Zero data retention (ZDR) is an arrangement under which an AI provider does not keep your prompts or the model's responses once the response is returned. OpenAI, Anthropic and Google Cloud all offer a version of it, but in every case it is approved or enabled by the provider, it applies only to the features the provider lists as eligible, and it keeps exceptions for legal holds and flagged content. Stateful features such as file storage, batch jobs, hosted agents and code execution containers usually sit outside it. This guide compares what each provider's documentation says, lists the features that step outside ZDR, and ends with what to check when an AI vendor, or your vendor's vendor, tells you it has a zero retention agreement. It was checked on November 11, 2026 against each provider's own data retention documentation.
Why this matters now
On November 10, 2026 Notion updated a security advisory about an incident at Fireworks AI, a third-party inference provider it used for some Notion AI features. Notion says the incident affected fewer than 1% of workspaces and that the exposed data included Notion AI chat transcripts used for its Insights feature. Notion also says Fireworks had given it a contractual zero data retention commitment, yet during the investigation it learned that "data was retained from the Fireworks endpoints that we used." Notion disconnected from Fireworks, disabled Insights while it investigates, and says it is auditing critical vendors for zero data retention compliance. Fireworks' own security bulletin describes an October 2026 incident and a November 9 update, but does not name Notion, so we have not assumed the two accounts describe exactly the same data.
The lesson is not specific to one vendor. A ZDR clause is only as good as the endpoints and features it actually covers, and the chain often has more than one AI company in it. Google autocomplete shows people searching "zero data retention openai", "zero data retention claude", "zero data retention anthropic", "zero data retention vertex ai" and "zero data retention ai providers", so the question is a common one.
What ZDR means at each provider
OpenAI
OpenAI's data controls guide says that, since March 1, 2023, API data is not used to train its models unless you opt in, and that abuse monitoring logs are kept for up to 30 days by default. Approved customers can choose Modified Abuse Monitoring, which excludes customer content from those logs (other than image and file inputs in rare cases), or Zero Data Retention, which excludes it in the same way and also forces the store parameter on /v1/responses and /v1/chat/completions to false. Both need prior approval through OpenAI's sales team. Once approved, an organization sets a default and each project can inherit it, pick a control, or choose None.
Anthropic
Anthropic's API and data retention page says that under a ZDR arrangement it does not store customer prompts or responses at rest after the API response is returned, and that retained data is never used for training without express permission. ZDR is requested through Anthropic's sales team and is enabled per organization: a new organization under the same account needs its own enablement. Organizations with ZDR cannot call the API directly from a browser, because cross-origin requests are rejected. Anthropic also names Covered Models (on the date we checked, the Fable and Mythos 5 family models) that require 30-day retention and are not available under ZDR unless Anthropic expressly authorizes it. For Claude Code, Anthropic's ZDR page says it is available to qualified Claude for Enterprise accounts, is not included in the standard plan, and does not extend to claude.ai chat, Cowork, analytics metadata, or third-party MCP servers and integrations.
Google Cloud (Vertex AI, now Gemini Enterprise Agent Platform)
Google's data governance page states that Google won't use your data to train or fine-tune models without your prior permission or instruction. Zero data retention is a set of conditions rather than one control: in-memory and durable caching are on by default and keep data for up to 24 hours, so you disable caching for the project; request-response logging and Live API session resumption are off by default and must stay off; the Interactions API's store parameter defaults to true and must be set to false; and the Sandbox API is not compatible with ZDR. For the Gemini Developer API through Google AI Studio, Google's usage policies say prompts and outputs are retained for 55 days for abuse monitoring, and the AI Studio pages we read do not describe a ZDR option, so teams that need it generally look at the Google Cloud route.
| OpenAI API | Anthropic Claude API | Google Cloud (Gemini) | |
|---|---|---|---|
| How you get ZDR | Prior approval via sales; org or project setting | Arrangement via sales; enabled per organization | Meet listed conditions; some exceptions via account team |
| Default abuse or log retention (as documented) | Up to 30 days | Not retained by default except Covered Models (30 days) | Caching up to 24 hours; AI Studio abuse logs 55 days |
| Training on API data by default | No (since March 1, 2023) | No, without express permission | No, without prior permission or instruction |
| Flagged or legal exceptions | CSAM image scanning; models can be made ineligible | Legal holds; flagged sessions up to 2 years | Advanced AI features may not support ZDR |
Features that step outside ZDR
The pattern across all three providers is the same: anything that has to keep state between calls is usually not covered. Using one of these features is a choice to step outside ZDR for that data; Anthropic says plainly that its API does not block ineligible features under ZDR, and the feature's own retention policy applies.
- OpenAI: the endpoint table lists
/v1/files,/v1/batches,/v1/assistantsand threads,/v1/vector_stores,/v1/conversations,/v1/agents,/v1/evalsand fine-tuning jobs as not ZDR eligible. Assistants objects that are not deleted are retained indefinitely, and deleted ones are removed 30 days later. Data sent to an MCP server is subject to that server's own policy. - Anthropic: the eligibility table marks the Batch API (29-day retention), Files API (kept until deleted or expired), MCP connector, Agent Skills and programmatic tool calling (code execution containers, up to 30 days) as not eligible. It also states that no Claude Managed Agents feature is eligible. Prompt caching, token counting, citations, extended thinking and PDF input in the Messages API are eligible; structured outputs are eligible with a qualification, because the JSON schema is cached for up to 24 hours.
- Google Cloud: Grounding with Google Search keeps logs for up to 3 days and Grounding with Google Maps for 30 days, and neither can be disabled; Google suggests Web Grounding for Enterprise if you need ZDR. The Deep Research agent stores session data for 7 days, and CodeMender keeps session data for up to 7 days.
Partner models carry their own rules. On Google Cloud, OpenAI's models are logged for up to 30 days by default, ZDR is available per approved project, and setting store: false alone does not enable it. Anthropic notes that on Amazon Bedrock and Google-managed Claude, the cloud provider is the data processor, so that platform's controls apply.
What ZDR does not cover
- Flagged content and the law. Anthropic's Claude Code ZDR page says Anthropic may retain data where required by law or to address Usage Policy violations, for up to 2 years if a session is flagged. OpenAI retains images its classifier flags as potential CSAM for manual review even under ZDR, and reserves the right to make specific models ineligible with advance written notice.
- Metadata. ZDR is about prompts and outputs. Account emails, usage statistics and billing data are still kept; Anthropic lists Claude Code analytics and seat management as outside ZDR.
- Your own systems. Your logs, traces, evaluation datasets and support tickets often hold the same prompts. A provider's ZDR does nothing for them. If you run an agent, see our AI agent security checklist.
- Everyone else in the chain. Inference hosts, observability tools, MCP servers and other sub-processors each have their own retention. The Notion case is a reminder that a contractual promise and what an endpoint actually stores can differ.
What to check with an AI vendor
- Ask which provider and which endpoints. "We have ZDR with OpenAI" means little until you know whether the vendor uses Responses with
storeoff, or files, batches and vector stores that are not covered. - Ask for the sub-processor list. Find out whether open-weight models are served by a third-party inference host, and what that host has agreed to and can show. Our SOC 2 for AI agents post covers the evidence auditors ask for.
- Check per-organization enablement. At Anthropic, ZDR does not carry over to a new organization, and at OpenAI each project can override the organization default. Developers using personal keys or logins are not covered; for Claude Code, managed settings can pin logins to the company organization.
- Check model eligibility. Some frontier models need retention. A vendor that upgrades to one of them may quietly move off ZDR.
- Plan for the breach anyway. Notion's advice to affected customers was to treat the data as exposed and rotate any credentials pasted into AI chats. Keep secrets out of prompts in the first place, and map retention to your legal duties under GDPR or HIPAA.
How we approach this
This is our approach, not a rule. For a client build that handles sensitive data we decide the retention target first, then choose endpoints to match: stateless calls where ZDR applies, with conversation state kept in the client's own database rather than in a provider's threads or conversations API. We document every place a prompt can land, including our own logs and any MCP servers, and keep that list in the system's records so an auditor or the client's security team can check it. When a feature they want is not ZDR eligible, we say so before it ships rather than after. Our AI governance and security audit covers this for existing systems.
Sources: OpenAI, data controls in the OpenAI platform, Anthropic, API and data retention, Anthropic, Claude Code zero data retention, Google Cloud, data governance and zero data retention, Google AI Studio, usage policies, Notion, security incident involving a third-party AI vendor, Fireworks AI, security bulletins. All read November 11, 2026. Eligibility tables change often, so check the current pages and your own contract before relying on any row.