# LLM Zero Retention vs. Zero Logging: What You Need to Know

> Understand the critical differences between zero retention and zero logging in LLMs. Learn about data retention policies, abuse monitoring, and key questions to ask vendors.

Published: 2026-09-09

Canonical: https://sygnet.ai/blog/llm-zero-retention-vs-zero-logging

---

## Key takeaways

- "Zero retention" and "zero logging" are different promises: by default OpenAI generates abuse-monitoring logs for all API feature usage and keeps them up to 30 days, and only approved customers get their content excluded.
- Even under a signed ZDR arrangement, safety metadata survives: Anthropic still retains User Safety classifier results to enforce its Usage Policy, and flagged sessions can mean inputs and outputs kept up to 2 years and classification scores up to 7 years.
- Retention hides in features, not just contracts: Gemini models cache inputs for up to 24 hours in the serving data centre, and you must disable data caching to achieve zero data retention.
- Your DPA's weakest link is usually the subprocessor clause: OpenAI's DPA gives customers 30 days to object to a new sub-processor after notice, which is worthless if nobody at your company reads the notice.

## What is the difference between "zero retention" and "zero logging"?

Zero retention means the vendor does not persist your prompts and outputs after the request completes; zero logging would mean nothing about the request is recorded at all, and almost no LLM provider offers that. The gap between the two is filled by abuse monitoring, classifier scores, transient caches and stateful endpoints.

The mechanics are explicit in the documentation. Abuse monitoring logs may contain customer content such as prompts and responses, plus metadata derived from that content like classifier outputs, and by default they are retained for up to 30 days unless longer retention is required by law or is reasonably necessary to protect the services or a third party from harm. Eligible customers can have content excluded from those logs via Zero Data Retention or Modified Abuse Monitoring controls, subject to prior approval and additional requirements. So "ZDR" removes the routine content copy, it does not switch off the safety pipeline, and it does not delete derived signals.

For document AI this matters more than for chat, because a single invoice, medical certificate or KYC file contains dozens of identified data subjects, not one user's question.

## Which layer of the stack actually retains your documents?

Retention is decided at three layers, the model provider, the IDP vendor, and the cloud distribution channel, and they have different defaults. Auditing only one gives you a false assurance.

At the channel layer the spread is wide. Amazon Bedrock states it doesn't store or log your prompts and completions, doesn't use them to train AWS models and doesn't distribute them to third parties, and its abuse detection mechanisms are fully automated, with no human review of or access to user inputs or model outputs. But exceptions now exist per model: for models requiring `aws_review`, prompts and completions are retained within the AWS boundary for up to 30 days and may be reviewed by AWS to meet a human-review requirement the model provider imposes as a condition of access. On Azure, there is no deployment option giving Modified Abuse Monitoring by default and no resource setting to disable abuse monitoring, it is a request process for eligible customers.

If your IDP vendor cannot name the exact channel and model version behind each pipeline, the retention answer is unverifiable, one reason the [build-versus-buy calculation for IDP](https://sygnet.ai/build-vs-buy-idp) should include contractual due diligence, not just engineering cost.

## How do provider defaults compare?

| Provider / channel | Default content retention | Route to zero retention | Residual data even with ZDR |
|---|---|---|---|
| OpenAI API | Up to 30 days of abuse-monitoring logs, all API features | ZDR or Modified Abuse Monitoring, prior approval required | `store` forced to false; background mode writes to disk ~10 min for polling |
| Azure OpenAI / Foundry | Up to 30 days, may be subject to human review | Modified Abuse Monitoring application, managed customers via account team | Automated detection and abuse prevention remain active |
| Anthropic Claude API | Inputs and outputs deleted on the backend within 30 days of receipt or generation | Approval-based arrangement for eligible API and Claude Code Enterprise customers | Up to 2 years for flagged content, 7 years for classification scores |
| Google Vertex AI / Gemini | Cached content up to 24 hours in the serving data centre | Disable data caching and request an abuse-monitoring exception | In-RAM implicit cache with 24-hour TTL, deemed compatible with ZDR |
| Amazon Bedrock | No storage or logging of prompts and completions | Default posture | Model-specific `aws_review` retention up to 30 days |

## What are the 12 questions to ask before signing?

Ask them in writing, and require the vendor to answer per pipeline rather than per company. A single "we're ZDR" line in a security whitepaper is not an answer.

### Prompt logs and abuse windows (Q1–Q5)

1. Which model endpoints does each document pipeline call, and is ZDR or Modified Abuse Monitoring approved for **each** of them? Approved customers select between the two controls at organisation or project level, so approval can exist for one project and not another.
2. Which features silently break ZDR? Features marked ineligible are typically stateful, they store jobs, files or container state, which is why they cannot be zero-retention, and using one is a choice to step outside the arrangement for that data.
3. What derived metadata survives? Ask specifically about classifier scores and their retention clock.
4. What is the flagged-content path? Even with ZDR or HIPAA arrangements, data may be retained where required by law or where flagged by automated trust and safety systems, up to 2 years for a flagged chat or session.
5. Are caches disabled? Achieving zero data retention on Vertex requires disabling data caching.

### The vendor's own storage (Q6–Q9)

6. Does the IDP vendor store the source PDF, the page images, the extracted JSON, or all three, and for how long?
7. Are [human-in-the-loop review](https://sygnet.ai/glossary/human-in-the-loop) queues in scope? Reviewer interfaces are a second, often undocumented copy of the document.
8. Where do embeddings and index shards live, and are they deletable per document?
9. Do error queues, debug traces and observability tools retain payloads? Even where ZDR endpoints are used, downstream systems, analytics, logging, backup, may inadvertently retain interactions presumed short-lived.

### Subprocessors and legal overrides (Q10–Q12)

10. Can you get the full chain, not the top layer? EDPB Opinion 22/2024 reads strictly on full-chain visibility: controllers should have the identity, name, address, contact person, of all processors and sub-processors.
11. What is the notice period and objection mechanism? Article 28(2) GDPR bars engaging another processor without prior specific or general written authorisation, and under general authorisation the processor must inform the controller of intended changes.
12. What happens under a legal hold? See below.

## Can a court order override your zero-retention clause?

Yes for the default tiers, and that is precisely why the ZDR paperwork matters. In the New York Times litigation, a May order compelled OpenAI to "preserve and segregate all output log data that would otherwise be deleted," regardless of user deletion requests. The plaintiffs demanded retention of even deleted ChatGPT chats and API content that would typically be removed within 30 days.

The carve-out is instructive: the original order applied to ChatGPT free, Plus, Pro and Team users but explicitly excluded Enterprise, Education and API customers under zero data retention agreements. OpenAI's own explanation was that for business customers on the ZDR API it never retains prompts or answers, so because the data is not stored the order doesn't affect it. The order was later wound down, a new order on 9 October 2025 freed OpenAI from the obligation to preserve output log data going forward, but logs already saved under it remain accessible.

Practical reading: the only durable defence against third-party discovery is data that was never written. Contract language alone does not delete anything, which is why architecture beats promises for sensitive flows like [KYC onboarding](https://sygnet.ai/solutions/kyc-onboarding).

## Why does the subprocessor list decide your GDPR exposure?

Because the retention clause governs one vendor while the subprocessor list governs everyone the vendor hands your documents to, and the notice window is short. OpenAI's DPA grants a general authorisation to the listed sub-processors, notifies changes via blog post, in-service notification, other reasonable means, or email for customers who subscribe, and gives 30 days to object. Note the subscription condition: notification is push, not pull, controllers must be informed in time to object, and expecting them to watch a web page does not discharge the obligation.

Two operational fixes cost nothing. First, subscribe to every provider's subprocessor notification channel with a shared mailbox, not one engineer's inbox. Second, define the objection outcome in advance: the objection path has to exist before someone objects, with the consequence, workaround or termination of the affected services, defined up front. EDPB Guidelines 07/2020 warn that a processing contract should not merely restate Article 28 but include specific, concrete information on how the requirements will be met. Sygnet publishes its own processing and retention posture on its [security and compliance page](https://sygnet.ai/security) for exactly this reason.

## FAQ

### Does zero data retention mean the vendor never sees my documents?

No. It means content is not persisted after the response is returned. Automated safety classifiers still run, and human access remains possible on a controlled path, Anthropic states no personnel can read retained conversations by default, and that human review occurs only through a controlled access path, for example when content is flagged by automated trust and safety systems. Ask for the flagged-content procedure, not just the retention number.

### Is abuse monitoring compatible with GDPR data minimisation?

It is a documented processing purpose, so it is not automatically unlawful, but it must appear in your records and your DPIA. Article 5 GDPR requires personal data to be kept in identifiable form no longer than necessary, and sending PII to a provider that stores prompts for 30 days sits in tension with that storage limitation principle. For special-category documents, prefer a channel where the default is no storage, then document why.

### How long does it take to get abuse-monitoring exemptions approved?

Plan for weeks, not days, and treat it as a release blocker. On OpenAI, ZDR and Modified Abuse Monitoring are subject to prior approval and acceptance of additional requirements; on Azure, managed customers request the Modified Abuse Monitoring form through their account representative, and the option is not available for unmanaged tenants. Also verify activation afterwards rather than assuming the approval email changed the runtime configuration.

### What should a DPA say about deletion of extracted data?

It should separate the document, the derived structured output, and the safety metadata, with a retention period and a deletion mechanism for each. Article 28(4) requires sub-processors to be bound by the same data protection obligations, and if a sub-processor fails, the processor is liable, so deletion commitments that stop at the first vendor are incomplete. Require deletion confirmation covering backups and review queues, with a stated maximum lag.