Zero data retention, explained: what happens to your data when AI reads it

Zero data retention (ZDR) means the AI model provider doesn’t store your prompts or the model’s answers once the request is processed, so there’s no copy of your data sitting in the provider’s logs. It’s the single most important term to confirm before client data goes to an AI model. But ZDR is a contract and a configuration, not a feature you get by default, and “available” is not the same as “in effect.”

What happens by default

When an application sends text to an AI model, the model provider receives it, processes it and returns an answer. Depending on the provider and the plan, the provider may keep the request and response for a period, often for abuse monitoring or debugging. Some consumer products may also use conversations to improve their models unless you opt out. For a firm handling client financials, legal matters or personal information, any stored copy is a copy you don’t control.

What ZDR covers

Under a ZDR arrangement, the provider agrees not to store prompts or outputs after the request is handled. Paired with a no-training commitment, it means:

• no persistent copy of your client data in the provider’s logs;
• your data isn’t used to train or improve the provider’s models;
• a smaller footprint to worry about if the provider is ever breached or subpoenaed.

What ZDR doesn’t cover

• Your AI vendor’s own systems. ZDR is about the model provider. Your vendor still stores data to do its job, so ask separately how that’s isolated and encrypted.
• Short-lived processing. Data still exists in memory while the model works. ZDR is about what’s kept afterwards.
• Every route. Some platforms route requests through gateways or fall back to other providers when one is busy. If fallback goes to a provider without ZDR, the guarantee breaks. Ask whether fallbacks are turned off.
• Logging by intermediaries. A gateway between your vendor and the model can have its own logging. It needs to be off too.

How to confirm it’s actually in effect

Ask your AI vendor four questions:

1. Is there a signed ZDR agreement with each model provider that sees our data? A standard terms page or an API key alone usually isn’t one.
2. Is training on our data contractually excluded?
3. Are fallbacks to other providers turned off, so requests can’t be routed somewhere without ZDR?
4. Is logging off at every hop, including any gateway?

Then ask the question that matters most: does your system refuse to call a model that doesn’t meet all four? A policy that says “we use ZDR providers” depends on people remembering. A system that blocks non-compliant models doesn’t.

Why it matters for service firms

Your engagement letters, confidentiality obligations and, for many firms, rules like the FTC Safeguards Rule or IRC 7216 govern how client information is used and disclosed. Being able to say, in writing, that no AI provider keeps a copy of your clients’ data or trains on it is a strong answer when a client or insurer asks how you use AI.

How Precision AI OS handles it

In Precision AI OS, a language model can’t be called unless it’s covered by zero-retention and no-training terms, with prompt logging off and shared-provider fallback off. Every model call is recorded. See how we protect your data.