No provider gives you zero data retention by default. It is a contract you ask for, it covers a list of endpoints rather than an API, and it does not stop the provider reading a request while it runs.
| Provider | Default | Zero retention | What falls outside |
|---|---|---|---|
| OpenAI | Requests logged for 30 days for abuse monitoring | On request, per organisation, eligible endpoints only | Assistants and stored threads, files, batches, fine-tuning, vector stores |
| Anthropic | Inputs and outputs kept for 30 days for trust and safety | Arranged through sales | Batch, the Files API, and code execution |
| Paid services log prompts for a limited period for abuse detection | Enterprise arrangements | Consumer tiers, which train on data |
The last column is the part people miss. A ZDR agreement that covers the messages endpoint does not cover the batch endpoint, and a batch job is exactly where a large customer dataset goes.
What zero retention actually promises
It promises the request is not written to storage after the response is returned. It does not promise the request is not read. Abuse monitoring, safety classifiers and human review of flagged content all happen while the request is in flight, and every provider's terms carve those out.
The 30-day default is not a threat
Both OpenAI and Anthropic keep requests briefly to detect abuse, then delete them. For most workloads that is fine and the honest answer is that you do not need ZDR.
You need it when the data is someone else's — patient records, legal files, a client's source code under an NDA. Then the question is not which provider is trustworthy. It is which one will sign.
Read the exclusions first
Ask for the exclusion list before the price. If the endpoints you use are on it, the agreement buys you nothing, and you will find out during an audit rather than before.