Zero-Retention AI for Regulated Teams

ZDR defined plainly. The exceptions vendors don't talk about. A buying checklist for compliance officers who can't afford to learn the hard way.

Every compliance officer evaluating AI in 2026 has a copy of the same vendor pitch deck on their desk. Slide three says "zero data retention" in a confident sans-serif. The footnote at the bottom of slide twelve, in 8-point grey, says "subject to operational logging and abuse-detection requirements."

That gap, between the confident slide and the grey footnote, is where every meaningful conversation about AI privacy now lives. ZDR has become a buying requirement for healthcare, finance, legal, and any other regulated industry. It's also one of the most slippery terms in the AI vendor stack. Here's what it actually means, where the exceptions live, and what to ask before you sign.

What ZDR (Zero Data Retention) actually means

ZDR is a contract term. It means the vendor agrees not to store your inputs (the prompts you send) or outputs (the responses generated) beyond what's needed to deliver the response back to your application. Once the response is delivered, the content is gone.

That's the clean version. The less clean version: ZDR addresses content storage. It doesn't, by itself, address every other class of data the vendor's infrastructure produces. Operational logs for abuse detection, billing records, request metadata, sub-processor logs at the CDN and load-balancer level. These can persist even when ZDR is in force, often for short windows, sometimes longer.

The mental model worth holding: ZDR is a contractual posture about content. It is not a magical absence of all data about your usage. Vendors who say "we don't keep anything" are either using shorthand or oversimplifying. Vendors who say "we contractually agree not to retain inputs or outputs beyond response generation, with these specific exceptions" are telling you the truth.

Why every regulated team is asking about it now

ZDR existed as a concept for years. It became a buying requirement in 2024.

In May 2024, a federal magistrate judge in The New York Times v. OpenAI and Microsoft ordered OpenAI to preserve all ChatGPT logs indefinitely as part of discovery in the copyright lawsuit. The order applied to consumer ChatGPT, Plus, Team, and standard API users. It did not apply to Enterprise customers who had a ZDR clause explicitly written into their contract. (We covered the broader implications in Can My AI Chats Be Subpoenaed.)

The compliance officer's reaction was immediate and uniform. If a court order can override a vendor's stated retention policy and force indefinite preservation, then the only thing standing between your client data and a discovery production is a contract clause. Either you have one, or you don't.

That order rewrote the buying criteria for every regulated team in the country. ZDR went from a feature to a gate. No clause, no procurement.

The three layers of retention to ask about

When a vendor says "we have ZDR," the right next question is "across which layers?" There are three, and they're worth separating.

Layer 1: Input and output content. The actual text of the prompt and the response. This is what most people picture when they hear "retention." A real ZDR contract addresses this layer cleanly: content isn't stored beyond response generation.

Layer 2: Operational and abuse-detection logs. Most vendors run automated classifiers on prompts to detect abuse (CSAM, weapons synthesis, malware generation, etc.). Those classifiers produce flags, scores, and short-term log entries. Some vendors keep a rolling window of the input itself for human review when a flag fires. This is the layer where "ZDR" gets fuzzy. Anthropic defaults to 7 days. OpenAI defaults to 30 days. Azure lets you opt out with approval.

Layer 3: Metadata logs. Who hit the API, with which key, against which model, at what time, with what token count, from what IP. This isn't your content. It's a record of your usage pattern. Even under aggressive ZDR, metadata logs almost always exist for billing, capacity planning, and security forensics. The retention window for these can be much longer (90 days, a year, or more).

True ZDR addresses all three layers explicitly. A contract that's silent on layers 2 and 3 isn't full ZDR. It's content-only ZDR.

Anthropic's specific posture

Anthropic publishes its API retention defaults clearly. From the official documentation:

• Inputs and outputs: Not retained beyond what's needed to generate the response. No saved chat history. No training use.
• Operational logs: 7-day rolling window by default, then auto-deleted. Used for trust and safety review when classifiers flag a request.
• Enterprise contracts: Can be negotiated further. Customers signing a BAA, MSA, or DPA can request stricter terms, including modifications to the operational log window. Covered in more depth in Anthropic DPA Explained.
• Training: API traffic is never used to train models. This is contractual, not opt-in.

Anthropic's posture is one of the cleaner ones in the market. The 7-day operational window is short by industry standards, the no-training default is firm, and the documentation doesn't bury the exceptions in legalese.

OpenAI's specific posture

OpenAI's posture varies dramatically by tier, which is the source of most compliance confusion.

• Consumer ChatGPT, Plus, Team: Currently under court order from the NYT case to preserve logs indefinitely. There is no consumer-tier path to deletion right now.
• Standard API: 30-day default retention for abuse monitoring, then deletion. No training on API inputs by default.
• Enterprise tier: ZDR available with an explicit clause. This is the only OpenAI product line that can credibly claim ZDR today.

If your team is using OpenAI through anything other than Enterprise, you don't have ZDR. That's the practical bottom line, and it's worth saying plainly because the marketing language tends to blur it.

Microsoft Azure OpenAI

Many regulated enterprises route their OpenAI traffic through Azure rather than going to OpenAI directly. Azure has its own retention posture, distinct from OpenAI's, and it's worth understanding.

Azure OpenAI defaults to abuse-monitoring logs similar to OpenAI's. The difference: Azure offers a path to opt out of abuse monitoring entirely, which gets you to a true ZDR posture. The catch is that opt-out requires Microsoft's approval. You apply for the modified data handling, justify the use case (typically healthcare, financial services, legal, or government), and Microsoft reviews.

For approved customers, the result is the strictest ZDR posture in the OpenAI family: no abuse logs, no content retention, no metadata beyond billing. For everyone else on Azure, retention sits closer to OpenAI's standard API.

If you're routing through Azure for compliance reasons, the abuse-monitoring opt-out is the configuration that actually delivers ZDR. Without it, you have a slightly different version of OpenAI's standard retention.

The exceptions vendors don't lead with

Even the cleanest ZDR contract has carve-outs. They aren't hidden, but they aren't on the front of the pitch deck either. The honest list:

None of these are deal-breakers. They're operational realities. The question for compliance is whether the vendor names them explicitly in the contract or buries them in vague language about "necessary operations." Named exceptions are auditable. Vague exceptions are not.

Vendor checklist for ZDR

Ten questions to put in front of any AI vendor before you sign. If they can't answer cleanly, that's the answer.

This is the level of specificity a compliance officer should expect. Vendors that are serious about ZDR can answer all ten in a discovery call. Vendors that aren't, will deflect to marketing language or "let me get back to you."

Vendor posture comparison at a glance

Where Private Claude fits

Private Claude is built on the Anthropic API, which means we inherit Anthropic's retention defaults at the model layer. The 7-day operational rolling log applies to traffic going through us, the same as it would for any direct Anthropic API customer. No training, no input/output retention beyond response generation.

On top of that, the Private Claude application has zero chat history of its own. There's no database storing conversations. Once you close the tab, the conversation is gone from our side. We don't have a copy to subpoena because we never had one in the first place. (More on that posture in HIPAA-Compliant AI Chat.)

For Business customers with stricter requirements:

• BAA available. We sign a BAA for healthcare-covered entities and business associates.
• VPC deployment. Private Claude can be deployed in your AWS, GCP, or Azure environment, so all traffic stays inside your infrastructure boundary. The model calls still go to Anthropic, but everything else lives in your VPC.
• Custom retention terms. If you need shorter than 7-day operational logs, that's negotiated with Anthropic at the Enterprise tier. We can introduce that conversation.

The pitch isn't that Private Claude has invented a new privacy primitive. It's that we've assembled the existing primitives (Anthropic's API posture, no-history application architecture, optional VPC deployment) into a configuration regulated teams can actually buy and run, without spending six months building it themselves.