# Zero data retention across AI providers: what to verify

URL: https://infro.io/blog/zero-data-retention-across-ai-providers-what-to-verify
Author: INFRO Editorial (https://infro.io/blog/editorial)
Publisher: INFRO
Published: 2026-11-02
Last modified: 2026-11-02
Last reviewed: 2026-11-02 (next review due 2026-12-02)
Topic: Security and governance
Format: Checklist

> Zero data retention holds only when every storing path is closed: the default log, abuse-monitoring storage, stateful endpoints, grounding tools and your own gateway logs. Verify each path per provider and file written evidence, because several exceptions cannot be switched off by the customer.

Key takeaways:
- Ask four questions per provider: what is stored by default, who can be exempted, which endpoints or tools sit outside the exemption, and where is that written down.
- Some retention cannot be disabled by the customer, such as Google's Grounding with Google Search logs (up to three days) and Maps data (30 days).[2]
- Stateful endpoints (Responses API, threads, stored completions, Interactions API, Files API) store by design; treat each as its own line item.
- The not-trained-on promise and the not-retained promise are different claims; evidence them separately.
- Your own gateway and observability logs count: turn payload capture off or set a short window, and note that this does not change provider-side storage.

## What "zero data retention" has to cover

A reviewer who writes "ZDR: yes" on a vendor form is usually recording one of several different facts. Retention can come from at least five places: a default request log, abuse-monitoring storage, stateful endpoints that persist conversations, tools such as grounding that keep their own logs, and logging you switch on yourself. Separately, a provider can promise not to train on your data and still keep it for a period. Treat "not trained on" and "not retained" as two claims with two pieces of evidence.

For each provider below, answer four questions and file the proof:

1. What is stored by default, and for how long?
2. Who can be exempted, and is exemption a switch, a contract term or an approval?
3. Which endpoints, models or tools sit outside the exemption?
4. Where is the answer written, in a document you can cite and date?

Provider documents change. Record the page URL and the date you read it next to every answer.

> **Note: Scope of this checklist**
> It reflects pages read on 2 November 2026. OpenAI's enterprise privacy page could not be read in that session, so its section below contains only questions to put to the vendor, not findings. Do the same exercise from their current documents and your signed terms.

## Google: Gemini API and the cloud platform are different regimes

Google has two surfaces with different rules, and procurement often conflates them.

**Gemini API (AI Studio keys).** Logging is on by default for Interactions API calls, and for Generate Content calls in projects created on or after October 26, 2026. A project owner can turn it on or off from the Logs and Datasets page.[1] Default retention is a maximum of 55 days, adjustable to 7, 14, 28 or 55; logs placed in datasets have no set retention period.[1] Because logging is only available for billing-enabled projects, prompts and responses in logs are not used for product improvement by default, but datasets you choose to share are processed under the Unpaid Services terms, and human reviewers may read them.[1] Our [earlier article on the default change](https://infro.io/blog/gemini-api-stores-requests-by-default-what-to-change) covers the switch itself.

**Cloud platform (the former Vertex AI).** Google's zero-data-retention page lists the areas where a customer has to act. It describes a training restriction: Google won't train or fine-tune models with your data without prior permission or instruction.[2] It then lists the exceptions:

- Prompt logging for abuse monitoring applies to customers governed by the Google Cloud Platform Terms of Service, and some Advanced AI models or features may log prompts and responses with zero retention not possible.[2]
- Grounding with Google Search stores logs for up to three days, with no way to disable it; the page points to Web Grounding for Enterprise if you need zero retention.[2]
- Grounding with Google Maps stores prompts, context and output for thirty days, also with no way to disable it.[2]
- Request-response logging is off by default and writes to BigQuery when enabled per model and project.[2]
- For the Interactions API, `store` defaults to true for all models; set `store = false` explicitly.[2]

Evidence to file for Google:

- [ ] Which surface each application uses (API key or cloud project), listed per service
- [ ] A screenshot or export of the Logs and Datasets setting and retention window for each Gemini API project
- [ ] The date each project was created, since the default depends on it
- [ ] A code or gateway-policy check that every Interactions call sends `store = false`
- [ ] A scan of requests for Search or Maps grounding tools, with an owner's sign-off on each
- [ ] A check that BigQuery request-response logging is off, or a data-owner decision where it is on
- [ ] Confirmation that no project runs on unpaid quota with real data: unpaid services use content to improve Google products, and in the EEA, Switzerland and the UK the paid-services terms apply instead[3]

## Azure OpenAI: the model is stateless, the features are not

Microsoft's page states that prompts, completions, embeddings and training data are not available to other customers, are not available to OpenAI, and are not used to train foundation models without your permission.[4] It also says the models are stateless, with no prompts or completions stored in the model.[4] The retention questions sit around the model.

- **Abuse monitoring.** When indicators of abuse are detected, a sample of prompts and completions may be selected for review, first by automated means and by human reviewers as necessary. The data store for human review is separated by customer resource and located in the geography of the resource.[4] Customers approved for modified abuse monitoring do not have that data storage and human review process, though automated review may still occur.[4] Eligibility is by application, so the evidence is the approval itself.
- **Stateful features.** The Responses API, the Threads feature of the Assistants API (preview) and Stored completions (preview) create a data store for message history. Uploaded files and vector stores are stored too. Stored data sits in the Foundry resource in your tenant, within the same geography, and you can delete it at any time.[4]
- **Processing location.** Global and DataZone deployment types may process prompts outside the resource's geography; data stored at rest stays in the designated geography.[4] This is a residency question, not a retention one, but reviewers often need both.
- **Batch.** Batch processing is a Global deployment type and data at rest remains in the designated geography until capacity is available.[4]

Evidence to file for Azure:

- [ ] The written modified-abuse-monitoring approval for each subscription or resource, with its date and scope
- [ ] An inventory of deployments by type (Standard, DataZone, Global, Batch)
- [ ] A list of every call path using the Responses API, Assistants threads, Files or Stored completions, with the retention owner for each
- [ ] A deletion procedure for stored entities, tested once
- [ ] A policy forbidding preview features where the page notes preview models or features might not support all stated conditions[4]

## Anthropic API: a 30-day default and an agreement-based exemption

Anthropic's article for commercial products says that for API users it automatically deletes inputs and outputs from its backend within 30 days of receipt or generation, with named exceptions: services with longer retention under your control such as the Files API, agreements such as a zero data retention agreement, retention needed to enforce its Usage Policy, and legal compliance.[5]

Two exceptions matter to a reviewer who has a ZDR agreement. First, inputs and outputs flagged by automated trust and safety systems as violating the Usage Policy are retained for up to 2 years, and classification scores for up to 7 years.[5] Second, for Covered Models, Anthropic requires limited data retention and review as part of safety work, described on a separate page.[5] Feedback submitted through thumbs up/down or bug reports is kept for 5 years.[5]

Evidence to file for Anthropic:

- [ ] The signed agreement, and the list of products it applies to (the vendor keeps a separate article on that scope; get it in writing for your organization)
- [ ] The model list in use, checked against the Covered Models page, with any retention requirement recorded
- [ ] A check that no application calls the Files API without an owner and a deletion schedule
- [ ] A rule that feedback buttons and bug-report payloads never include production content
- [ ] An understanding with the business that a flagged request is retained regardless of the agreement, and who handles that case

## Bedrock and OpenAI: what the pages gave, and what to ask

**Amazon Bedrock.** The general section of the FAQ says content is not used to improve the base models and is not shared with any model providers, that data is encrypted in transit and at rest with optional customer keys, and that AWS PrivateLink gives private connectivity from a VPC.[6] The part of the FAQ read for this article does not state a retention period for invocation payloads, so do not infer one. Ask AWS, and read the data-protection documentation, for the following:

- [ ] Whether any invocation content is stored by default, and whether abuse detection stores it
- [ ] Whether model invocation logging is enabled in each account and region, and where it writes
- [ ] Which features keep state: agents, knowledge bases, guardrails, customization data, and any third-party models whose developer terms differ
- [ ] Whether a given third-party model runs under extra terms from its own developer

**OpenAI.** The enterprise privacy page was unavailable to read, so no findings are recorded here. Put the same four questions to the vendor and require the answers in your contract or a dated, citable page:

- [ ] Is zero data retention an account approval, and which of your projects and organizations does it cover?
- [ ] Which endpoints are excluded from it? Any endpoint that returns an object you can fetch later, such as a stored response, thread, file or batch output, is storing something; list each.
- [ ] How do server-side tools and background processing behave under the exemption?
- [ ] What does abuse monitoring keep, and for how long?

## Your own layer counts

The checklist is incomplete if your gateway, tracing and application logs keep what the provider does not. INFRO's documentation states that prompt and response capture is off by default, applies to every request when an owner or admin turns it on, can be disabled per request with `logging: false`, and that the stored window is the smaller of the organization's choice and its plan's maximum.[7] It also states that disabling INFRO logging does not disable storage or logging at your provider.[7] Two things follow for any gateway you evaluate:

- Evidence your gateway setting and the provider setting separately.
- Remove sensitive content before it leaves. Request traces and pattern-based guardrails that block, redact or flag items like card numbers or API keys sit in front of the provider, though detection can miss things and is not a substitute for provider-side controls.

A short test for each application closes the loop: send a canary string, wait one retention window, then confirm the string is absent from every store you control and that the provider's stated deletion date has passed. The last step relies on the provider's word, which is why the written agreement is the evidence that matters.

## What to put in the evidence pack

For each provider and each application, keep one row:

| Field | Example of what to record |
| --- | --- |
| Surface and endpoint | Gemini API key, Interactions API |
| Default retention | Written figure and the page URL, with the date read |
| Exemption mechanism | Switch, contract term or approval, plus its reference |
| Exceptions in use | Grounding, files, threads, flagged-content retention |
| Control and owner | Setting, code check or policy, and the named person |
| Last verified | Date, and the reviewer |

Re-verify on a schedule and on any change notice: Google's default for new projects changed on a date, and retention pages carry their own revision dates. A row without a source URL and a date is an opinion.

## Questions

### Is a no-training commitment the same as zero data retention?

No. Azure's page, for example, states prompts are not used to train models while also describing abuse-monitoring storage and stateful features that persist data.[4] Evidence training use and retention as two separate claims.

### Does turning off logging in a gateway give me zero retention at the provider?

No. INFRO's own documentation says disabling INFRO logging does not disable storage or logging at your AI provider.[7] The provider's retention is governed by your account settings and agreement.

## Sources

1. Data logging and sharing — Google AI for Developers (Gemini API). https://ai.google.dev/gemini-api/docs/logs-policy (accessed 2026-11-02)
2. Gemini Enterprise Agent Platform and zero data retention — Google Cloud Documentation. https://docs.cloud.google.com/gemini-enterprise-agent-platform/resources/zero-data-retention (accessed 2026-11-02)
3. Gemini API Additional Terms of Service — Google AI for Developers. https://ai.google.dev/gemini-api/terms (accessed 2026-11-02)
4. Data, privacy, and security for Models sold by Azure in Microsoft Foundry — Microsoft Learn. https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy (accessed 2026-11-02)
5. How long do you store my organization's data? — Anthropic Privacy Center. https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data (accessed 2026-11-02)
6. Amazon Bedrock FAQs — Amazon Web Services. https://aws.amazon.com/bedrock/faqs/ (accessed 2026-11-02)
7. Privacy & data — INFRO Docs. https://infro.io/docs/privacy (accessed 2026-11-02)