WhichLLMAPIsofferzerodataretention?

A developer on r/cybersecurity pointed out that a zero data retention LLM API is “usually not enabled by default”, and that many teams assume an API call is covered when retention is a separate setting (thread). The provider table below was read from each vendor’s own page on October 27, 2026. Retention terms change often, so re-check the linked page before you send anything sensitive. This is a reading of vendor documentation, not legal advice and not an audit.

What does zero data retention mean, exactly?

Zero data retention means the provider processes your prompt, returns the response, and does not store either afterward. OpenRouter’s docs put it as “a provider will not store your data for any period of time.” In practice every vendor attaches carve-outs, so the useful question is what is still kept.

Typical carve-outs, all visible in the policies below:

• Metadata. Token counts, timestamps, model, and often IP address and key ID are retained for billing and operations.
• Safety retention. Some models keep content for abuse review even under a ZDR agreement.
• Stateful features. Threads, stored responses, files, vector stores and batch jobs persist data by design.
• Short caches. Prompt caches can hold data for minutes to 24 hours.

How is ZDR different from “we don’t train on your data”?

ZDR is about storage, while no-training is about use, and a provider can promise the second without the first. OpenAI says API data is not used to train its models unless you opt in, yet also says that “by default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days.” Google says it won’t train on your data without permission, and also says it may log prompts to detect abuse.

OpenRouter makes the same distinction: some endpoints “do not train on your data but do retain it,” for example for abuse scanning or legal reasons, and those don’t count as ZDR in its router.

Which providers offer a zero data retention LLM API?

Most major providers offer it, but only a few make it the default. The table summarizes each provider’s current wording, and the chart after it shows the longest retention window each one documents.

Two details deserve a longer look.

Anthropic’s covered models. In June 2026 Anthropic began requiring limited retention for its most capable models. The Register reported on August 20, 2026 that, as of June 9, prompts and outputs for these covered models are kept 30 days for safety work “on every platform where these models are offered.” Amazon’s Bedrock page reflects this: certain Claude models require its aws_review mode, under which content is retained within AWS for up to 30 days and may be reviewed by AWS, but isn’t shared with the model provider. Older Claude models are unchanged.

OpenAI’s response. OpenAI announced a preview of Private Safety Processing on August 19, 2026, aimed at detecting misuse across interactions without breaking ZDR, per Axios. It is a preview with early customers, so treat it as a direction, not a guarantee.

How do OpenRouter-style routers handle retention?

A router doesn’t keep your data by default, but it can only route you to providers whose policies you can accept. The diagram shows why: ZDR covers the provider’s inference step, while your own logs, the gateway and the provider’s stateful features sit outside that promise.

OpenRouter says prompts are not retained unless you opt in to logging. Its ZDR mode restricts routing to endpoints that have a ZDR policy, enforceable globally, per model group, per guardrail or per request. The per-request flag can only tighten, never loosen, an account-level rule.

Rules that matter for a developer:

• If OpenRouter can’t verify an endpoint’s policy, it assumes the endpoint “both retains and trains on data.”
• ZDR “only applies to provider routing for inference requests.” Web search and other tools follow their own policies.
• Implicit in-memory prompt caching is treated as not retaining data.
• Your own copy of the prompt, in app logs or an error tracker, is outside the guarantee.
• For private endpoints, OpenRouter records your declaration as an attestation and does not independently verify it.

The same logic applies to any gateway: you inherit the weakest hop in the chain. See the uncensored LLM API comparison for how routed and first-party hosts differ on this.

What do developers report in practice?

Developers mostly report that ZDR is hard to turn on and easy to overestimate. These are community reports, not our tests.

• A security-minded thread on r/cybersecurity (thread) argued ZDR is “usually not enabled by default.” Commenters said many teams assume an API call is covered when retention is a separate setting, and several preferred self-hosting for sensitive work because ZDR still requires trusting the provider’s implementation.
• In the Hacker News launch thread for Consus, a gateway founder said providers call their retention “abuse monitoring,” that most had agreed to disable it, and that one remaining case was an AWS classifier that can retain flagged requests for up to 30 days. That is the founder’s statement, not a verified fact. Other commenters pointed out that a gateway doesn’t control data leaving through tool results, web fetches or third-party MCP servers.
• A July 2026 write-up by a UK consultancy, SpotDev, argues “ZDR enabled” overstates the control: stateful endpoints stay out of scope, safety carve-outs can survive, and teams often move retention into their own logs. Its advice: ask for approval status per project, per endpoint, in writing.

What should you check before sending proprietary code?

Confirm approval, scope and your own logging before any proprietary code leaves your machine. A short checklist:

1. Is ZDR approved for your org or project? “Available” is not “enabled for you.”
2. Which model? Anthropic’s covered models and Bedrock’s aws_review models retain content for 30 days.
3. Which endpoints does your code call? Threads, stored responses, files, vector stores and batch jobs persist data.
4. Which features are on? Search grounding, caching, session resumption, and server-side tools have separate retention.
5. Where does your own tooling log? Editors, agents, proxies and error trackers keep their own copies.
6. Can you verify it? Azure exposes a ContentLogging: false flag; Anthropic shows retention under Settings, Privacy Controls. Most others offer only a contract.
7. Can you redact first? Stripping secrets and customer data before the request avoids the question.

When is self-hosting the only real answer?

Self-hosting is the only way to make retention something you control rather than something you were promised. If the code is under an NDA, export controls, or a client contract that forbids third-party processors, no ZDR agreement substitutes for keeping inference in your own environment. Open-weight models make that practical: see how to run an uncensored LLM locally and the self-host versus API cost breakdown.

Self-hosting has its own cost. You pay for GPUs or accept smaller models, and you still own the logging, access control and patching. The trade is trust in a vendor for work in your own team.

FAQ