“Zero Data Retention” is one of the most-used and least-precise phrases in enterprise AI procurement. Before you rely on it, it helps to separate what it can mean.
Three guarantees, often confused
Not trained on. Your data is excluded from model training. This is now common by default on enterprise and API tiers — but “by default” and “guaranteed in contract” are different things.
Not retained. Prompts and outputs are not stored after the request completes, or are stored only briefly for abuse monitoring. This is what “Zero Data Retention” should mean, but the window and scope vary.
Not accessible. Even where data is briefly stored, who can see it, under what controls, and in which jurisdiction?
What to require before sending real data
- Is exclusion from training contractual, not just a settings toggle?
- What is the exact retention window, and does ZDR remove it entirely?
- Where is data processed and stored geographically?
- Do logging, abuse-monitoring, or human-review processes create copies?
- Does ZDR still apply when using agents, tools, or connectors?
Terms differ by provider, plan, and region, and they change often. Treat any general statement — including this one — as a prompt to confirm the current language in your own agreement.
Data handling is one of the first lenses in a Celadon AI Audit, and a key input to choosing a provider.
Put governance on solid ground
Celadon assesses data handling, risk, and governance as part of every AI Audit — before a single production prompt is sent.
Get an AI Audit →