under GDPR, HIPAA, or the EU AI Act, ZDR should not be treated as an optional feature. For regulated AI workloads, it is a procurement baseline.

Zero Data Retention vs. Data Minimization: What's the Difference?

Data minimization and Zero Data Retention solve two different parts of the same risk.

Data minimization is the GDPR principle that requires you to send only the data needed for a specific purpose. In an AI workflow, this means removing unnecessary personal data before the API call: names, IDs, contact details, financial identifiers, or any field the model does not need.

ZDR starts after that. It controls what the AI vendor keeps once the request has been processed. A company can apply strong data minimization and still fail ZDR if the provider stores the prompt, file, or output in logs for 30 days.

This matters in regulated environments because minimized data can still be sensitive. A healthcare company may remove a patient’s name and insurance number before sending a case summary to an LLM. But if that summary still contains symptoms, diagnosis history, or treatment context, it remains sensitive health data. If the API provider retains it, the company still has vendor-side exposure.

The procurement takeaway is simple: do not accept data minimization as a substitute for ZDR. Ask two separate questions: what data do we send, and what does the vendor retain after processing? For enterprise AI, both controls are required.

Criteria	Data Minimization	Zero Data Retention	Standard Retention
Who controls it	Mostly the customer, through application logic and data filtering.	Mostly the vendor, through infrastructure, logging, and retention policy.	The vendor, based on default API terms.
What it covers	What data is collected or sent to the AI API.	What customer content is retained after processing.	Prompts, files, outputs, logs, or metadata retained by default.
When data is deleted	Before the API call, by removing unnecessary fields.	After processing, usually immediately or within a short defined window.	After the vendor’s standard retention period, often days or weeks.
Compliance benefit	Reduces unnecessary data exposure.	Reduces vendor-side storage and breach exposure.	Creates more data persistence and review burden.

How Major AI Providers Handle Zero Data Retention

The pattern is consistent across major providers: ZDR is usually not the default API mode. It often requires a separate approval, enterprise or scale-tier access, and careful endpoint selection.

For procurement, the key question is not “Does this provider offer ZDR?” It is “Which exact models, endpoints, tools, and regions are covered by ZDR in our contract?”

Provider	ZDR Available	How to Access It	Default Retention Period	Limitations
OpenAI	Limited	Prior approval via Sales, then org or project-level data controls.	Abuse monitoring logs are retained up to 30 days by default.	Endpoint-specific. Assistants, files, vector stores, conversations, and some stateful features are not fully ZDR-eligible. Extended prompt caching may store derived KV tensors temporarily.
Anthropic	Limited	Commercial API agreement with ZDR enabled for eligible workspaces.	Conversation content is not retained by default, but some models and features require retention.	ZDR covers selected APIs only. Stateful agents, files, batch processing, code execution, and some models are excluded.
Google Gemini	Limited	Approved ZDR request at project level for paid services.	Paid Gemini API abuse monitoring can retain prompts and outputs for 55 days.	Grounding with Google Search or Maps stores data for 30 days and cannot be disabled.
Mistral	Limited	Scale plan only, after request and approval.	Not clearly stated in the public ZDR help page.	Applies only to stateless API calls. Agents, conversations, files, batch, libraries, and other stateful products are excluded.
Cohere	Limited	Approved ZDR or Model Vault deployment.	SaaS prompts and generations are deleted after 30 days by default.	Some deployment options are waitlisted. Training opt-out and ZDR are separate controls.
Eden AI	Yes	Enforced at gateway level, available through the EU endpoint.	Prompts, files, and outputs are not retained by default.	Depends on EU-compatible provider and model availability. Includes SOC 2, ISO 27001, and GDPR-ready documentation.

How Eden AI Implements Zero Data Retention

Eden AI implements ZDR at the gateway level. Instead of connecting each application directly to every model provider, the enterprise sends AI requests through Eden AI, which applies the retention and routing controls before the request reaches the selected underlying model.

This matters because ZDR is not only a provider feature. It is an enforcement layer across the AI supply chain. Eden AI centralizes how prompts, files, outputs, routing metadata, and provider access are handled, so teams do not need to negotiate and monitor a different retention baseline for every model integration.

Eden AI’s ZDR offer includes:

Data discarded within 24 hours
EU endpoint available for European data residency
No use of customer data for model training
SOC 2 Type II and ISO 27001 certified
GDPR-ready DPA documentation included

The operational advantage is control. Teams get one contract, one audit trail, and one compliance baseline across the AI providers they route through, instead of maintaining separate policies for each provider.

You can review Eden AI’s data compliance documentation at edenai.co/data-compliancy or start with the EU endpoint directly.

How to Verify Your AI API Actually Has Zero Data Retention

ZDR is frequently claimed, rarely verified. Many AI API vendors say they offer Zero Data Retention, but fewer are explicit about which endpoints, models, logs, retries, and subcontractors are actually covered.

Use this checklist during vendor review:

Is ZDR the default, or does it require a separate agreement, approval, or enterprise plan?
Which endpoints, models, tools, and features are covered by ZDR? Which ones are excluded?
Is there a signed DPA or contractual document that explicitly names ZDR and defines the retention window?
How quickly are prompts, files, outputs, and related content purged after processing?
Does ZDR apply to both inputs and outputs, including uploaded files, system prompts, retrieved context, and model responses?
What happens during system errors, failed requests, retries, abuse monitoring, or support debugging? Is customer content logged in those cases?

If a vendor cannot answer all six questions clearly in writing, ZDR is not fully implemented. The website may say “Zero Data Retention,” but the contract and architecture determine the real risk.

FAQs - Zero Data Retention for AI APIs

No. These are separate controls. A vendor can exclude your data from model training while still storing prompts, files, and outputs for debugging, abuse monitoring, or analytics. ZDR means customer content is not stored after processing.

No. It means the AI provider should not log or retain your customer content on its side. Your own application layer, API gateway, reverse proxy, observability tools, or internal logs may still capture prompts and outputs. ZDR is a vendor-side guarantee, not an end-to-end architecture guarantee.

Rarely. Most major providers gate ZDR behind enterprise contracts, manual approval, or dedicated data controls. On standard self-serve API plans, you should assume default retention applies unless your contract says otherwise.

No, ZDR should not reduce model output quality. It can disable features that depend on stored context, caching, or persistent state. For example, extended prompt caching may not be ZDR-eligible, which can affect latency or cost at high volume.

No. ZDR supports GDPR Article 5(1)(e) on storage limitation and Article 25 on data protection by design, but it is not sufficient alone. You still need a lawful basis for processing, a signed DPA, data subject rights management, access controls, and clear internal governance.

Check your contract, not the homepage. Look for explicit ZDR language in the DPA, MSA, or security addendum, including scope, retention window, covered endpoints, and exclusions. If you only have a standard API agreement, ZDR is probably not active.

A private deployment gives you infrastructure isolation, usually through self-hosting, a dedicated cloud environment, or a VPC. ZDR is a retention guarantee inside shared provider infrastructure. Private deployment gives stronger control, while ZDR is usually faster and cheaper to implement.

Yes, if the gateway enforces ZDR at the routing layer. This gives you one contract, one audit trail, and one compliance baseline instead of managing separate ZDR agreements with every model provider. You should still verify that the gateway itself is ZDR-compliant, not only the underlying models. You can review Eden AI’s data compliancy documentation at edenai.co/data-compliancy.

Last updated onJune 16, 2026

Taha Zemmouri

Taha Zemmouri is the CEO and co-founder of Eden AI. With previous experience in AI consulting, he brings a strong business perspective to artificial intelligence and focuses on turning AI capabilities into practical value for companies. With a background in data science and a real entrepreneurial mindset, he combines technical understanding, business vision, and hands-on execution to make AI more accessible and easier to integrate.

Zero Data Retention for AI APIs: What It Is, Why Enterprises Need It, and How to Get It