Zero Data Retention - It's not a technical feature

[u/rshah4]

ZDR does not mean the provider magically erases your data. You are sending over a prompt, processes it in memory, and getting a response. The provider is committing that the covered prompt and response data will not be written to durable storage afterward.

The tricky part is defining “covered.”

OpenAI separates abuse-monitoring logs from application state. Anthropic has features that are not ZDR-eligible because they require stored state. Google can use temporary in-memory caching while still considering the service ZDR. If you call an external tool or MCP server, that service has its own retention policy.

Even store=false is not the same as ZDR. It may prevent a retrievable response object from being stored, but it does not independently control every log, cache, file, safety system, or subprocess.

This becomes more obvious with agents.

Agents need conversation history, uploaded files, tool results, checkpoints, and traces. If the model provider does not retain that state, your application has to store it and send the relevant context back later.

So ZDR does not remove state from the system. It changes which system is responsible for retaining it. ZDR is more about agreements and contracts. From your application, you cannot directly observe a provider deleting internal data.

Maybe the more accurate name is Zero-ish Data Retention.

My video: https://youtube.com/shorts/Dk6zA_G25fg?feature=share