ZDR Reference¶
Look-up facts for provider data-retention postures, feature eligibility, configuration keys, and audit checklists. Provider policies change often: every row carries the date it was last checked and the source it came from. When a row says "not re-verified", the official page could not be reached on 2026-09-25 and the value is carried over from the previous check.
Your contract wins
Every provider says the signed agreement (ZDR addendum, BAA, DPA) is the source of truth. The tables below describe the public documentation, not your contract.
Provider Policy Matrix¶
Default posture and how to reach zero retention, per provider. "Default retention" means what happens to prompts and outputs on a standard paid API account with no special arrangement.
| Provider | Default retention of prompts/outputs | ZDR mechanism | How to enable | Status (checked) | Source |
|---|---|---|---|---|---|
| Anthropic Claude API (incl. Claude Platform on AWS) | Official API docs: "not retained by default", except Covered Models (30 days). Claude Code data-usage page still says "Standard: 30-day retention" for commercial users (see discrepancy) | ZDR arrangement, per organization | Sales / account team; each new org enabled separately | Verified 2026-09-25 | API and data retention |
| Amazon Bedrock | Not stored or logged ("standard data handling for the model"); Covered Models need aws_review mode (up to 30 days, inside AWS) |
Account- or project-level data retention mode none |
PutAccountDataRetention API (no console UI, per secondary sources) |
Verified 2026-09-25 (API model) | Bedrock data protection, botocore model |
| OpenAI API | Abuse monitoring logs up to 30 days | ZDR or Modified Abuse Monitoring (MAM), per org or project | Prior approval by OpenAI (sales) | Partially verified 2026-09-25 (docs host blocked; spec + search) | Data controls |
| Azure OpenAI / Foundry Models sold by Azure | Flagged prompts/completions can be stored in a per-geography abuse monitoring store for human review | Modified abuse monitoring (Limited Access) | Application form; only customers managed by a Microsoft account team or in an eligible program | Verified 2026-09-25 | Data, privacy, and security |
| Claude in Microsoft Foundry | Anthropic is an independent processor; Hosted on Azure keeps prompts in Azure, only usage metadata and safety-flagged content egress to Anthropic | Anthropic terms apply; Covered Models need a separate subscription for ZDR orgs | Azure Marketplace deployment | Verified 2026-09-25 | Claude in Microsoft Foundry |
| Google Vertex AI / Agent Platform | Gemini: 24 h in-memory cache plus abuse-monitoring prompt logging | Disable caching + abuse-monitoring exception | Project-level cache config + support request (invoiced billing) | Not re-verified (last checked 2026-07-07; docs host blocked) | Vertex AI zero data retention |
| Mistral AI | TBD (default retention not stated on the ZDR page) | ZDR for stateless endpoints on paid plans | Request via support; appears in Admin > API > Privacy once approved | Verified 2026-09-25 | Mistral ZDR docs |
| OpenRouter (gateway) | OpenRouter itself does not retain prompts unless you opt in to prompt logging; upstream policy varies per endpoint | provider.zdr: true per request, account/guardrail toggles per model group |
Request parameter or privacy settings | Verified 2026-09-25 (docs repo) | OpenRouter ZDR |
| Groq | Up to 30 days for reliability/abuse monitoring (secondary sources) | Self-serve ZDR toggle | Console > Data Controls | Not re-verified (console.groq.com blocked) | Your data in GroqCloud |
| Fireworks AI | No prompt/completion retention for serverless inference by default (per source article) | Default | None | Not re-verified (docs host blocked) | Fireworks data handling |
Anthropic default retention discrepancy¶
Anthropic's own pages disagree on the default for commercial API traffic (checked 2026-09-25):
- The API docs say conversation content "is not retained by default; the exception is Covered Models, which require 30-day retention."
- The Claude Code data-usage page lists "Standard: 30-day retention period" for Team, Enterprise, and API users.
- Secondary sources report the Privacy Center moved API logs from 30 to 7 days on 2025-09-14 and later back to 30 days. The Privacy Center could not be fetched to confirm.
Treat the default as "up to 30 days" for planning, and rely on a ZDR arrangement if you need a firm no-retention commitment.
Anthropic Claude API¶
ZDR Scope¶
| In scope | Out of scope |
|---|---|
| Messages API and Token Counting API (eligible features only) | Claude Console, including the playground |
| Claude Code with Commercial-org API keys | Claude Managed Agents (sessions persist until deleted) |
| Claude Code through Claude Enterprise with ZDR enabled | Claude Free, Pro, Max; Teams and Enterprise chat interfaces |
| Claude Platform on AWS (on request) | Claude for Excel |
| Covered Models (Fable 5, Fable 5.1, Mythos 5, Mythos 5.1) unless expressly authorized | |
| Third-party integrations, CORS (browser) access | |
| Flagged content and legal holds (up to 2 years) |
Source: API and data retention, checked 2026-09-25.
Feature Eligibility (ZDR and HIPAA)¶
"Qualified" means prompts and outputs are not stored but a bounded technical artifact is. Under ZDR, "No" features are not blocked; using them steps outside ZDR for that data. Under HIPAA readiness, "No" features return 400 invalid_request_error.
| Feature | Endpoint | ZDR | HIPAA | Retained artifact / period |
|---|---|---|---|---|
| Messages API, thinking, effort, fast mode, citations, PDF (inline), search results | /v1/messages |
Yes | Yes | None |
| Token counting | /v1/messages/count_tokens |
Yes | Yes | None |
| Prompt caching | /v1/messages |
Yes | Yes | KV cache and hashes in memory for the cache TTL |
| Structured outputs / strict tool use | /v1/messages |
Yes (qualified) | Yes | JSON schema cached up to 24 h since last use (no PHI in schemas) |
| Cache diagnostics | /v1/messages |
Yes (qualified) | No | Hash fingerprint and token estimates, briefly |
| Web search | web_search tool |
Yes | Yes | Dynamic filtering not eligible |
| Web fetch | web_fetch tool |
Yes | No | Publishers may log fetched URLs |
| Tool search, advisor tool, context editing, compaction | /v1/messages |
Yes | No | None |
| Bash, text editor, memory, computer use | Client-side tools | Yes | Yes | Stored in your environment |
| Browser use | Client-side toolset | Yes | No (not blocked) | Stored in your environment |
| Batch processing | /v1/messages/batches |
No | No | 29 days |
| Files API | /v1/files |
No | No | Until deleted or expiry |
| Code execution, programmatic tool calling | code_execution tool |
No | No | Container data up to 30 days |
| Agent Skills | /v1/skills |
No | No | Standard policy |
| MCP connector | mcp_servers |
No | No | Standard policy |
| MCP tunnels (research preview) | /v1/tunnels |
No | No | See tunnel security docs |
| Claude Managed Agents | /v1/agents, /v1/sessions, /v1/environments |
No | No | Until deleted |
Retention Outside ZDR and HIPAA¶
| Data | Retention |
|---|---|
| Flagged inputs/outputs (trust and safety, any arrangement) | Up to 2 years |
| Covered Model prompts/outputs | 30 days (effective 2026-06-09) |
| Compliance Activity Feed | 6 years |
| Local session transcripts (Claude Code, Cowork) via Compliance API | 6 years default, or the org's finite custom retention |
| Remote session transcripts (Cowork in the cloud) | 6 years unless deleted |
Claude Code /feedback, /bug, /share transcripts |
5 years |
Claude Code local transcripts (~/.claude/projects/) |
30 days by default (cleanupPeriodDays) |
Covered Models¶
| Fact | Value |
|---|---|
| Models | Claude Fable 5, Fable 5.1, Mythos 5, Mythos 5.1, and future similarly capable models Anthropic designates |
| Effective | 2026-06-09 |
| Retention | 30 days, on every platform the models are offered |
| Where data sits | Anthropic (Claude API, Claude Platform on AWS); inside AWS or Google Cloud on Bedrock / Agent Platform |
| Error without retention | 400 invalid_request_error: "In order to access this model, your organization or workspace must have data retention enabled." |
| ZDR org workaround | Enable 30-day retention on one workspace (Console > Settings > Workspaces > Privacy controls) |
| Azure | ZDR-configured organizations need a separate subscription; Covered Models are Hosted on Anthropic only |
| Interim exception | Eligible customers get ZDR on Fable 5 / 5.1 until Enterprise Frontier Safeguards ships (announced 2026-09-01) |
Sources: Covered Models retention practices, Enterprise Frontier Safeguards.
Claude Code Features Disabled Under ZDR (Claude Enterprise)¶
| Feature | Reason |
|---|---|
| Cloud sessions (web, Desktop cloud sessions) | Server-side session storage |
| Claude Tag | Channel memory and transcripts |
| Artifacts | Published page content on Anthropic infrastructure |
/feedback, /bug, /share |
Sends conversation data to Anthropic |
| Remote Control | Transcript stored to sync devices |
Chat on claude.ai, Cowork, analytics metadata, seat management data, and third-party MCP servers stay outside ZDR. Source: Claude Code ZDR.
Amazon Bedrock Data Retention Modes¶
Amazon Bedrock added account-level retention APIs on 2026-06-09 (botocore 1.43.26) and the aws_review mode on 2026-09-04 (botocore 1.43.89). The enum below is copied from the botocore service model.
| Mode | Meaning |
|---|---|
default |
The standard data handling for the model applies |
none |
Zero data retention; requests to models or APIs that need retention are blocked |
aws_review |
AWS may review request data; data is not shared with the model provider. Required for Claude Fable 5 / 5.1 |
provider_data_share |
Data may be shared with the model provider |
inherit |
No mode set at this scope (project inherits from account) |
| API | HTTP | CLI |
|---|---|---|
GetAccountDataRetention |
GET /data-retention |
aws bedrock get-account-data-retention |
PutAccountDataRetention |
PUT /data-retention |
aws bedrock put-account-data-retention --mode none |
Mode none blocks stateful APIs
Per the AWS data-retention guide, APIs that need retention to function, for example the Responses API with store=true, are blocked when the mode is none.
OpenAI API¶
| Fact | Value | Source |
|---|---|---|
| Abuse monitoring logs | Up to 30 days by default, longer if legally required | Data controls |
| Controls | Zero Data Retention or Modified Abuse Monitoring, per organization or project, after prior approval | Same |
store under ZDR |
Always treated as false |
Same (checked 2026-07-07) |
| Stateless reasoning | Request include: ["reasoning.encrypted_content"] to carry reasoning items across turns when store=false or the org is in ZDR |
OpenAPI spec |
| Prompt cache retention (older models) | ZDR orgs default to in_memory; non-ZDR orgs default to 24h |
OpenAPI spec (checked 2026-09-25) |
Prompt cache retention (gpt-5.5, gpt-5.5-pro, later) |
Only 24h supported; prompt_cache_retention is deprecated in favor of prompt_cache_options.ttl |
OpenAPI spec |
| Extended prompt caching | Not ZDR-eligible (KV tensors stored as application state) | Data controls (checked 2026-07-07) |
| Videos API / DALL-E | Blocked for ZDR/MAM orgs; image generation ZDR-compatible only with gpt-image-* |
Data controls (checked 2026-07-07, not re-verified) |
| CSAM classifier hits | Retained for manual review regardless of ZDR/MAM | Same |
| Frontier-model ZDR | Announced 2026-08-21 with Private Safety Processing (phased rollout) | OpenAI announcement |
Azure OpenAI and Foundry¶
| Fact | Value |
|---|---|
| Model statelessness | Prompts and completions are not stored in the model and not used to train base models |
| Stateful features that store data | Responses API, Assistants Threads, Stored completions, Files, vector stores, Batch, fine-tuning. Stored in the customer's geography, AES-256, deletable |
| Abuse monitoring store | Per geography; human review only of flagged content via Secure Access Workstations and JIT approval; EEA reviewers for EEA deployments |
| Modified abuse monitoring | Removes storage and human review; automated review still runs |
| Eligibility | Customers managed by a Microsoft account team or in an eligible program; some advanced models have stricter criteria |
| Verification | ContentLogging: false appears in the resource capabilities only when storage is off |
| Global / DataZone deployments | Processing can occur in any geography (Global) or within the data zone; data at rest stays in the customer geography |
Sources: data privacy include (change log last entry 2025-10-03), abuse monitoring include (2026-05-13), limited access include (2026-03-19).
Retention window no longer stated
Earlier Azure OpenAI docs described a 30-day window for the abuse monitoring store. The 2025-10 and 2026-05 revisions do not state a duration. Ask Microsoft for the current figure if your audit needs it.
Mistral AI¶
| Fact | Value |
|---|---|
| Availability | Paid plans, per-request review (may be denied) |
| ZDR endpoints | /v1/chat/completions, /v1/fim/completions, /v1/embeddings, /v1/moderations, /v1/chat/moderations, /v1/classifications, /v1/chat/classifications, /v1/ocr, /v1/audio/speech, /v1/audio/transcriptions |
| Excluded | Labs models; Agents, batch files, Conversations, Libraries, /v1/files, Vibe Work, Chat |
| Training opt-out | Separate control; ZDR not required to opt out |
| Regional inference | api.eu.mistral.ai, api.us.mistral.ai at 1.1x list price; stateful features unavailable there |
Source: mistralai/platform-docs-public (ZDR and regional inference pages), checked 2026-09-25.
OpenRouter Routing Controls¶
| Control | Scope | Effect |
|---|---|---|
provider.zdr: true |
Per request | Route only to endpoints with a ZDR policy; OR-ed with account and guardrail settings |
provider.data_collection: "deny" |
Per request | Route only to providers that do not collect (train on) data; not the same as ZDR |
| Privacy settings | Account, per model group (Anthropic, OpenAI, Google, SpaceXAI, other) | Enforce ZDR for that group |
| Guardrail fields | enforce_zdr_anthropic, enforce_zdr_openai, enforce_zdr_google, enforce_zdr_xai, enforce_zdr_other |
Per API key or member; enforce_zdr is deprecated |
| ZDR endpoint list | GET https://openrouter.ai/api/v1/endpoints/zdr |
Machine-readable list |
Scope limits
OpenRouter ZDR covers provider routing only, not plugins such as web search. OpenRouter treats in-memory implicit prompt caching as "not retaining", so cached endpoints stay eligible.
PII Redaction Tools¶
| Tool | Type | Approach |
|---|---|---|
| Microsoft Presidio | Open source | NER + regex + checksums; analyzer and anonymizer services |
| LLM Guard | Open source | LLM-specific input/output scanners: PII, prompt injection, output validation |
| Amazon Comprehend | Managed | PII detection API |
| Google Sensitive Data Protection | Managed | 150+ built-in infoTypes; format-preserving (reversible) encryption |
| Amazon Bedrock Guardrails | Managed | Sensitive-information policy (ANONYMIZE or BLOCK per entity type) |
Audit Evidence Checklist¶
- Configuration artifacts: Azure
ContentLogging: false; Bedrockget-account-data-retentionreturnsnone; Anthropic workspace privacy settings screenshot; OpenAI org/project data-retention setting. - Negative tests: stored-object retrieval fails (OpenAI stored completions, Bedrock invocation log group empty).
- Environment audit: proxies, APM, error trackers, and LLM observability tools do not log raw prompts.
- Contractual proof: ZDR addendum, BAA (HIPAA), DPA (GDPR), SOC 2 Type II report.
- Feature inventory: list of stateful endpoints in use (batch, files, code execution, Responses
store=true) and their retention. - Model inventory: model IDs in use and whether any is a retention-required model (Anthropic Covered Models, Bedrock
aws_review).
Self-Hosted Hardware Sizing¶
Approximate memory for self-hosted open-weight models (weights only; KV cache and activations need extra headroom).
| Model size | VRAM (FP16) | VRAM (INT4) | Example GPU | System RAM |
|---|---|---|---|---|
| 7B | ~14 GB | ~4 GB | 1x RTX 4090 | 16 GB |
| 13B | ~26 GB | ~7 GB | 1x RTX 4090 / A100 | 32 GB |
| 32B | ~64 GB | ~18 GB | 1x A100 80GB / H100 | 64 GB |
| 70B | ~140 GB | ~38 GB | 2x A100 80GB / 2x H100 | 128 GB |
| 400B+ (MoE) | ~800 GB | ~200 GB | 8x H100 | 512 GB |
| 671B MoE (DeepSeek-R1/V3) | ~1.3 TB | ~340 GB | 8x H100 (FP8) or 8x H200 | 1 TB |
The FP16 column is 2 bytes per parameter; INT4 is roughly 0.5 bytes per parameter plus overhead. DeepSeek-V3/R1 ship FP8 weights (~671 GB).
Self-Hosted Hardening Checklist¶
- Private VPC/subnet, no internet egress from inference nodes.
- Auth proxy (OAuth2 Proxy, Envoy JWT filter) in front of the OpenAI-compatible endpoint.
- TLS terminated at a load balancer or reverse proxy; inference port never exposed.
- Audit logs record identity, timestamp, and model, never prompt content.
- Model weights verified against official checksums; no untrusted mirrors.
Policy Timeline¶
| Date | Change | Source |
|---|---|---|
| 2025-05-13 | US court orders OpenAI to preserve consumer ChatGPT and API output logs (NYT case); ZDR API and ChatGPT Enterprise/Edu excluded | OpenAI response |
| 2025-09-14 | Anthropic API log retention reported cut from 30 to 7 days (secondary sources) | Secondary |
| 2025-10-09 | Preservation order ended going forward (logs after 2025-09-26 no longer preserved) | Engadget |
| 2026-06-09 | Anthropic Covered Models (Fable 5, Mythos 5) require 30-day retention; Bedrock account data retention API ships | Anthropic, botocore |
| 2026-08-21 | OpenAI announces ZDR for frontier models and Private Safety Processing | OpenAI |
| 2026-09-01 | Anthropic announces Enterprise Frontier Safeguards (EFS); interim ZDR on Fable 5/5.1 for eligible customers | Anthropic |
| 2026-09-04 | Bedrock adds aws_review retention mode |
botocore 1.43.89 |
| 2026-09 | Claude Fable 5.1 / Mythos 5.1 released as Covered Models | Anthropic |