Zero data retention across AI providers: what to verify

What "zero data retention" has to cover

A reviewer who writes "ZDR: yes" on a vendor form is usually recording one of several different facts. Retention can come from at least five places: a default request log, abuse-monitoring storage, stateful endpoints that persist conversations, tools such as grounding that keep their own logs, and logging you switch on yourself. Separately, a provider can promise not to train on your data and still keep it for a period. Treat "not trained on" and "not retained" as two claims with two pieces of evidence.

For each provider below, answer four questions and file the proof:

1. What is stored by default, and for how long?
2. Who can be exempted, and is exemption a switch, a contract term or an approval?
3. Which endpoints, models or tools sit outside the exemption?
4. Where is the answer written, in a document you can cite and date?

Provider documents change. Record the page URL and the date you read it next to every answer.

Google: Gemini API and the cloud platform are different regimes

Google has two surfaces with different rules, and procurement often conflates them.

Gemini API (AI Studio keys). Logging is on by default for Interactions API calls, and for Generate Content calls in projects created on or after October 26, 2026. A project owner can turn it on or off from the Logs and Datasets page.¹ Default retention is a maximum of 55 days, adjustable to 7, 14, 28 or 55; logs placed in datasets have no set retention period.¹ Because logging is only available for billing-enabled projects, prompts and responses in logs are not used for product improvement by default, but datasets you choose to share are processed under the Unpaid Services terms, and human reviewers may read them.¹ Our earlier article on the default change covers the switch itself.

Cloud platform (the former Vertex AI). Google's zero-data-retention page lists the areas where a customer has to act. It describes a training restriction: Google won't train or fine-tune models with your data without prior permission or instruction.² It then lists the exceptions:

• Prompt logging for abuse monitoring applies to customers governed by the Google Cloud Platform Terms of Service, and some Advanced AI models or features may log prompts and responses with zero retention not possible.²
• Grounding with Google Search stores logs for up to three days, with no way to disable it; the page points to Web Grounding for Enterprise if you need zero retention.²
• Grounding with Google Maps stores prompts, context and output for thirty days, also with no way to disable it.²
• Request-response logging is off by default and writes to BigQuery when enabled per model and project.²
• For the Interactions API, store defaults to true for all models; set store = false explicitly.²

Evidence to file for Google:

• Which surface each application uses (API key or cloud project), listed per service
• A screenshot or export of the Logs and Datasets setting and retention window for each Gemini API project
• The date each project was created, since the default depends on it
• A code or gateway-policy check that every Interactions call sends store = false
• A scan of requests for Search or Maps grounding tools, with an owner's sign-off on each
• A check that BigQuery request-response logging is off, or a data-owner decision where it is on
• Confirmation that no project runs on unpaid quota with real data: unpaid services use content to improve Google products, and in the EEA, Switzerland and the UK the paid-services terms apply instead³

Azure OpenAI: the model is stateless, the features are not

Microsoft's page states that prompts, completions, embeddings and training data are not available to other customers, are not available to OpenAI, and are not used to train foundation models without your permission.⁴ It also says the models are stateless, with no prompts or completions stored in the model.⁴ The retention questions sit around the model.

• Abuse monitoring. When indicators of abuse are detected, a sample of prompts and completions may be selected for review, first by automated means and by human reviewers as necessary. The data store for human review is separated by customer resource and located in the geography of the resource.⁴ Customers approved for modified abuse monitoring do not have that data storage and human review process, though automated review may still occur.⁴ Eligibility is by application, so the evidence is the approval itself.
• Stateful features. The Responses API, the Threads feature of the Assistants API (preview) and Stored completions (preview) create a data store for message history. Uploaded files and vector stores are stored too. Stored data sits in the Foundry resource in your tenant, within the same geography, and you can delete it at any time.⁴
• Processing location. Global and DataZone deployment types may process prompts outside the resource's geography; data stored at rest stays in the designated geography.⁴ This is a residency question, not a retention one, but reviewers often need both.
• Batch. Batch processing is a Global deployment type and data at rest remains in the designated geography until capacity is available.⁴

Evidence to file for Azure:

• The written modified-abuse-monitoring approval for each subscription or resource, with its date and scope
• An inventory of deployments by type (Standard, DataZone, Global, Batch)
• A list of every call path using the Responses API, Assistants threads, Files or Stored completions, with the retention owner for each
• A deletion procedure for stored entities, tested once
• A policy forbidding preview features where the page notes preview models or features might not support all stated conditions⁴

Anthropic API: a 30-day default and an agreement-based exemption

Anthropic's article for commercial products says that for API users it automatically deletes inputs and outputs from its backend within 30 days of receipt or generation, with named exceptions: services with longer retention under your control such as the Files API, agreements such as a zero data retention agreement, retention needed to enforce its Usage Policy, and legal compliance.⁵

Two exceptions matter to a reviewer who has a ZDR agreement. First, inputs and outputs flagged by automated trust and safety systems as violating the Usage Policy are retained for up to 2 years, and classification scores for up to 7 years.⁵ Second, for Covered Models, Anthropic requires limited data retention and review as part of safety work, described on a separate page.⁵ Feedback submitted through thumbs up/down or bug reports is kept for 5 years.⁵

Evidence to file for Anthropic:

• The signed agreement, and the list of products it applies to (the vendor keeps a separate article on that scope; get it in writing for your organization)
• The model list in use, checked against the Covered Models page, with any retention requirement recorded
• A check that no application calls the Files API without an owner and a deletion schedule
• A rule that feedback buttons and bug-report payloads never include production content
• An understanding with the business that a flagged request is retained regardless of the agreement, and who handles that case

Bedrock and OpenAI: what the pages gave, and what to ask

Amazon Bedrock. The general section of the FAQ says content is not used to improve the base models and is not shared with any model providers, that data is encrypted in transit and at rest with optional customer keys, and that AWS PrivateLink gives private connectivity from a VPC.⁶ The part of the FAQ read for this article does not state a retention period for invocation payloads, so do not infer one. Ask AWS, and read the data-protection documentation, for the following:

• Whether any invocation content is stored by default, and whether abuse detection stores it
• Whether model invocation logging is enabled in each account and region, and where it writes
• Which features keep state: agents, knowledge bases, guardrails, customization data, and any third-party models whose developer terms differ
• Whether a given third-party model runs under extra terms from its own developer

OpenAI. The enterprise privacy page was unavailable to read, so no findings are recorded here. Put the same four questions to the vendor and require the answers in your contract or a dated, citable page:

• Is zero data retention an account approval, and which of your projects and organizations does it cover?
• Which endpoints are excluded from it? Any endpoint that returns an object you can fetch later, such as a stored response, thread, file or batch output, is storing something; list each.
• How do server-side tools and background processing behave under the exemption?
• What does abuse monitoring keep, and for how long?

Your own layer counts

The checklist is incomplete if your gateway, tracing and application logs keep what the provider does not. INFRO's documentation states that prompt and response capture is off by default, applies to every request when an owner or admin turns it on, can be disabled per request with logging: false, and that the stored window is the smaller of the organization's choice and its plan's maximum.⁷ It also states that disabling INFRO logging does not disable storage or logging at your provider.⁷ Two things follow for any gateway you evaluate:

• Evidence your gateway setting and the provider setting separately.
• Remove sensitive content before it leaves. Request traces and pattern-based guardrails that block, redact or flag items like card numbers or API keys sit in front of the provider, though detection can miss things and is not a substitute for provider-side controls.

A short test for each application closes the loop: send a canary string, wait one retention window, then confirm the string is absent from every store you control and that the provider's stated deletion date has passed. The last step relies on the provider's word, which is why the written agreement is the evidence that matters.

What to put in the evidence pack

For each provider and each application, keep one row:

Re-verify on a schedule and on any change notice: Google's default for new projects changed on a date, and retention pages carry their own revision dates. A row without a source URL and a date is an opinion.