Zero data retention

Zero data retention (ZDR) is a contractual commitment from an LLM or AI API provider stating that submitted data (prompts, documents, and generated outputs) is not stored beyond the time needed to process the request, and is not used to train future models. It is typically formalized in a data processing agreement or an addendum to the provider's standard terms. For document processing, ZDR is often the difference between a vendor being usable for sensitive files and being ruled out entirely.

How it works

In practice, ZDR works through a combination of contract terms and infrastructure settings. A provider (say, OpenAI, Anthropic, or a cloud LLM API) offers an opt-in agreement that disables logging of inputs and outputs, or purges them within a short window (often measured in minutes or hours rather than days). Some providers separate this from "abuse monitoring" retention, which may still apply for a limited period even under ZDR terms, so the wording matters.

For a document processing vendor sitting on top of these models, ZDR has two layers: the vendor's own retention policy, and the retention policy of whichever LLM it calls. A company can promise not to store your invoices, but if it routes them through a third-party API without a ZDR agreement, the document may still sit in that provider's logs. Buyers should ask for both layers in writing, not just a marketing claim.

ZDR does not mean no processing happens. The document is still read, parsed, and analyzed in memory or in short-lived storage. What changes is what happens after: no persistent copy, no inclusion in training data, no indefinite audit log tied to content. This distinction matters when comparing vendors, since some conflate "we don't train on your data" with the stronger, and different, promise of "we don't retain your data at all."

Why it matters for document processing

Documents like invoices, contracts, and KYC files often contain personal data, financial terms, or business secrets. Sending them through an LLM without a retention agreement creates exposure that data protection and legal teams generally cannot accept, especially for GDPR-covered organizations. ZDR terms give a concrete answer to the recurring audit question: "where does this file end up?"

It also affects vendor selection directly. A document processing tool built on models without ZDR options limits what document types a company can safely automate. Contract analysis and KYC onboarding, for instance, routinely touch personally identifiable information and confidential clauses, so ZDR (or an equivalent on-premise/private deployment) is often a hard requirement rather than a nice-to-have. Vendors that can point to signed ZDR agreements with their model providers, or that offer regional processing without external LLM calls, tend to close enterprise deals faster because they remove a legal blocker early.

Related terms

• Data residency
• GDPR and document processing
• Security and compliance
• KYC onboarding
• Contract analysis

FAQ

Does zero data retention mean my documents are never processed by the AI model?

No. The document is still read and analyzed to generate results. ZDR means the provider does not keep a persistent copy afterward and does not use it to train future models. Processing happens, storage does not, or is limited to a short technical window needed to complete the request.

Is zero data retention the same as GDPR compliance?

No. ZDR addresses one specific risk, unwanted storage or model training on your data. GDPR compliance also requires a legal basis for processing, data subject rights, breach notification, and often data residency guarantees. ZDR terms support compliance but do not substitute for a full GDPR assessment.