Data protection
Zero Data Retention, enforced on every request
Zero Data Retention (ZDR) means an AI provider processes your prompt and returns a response without storing either afterwards, and without using them for training, evaluation, or human review. It is the single most important contractual and technical control in enterprise AI — and it is also the one most often assumed rather than verified.
Where ZDR quietly breaks
Retention terms are not a property of a vendor; they are a property of a specific contract, endpoint, and setting. The same provider can be zero-retention on one API and thirty-day-retention on another. A team that switches endpoints for a faster model, or calls a consumer product instead of the enterprise API, moves outside the terms without ever noticing.
- A developer tests with a personal key that carries no enterprise terms.
- A new model launches on an endpoint your zero-retention agreement does not cover.
- A plugin or agent framework forwards the prompt to a second provider you never vetted.
- A browser extension or desktop assistant bypasses your network path entirely.
How Shield enforces it
Shield treats ZDR as an invariant rather than a checkbox. Every request is inspected, minimized, and dispatched only to a model whose current terms satisfy your policy.
- Payload minimization first: sensitive fields are stripped, tokenized, or replaced with grounded references before dispatch.
- Model allow-listing: a model is callable only while its retention terms and residency match policy.
- Per-request attestation: the log records the model, the terms in force, and the controls applied.
- Fail-safe routing: if no compliant model can serve the request, it is blocked or downgraded rather than quietly sent.
- Board-readable reporting: retention posture is reportable across every model your teams touch.
What you can show an auditor
Evidence beats intent. Because every call is attributed and logged at the gateway, you can demonstrate — per request, per user, per model — that data left under zero-retention terms and that anything sensitive was minimized before it left. That mapping to HIPAA, SOC 2, ISO 27001, and the EU AI Act is the deliverable auditors actually want.
Request an AI Readiness Review — free
A 20-minute review of how your teams use AI today, which models are in play, and the controls a board would expect. No obligation.
Frequently asked questions
What does Zero Data Retention mean?
Zero Data Retention means the AI provider does not store your prompt or the model's response after the request completes, and does not use either for training, evaluation, or human review. The data exists only for the duration of inference.
Isn't ZDR just a setting we can turn on?
Providers offer retention controls, but they differ by provider, by API, by endpoint, and by contract tier — and they can be silently bypassed by a team calling a different endpoint. ZDR only holds if something enforces it on every request.
Does ZDR remove the need to redact sensitive data?
No. ZDR limits what a provider keeps; it does not change what you sent. Sound practice is to minimize the payload first and rely on ZDR as the second layer, not the only one.
How do we prove ZDR to an auditor?
With per-request evidence: which model handled the call, under which contract terms, with which retention setting, and which controls applied. That record is what a gateway produces and a direct integration does not.
Does ZDR cover abuse monitoring logs?
This varies by provider. Some retain limited metadata for abuse detection even under zero-retention terms. The important thing is knowing which terms apply per model, which the gateway tracks for you.