zero data retention (ZDR)

advancedspreading

An agreement in which the AI provider does not store your question and the answer after processing, handling them only for the duration of the response.

In plain terms

When you send a question to an AI service, your text goes to the provider's server. By default, it remains there temporarily as a log, mainly to detect abuse. This lasts from a few days to roughly a month, depending on the provider. With zero data retention, this storage is omitted: the system processes the request, returns the answer, and does not preserve the content.

It is like an interpreter who hears and translates everything at a negotiation but takes no notes and makes no recording. They complete the work, but afterward there is no notebook that anyone could steal or request from them.

It is useful because what is not stored cannot later leak, cannot be reviewed later by the provider's staff, and cannot be handed over upon official request. This is why banks, hospitals, law firms, and administrative bodies primarily request it. It does not offer a full guarantee: the contract may contain exceptions, for instance in cases of suspected abuse or legal obligation.

It is not the same as the promise that your data will not be used to train a model. That only excludes one method of use, whereas zero data retention concerns the storage itself.

How it works

The company specifies in the contract with the provider that zero data retention applies to the account. This is typically requested for business use via a programmatic interface (API), requiring special approval.
The request arrives via an encrypted channel, the model processes it in server memory, and prepares the response.
After the response is sent back, the text of the request and the response is not stored in a permanent log or database. At most, technical data remain, such as the timestamp and the amount used for billing.
Since there is no stored history, the client's own system must preserve the previous conversation and resend it every time. Convenience features based on storage are then partially or entirely unusable.
Compliance is mandated by the contract binding the provider, supported by internal rules and independent audits. You cannot verify this directly from the outside.

An everyday example

A private clinic has an AI generate a summary from medical reports. Before implementation, the data protection officer asks the provider what happens to patient data and signs only a contract that includes zero data retention. Thus, the text of the report does not remain on the provider's servers after the response is generated.

Who is affected

entrepreneur, executiveIf you entrust business secrets or customer data to AI, the data retention clause in the contract determines the risk you take.

developerIf you build an AI agent or coding agent, you must handle the storage of conversation history yourself and know which functions do not work without storage. → Code

patient, doctorHealth data is particularly sensitive, so it matters greatly whether a copy remains with the AI service provider. → Health

lawyer, citizenThe principle of zero data retention implements two core GDPR principles, data minimization and storage limitation, in one of the strictest ways in practice. → Law

A common misconception

MythWith zero data retention, my data never reaches the provider, so I can enter anything without worry.

In realityThe data still goes to the provider's server and is processed there; it is just not stored afterward. The risk in transmission and processing remains, and the no-storage promise does not cover copies on your side either.

Limits and risks

This generally does not apply to consumer chat applications: there your conversation history is stored, and zero data retention is typically a separate business agreement.
It means different things for different providers, and there can be exceptions, such as in cases of legal obligation or suspicion of abuse. Always check the exact wording of the contract.
Only applies to the provider: your company's own systems, intermediary applications, and external tools used by the agent may still store the data.
Without stored logs, it is harder to investigate an error or misuse afterward, and some features may be unavailable.

Similar, but not the same

opt-out from training – Opt-out only excludes training a model from your data, not storing it; zero data retention, however, also excludes storage.
helyben futtatott modell – With local execution, the data never leaves your own machine; with zero retention, it leaves but the provider does not store it.
End-to-end encryption – With end-to-end encryption, only the two communicating parties can read the content, not the intermediary provider. However, the AI provider must see your text for processing, so there encryption only protects the path leading there. Zero data retention regulates what happens to the data after processing.

Related concepts

Broader

data protection, data security, data processing, AI governance

Narrower

data retention period, abuse monitoring log

On the edge

data efficiency, GDPR, helyben futtatott modell, data sovereignty, confidential computing

A brief history

The principle is based on an old data protection concept: the EU's General Data Protection Regulation (GDPR), applicable since 2018, stipulates that personal data may only be stored for as long as necessary. The term 'zero data retention' itself became a standard contractual term for AI providers around 2023 with the business spread of large language models.

Where things stand

As of late 2026, in major AI providers' business API offerings this is typically available on request, but usually subject to separate approval and not covering all features. It is a common procurement requirement in regulated sectors. It is not the default in consumer products, and its exact scope varies by provider.

Status: 2026 November

In the news

Appears in 1 Agent Age stories; the curve shows weekly occurrence in the news magazine.

OpenAI offers zero data retention for frontier models and changes ChatGPT's handling of confidential conversations from MondayAug 17, 2026 · Agent Age

Also known as

ZDR · zero data retention · zero data retention · zero data retention · zero retention · mode without data retention · zero-retention API · no data retention

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.