Zero Data Retention (ZDR): Does Your Business Actually Need It to Use AI in 2026?

Quick Answer: Does Your Business Need ZDR?

You need contractual ZDR if you answer YES to any of these four questions: do you handle identifiable health data, have you signed strict NDAs with clients, do you work in a regulated industry (banking, insurance, legal, defense, pharma, public sector), or do you handle GDPR sensitive personal data (article 9)? If you answer NO to all four, ZDR is probably overkill and you’re paying 30 to 50% more for a feature you don’t need. The right answer depends on your data, not on marketing fear.

What ZDR Actually Is

Zero Data Retention is a contractual and technical commitment from the AI provider: your data passes through their servers to generate a response, then is immediately erased. No storage, no copy, no persistent logs.

Three levels of confidentiality coexist in the market, and many businesses confuse them.

Level 1: training opt-out. The provider doesn’t use your data to train its models, but keeps it in standard logs (usually 30 days). This is the default at OpenAI Business, Anthropic API, Mistral La Plateforme. Useful but insufficient if you handle sensitive data.

Level 2: no application logs. The provider doesn’t keep your prompts in logs, except for detected abuse. This is what Anthropic offers by default on its commercial API since 2024.

Level 3: contractual ZDR. No data is retained, not even in transient memory beyond request processing. Signed contractual commitment, generally reserved for Enterprise Agreements or European providers that make it their positioning.

True ZDR is rare and paid. Many actors market Level 1 as ZDR. Always read the official retention policy, not the product page.

How It Works Technically

Without ZDR, the lifecycle of an AI request looks like this:

1. You send a prompt to the API
2. The prompt is routed to a GPU server
3. The model generates a response
4. The prompt and response are written to logs (security, debug, abuse)
5. Logs are kept for 30 to 90 days
6. Some requests may be reviewed by humans to improve quality

With strict ZDR:

1. You send a prompt to the API
2. The prompt is processed in RAM only
3. The response is generated
4. The prompt and response are erased as soon as the response is returned
5. No application logs are kept

Important nuance: even with ZDR, some providers keep technical metadata (timestamp, token count, organization ID). This is not a GDPR issue, but you should know.

ZDR also doesn’t erase your own conversation history in the interface you use. If you go through a desktop or web app that stores your chats locally, that data stays with you. ZDR only concerns what happens on the model provider’s server side.

When Your Business Actually Needs It

Here’s the decision framework. You should require ZDR if you answer YES to any of these four questions.

1. Do you handle identifiable health data?

Medical records, patient IDs, history, test results. HIPAA compliance in the US and the special GDPR directive for “sensitive data” in Europe impose minimal retention at the processor level. Without ZDR, you transfer legal responsibility to a processor you don’t control.

2. Have you signed strict NDAs with your clients?

Many enterprise B2B contracts contain a “no third-party processing without prior consent” clause. If your client hasn’t signed a Data Processing Agreement with OpenAI, and you send their data to ChatGPT to write an email, you’re in breach. Contractually documented ZDR allows you to defend subcontracting.

3. Do you work in a regulated industry?

Banking, insurance, legal, defense, pharma research, public administration services. Regulators impose a traceable subcontracting chain. ACPR, AMF, CNIL, EBA, EMA, FDA, all have been watching AI processor retention since 2025.

4. Do you handle GDPR sensitive personal data?

Racial origin, political opinions, religion, sexual orientation, biometric data, criminal data. GDPR article 9 prohibits processing by default. Contractual ZDR is one of the few ways to prove that the processor doesn’t retain this data.

If you answer NO to all four questions, you probably don’t need ZDR. Here are the cases where it’s paranoia that costs time and money:

• Marketing brainstorming on already public products
• E-commerce product description generation
• Help writing blog articles
• Translation of public content
• Standard customer service responses without sensitive client data

For these uses, simple training opt-out is enough. You often pay 30 to 50% more for strict ZDR, without real benefit.

Which Providers Offer Real ZDR in 2026

The market has evolved a lot in 2025. Here’s the state at the time of writing, knowing policies change quickly. Always check the official policy before signing.

Provider	ZDR Available	Tier Required	Notes
Anthropic (Claude API)	Yes	Enterprise Agreement / Commercial Org	Default API already strong (no training, 30-day logs)
OpenAI (Azure)	Yes	Microsoft Enterprise Agreement	~500K USD annual volume threshold
OpenAI (ChatGPT Plus/Business)	No	N/A	Use API only for sensitive workloads
Mistral AI	Yes	Enterprise via La Plateforme	Most mature European option, GDPR by design
OpenRouter	Yes (per provider)	Filter on ZDR providers	Llama, DeepSeek, GLM, Qwen on ZDR servers
LLM Bay (France)	Yes	Default	100% local hosting, sovereign sector friendly
Infomania (Switzerland)	Yes	Default	Swiss data residency + ZDR
Vercel AI Gateway	Yes	Pro / Enterprise plans	Abstracts provider routing

To avoid for truly sensitive data: consumer interfaces (ChatGPT Free and Plus, Claude Free and Pro, Gemini standard). None offer ZDR on user subscription. For these cases, you need to go through commercial APIs with dedicated contracts.

ZDR Alone Isn’t Enough

ZDR only covers retention on the model provider’s side. Your data sovereignty depends on a complete chain, and the weakest link breaks all security.

The checklist before an AI deployment in a sensitive environment:

Does the model provider have a signed contractual ZDR? The contract, not the marketing page.

Does the interface you use store chats locally or in its cloud? ChatGPT Plus stores everything by default. Claude Pro too. An interface like OpenCode Desktop or Prisma Workspace keeps everything local on your computer.

Do connected tools (MCPs, plugins, integrations) respect the same policy? Many third-party plugins send prompts to their own servers before routing to the model.

Have your teams been trained on data triage? The best ZDR stack in the world doesn’t protect against an employee copy-pasting a confidential client contract into ChatGPT Free for a quick summary.

Is there an internal logging system on the company side? To be able to audit in case of a leak, you need to know which employee sent which data to which model, and when. Independently of provider ZDR.

ZDR is a necessary but not sufficient prerequisite. True sovereignty is a company policy, not a button to activate.

What 265+ AI Projects Have Taught Us About ZDR

At Kreante, we’ve shipped 265+ low-code and AI projects across 35+ countries since 2020. The pattern we keep seeing in SMB AI projects: businesses either over-engineer privacy (paying for enterprise ZDR they don’t need) or under-engineer it (pushing ultra-sensitive data into ChatGPT Free).

Our AI-Native framework starts with an AI maturity audit that asks three concrete questions. What data will pass through the AI? What contractual confidentiality has the company committed to its clients? What tools are already used internally without control (Shadow AI)?

The answers drive the stack. A Paris-based law firm handling litigation files doesn’t have the same need as a Latin American e-commerce generating product descriptions. The former goes to Mistral Enterprise or LLM Bay with signed ZDR. The latter can stay on ChatGPT Business with training opt-out.

The most common mistake we see in 2026: SMB founders treating ZDR as binary. It’s a cursor to position based on the reality of your data, not a checkbox to satisfy a vague privacy concern.

Conclusion

ZDR is a powerful tool for businesses that need it, and an unnecessary cost for those that don’t. Before you commit, ask yourself the four framework questions. If you answer YES to one, require contractual ZDR. Otherwise, standard training opt-out is enough.

And don’t forget that ZDR is just one link in the chain. The sovereignty of your data depends as much on your interfaces, your teams and your internal processes as on the model provider.

If you want to assess your current AI usage and know where you stand in terms of sovereignty, book a free 60-minute audit with Kreante. No commitment.