Zero Data Retention

When someone uses an AI service on the internet, they send text to a remote computer. There, calculations are performed, and a response comes back. Normally, a copy of this text stays with the provider — for debugging, for abuse monitoring, or for improving the program. Zero Data Retention means: exactly that does not happen. The provider promises to discard the input and the response immediately after processing. Translated, the term simply means “zero data retention.”

Why companies insist on it

For private users, it is usually just unpleasant if inputs are stored. For companies, it can be prohibited. A law firm that has an AI summarize a contract is passing on someone else’s secrets. A hospital typing in diagnoses is processing health data. Such data is especially strictly protected in Europe under the General Data Protection Regulation.

That’s why Zero Data Retention is often the condition under which a company will purchase an AI service at all. Without this commitment, the legal department declines. Providers such as OpenAI, Anthropic, or Microsoft therefore offer the option specifically for business customers, usually only in paid tiers and often only after a review of the use case.

A second reason is fear of the training dataset. Many worry that their company secrets could seep into a future model and eventually surface as an answer at a competitor. Whether this is technically realistic is debated. But the concern alone is enough to make deals fall through.

What actually happens to the data

The distinction between processing and storing is important. The service inevitably has to process the input — otherwise it couldn’t respond. For this, the text briefly resides in working memory, i.e., the volatile memory of the server. This memory is cleared as soon as the task is completed. Zero Data Retention additionally promises that the text is not written to any hard drive and does not end up in any log file.

You can think of it like a phone call with an interpreter. They listen, translate, and hang up. They take no notes, and there is no recording. Still, they understood everything while speaking.

Within a single conversation, the history remains technically available, because it is sent along with every new question. This is not a contradiction to the commitment. A typical intermediate solution is limited retention: 30 days for abuse review, followed by automatic deletion. This is explicitly not Zero Data Retention, but it is often advertised as such. Those who look closely check the contract terms, not the marketing page.

How to recognize the commitment in an offer

The term rarely appears in the user interface. It shows up in contracts, in privacy policies, and in press releases. In public sector procurement tenders, it has by now become a common requirement. It is also often explicitly mentioned for programming tools that suggest code — source code is considered especially sensitive.

In business news, the term usually appears as a selling point. A provider announces a version for business customers and emphasizes that no data is stored. Sometimes it is also a reaction to a scandal, for instance when a company’s internal chats became public. A common misconception: Zero Data Retention does not mean that the data never leaves the country. Where the computation takes place is governed by a different commitment, often called “Data Residency.”