Use Bedrock's None Mode to Enforce Zero Data Retention

If your AI vendor approval says "zero data retention," check which endpoints your application calls, because the commitment covers only some of them. Zero data retention (ZDR) is a provider's agreement not to store your prompts and outputs at rest after it returns a response. In OpenAI's data controls table, 15 of the 28 endpoints listed are marked ineligible, including files, batches and vector stores. Anthropic says plainly that its API does not block ineligible features under ZDR.

The recommendation, based on each vendor's live documentation checked on November 9, 2026: approve ZDR per endpoint and per model, never per vendor. If you need a control your own team can enforce, use Amazon Bedrock with data_retention_mode: none and deny every other value with a Service Control Policy. If you buy Claude or OpenAI models directly, ZDR works, but you must put an endpoint allowlist in your own gateway. Google Vertex AI is the loser on this one question, because ZDR there is a set of separate switches, some of which cannot be switched off.

Provider	Control	How you get it	Outside the promise	When you call something ineligible	Verdict
OpenAI API	ZDR or Modified Abuse Monitoring	Sales approval, then a Data Retention tab	Files, batches, vector stores, fine-tuning, evals, Assistants, Conversations	The call works and state is kept	Good if you hold conversation state yourself
Anthropic Claude API	ZDR, per organization	Sales or account team	Files, batches, code execution, MCP connector, Agent Skills, Managed Agents, Console	The call works and that data leaves ZDR	Clearest documentation
Azure OpenAI in Microsoft Foundry	Modified abuse monitoring	Application form, managed customers only	Stored Responses history, files, vector stores, batch (held in your resource)	Feature stores data as designed	Right if you already have a Microsoft account team
Amazon Bedrock	data_retention_mode: none	An API call, per Region	Models that require retention: Fable 5 and 5.1, and OpenAI models other than gpt-oss	The request is blocked	Best enforcement
Google Vertex AI	No single switch	Per-feature settings, account team for some	Search grounding logs (3 days), Maps grounding (30 days), Deep Research (7 days)	Depends on feature and contract	Weakest for ZDR

Google's documentation now also calls this product Gemini Enterprise Agent Platform. OpenAI and Anthropic send ZDR requests to sales and publish no ZDR price, and Bedrock's retention page lists no fee for the mode (all checked November 9, 2026).

---

How ZDR Compares on One Workload

ZDR coverage changes with the features a workload uses, so the fair comparison is one defined application. Take a contract-review assistant that keeps multi-turn chat, accepts uploaded PDFs, re-runs a nightly batch, executes code on the provider's servers, and grounds answers on the web.

Feature	OpenAI	Anthropic	Azure OpenAI	Bedrock	Vertex AI
Server-side chat state	store forced false; Conversations ineligible	Message threads ineligible, in memory, deleted within 1 hour of last use	Responses history stored in your resource	store=true rejected	Interactions API stores unless store is false
Uploaded files	Ineligible, kept until deleted	Ineligible, kept until deleted or expired	Stored in your resource until you delete	Not stated	Not stated
Batch	Ineligible, kept until deleted	Ineligible, 29 days	Stored in your geography, processed globally	Not stated	Not stated
Hosted code execution	Containers deleted on expiry or request	Ineligible, up to 30 days	Not stated	Not stated	Sandbox snapshots kept for the sandbox TTL
Web grounding	Live web use is not BAA-covered	Eligible, except dynamic filtering	Not stated	Not stated	Search logs 3 days, Maps 30 days
Prompt caching	Encrypted tensors stored up to 24 hours	Eligible; held in memory for the cache TTL	Not stated	Not stated	On by default; durable tier up to 24 hours unless disabled

"Not stated" means the provider's retention documentation is silent, so that cell is a question for your account team. On this workload, the PDF upload and the nightly batch take the assistant outside ZDR on both direct APIs, and Grounding with Google Search does the same on Vertex.

---

OpenAI's ZDR Forces Store Off and Leaves Stateful Endpoints Out

OpenAI ZDR removes your content from abuse logs and forces store to false on /v1/responses and /v1/chat/completions, and it does nothing for endpoints marked ineligible. Those are conversations, ChatKit threads, agents, Assistants, threads, vector stores, audio voices, files, fine-tuning jobs, evals and batches. Assistants, threads and vector store objects are deleted 30 days after you delete them, and undeleted objects stay indefinitely.

OpenAI also offers a lighter control. Modified Abuse Monitoring removes content from the 30-day abuse logs across API endpoints (image and file inputs can be an exception in rare cases) while leaving full platform capabilities available, so stored responses and files keep working. Check which control your amendment names, because a procurement summary that says "ZDR" may describe MAM.

Do not pick OpenAI's direct API under ZDR if your application is built on previous_response_id, Assistants or hosted vector stores. Those designs need the state that ZDR excludes.

Anthropic Publishes the Clearest Table and Still Lets You Step Out

Anthropic's ZDR covers the Messages and Token Counting APIs for eligible features, and its feature table is the most useful single page any of these vendors publishes on the subject. Prompt caching, computer use, web search and PDFs sent inline are eligible. Batch processing (29 days), the Files API, code execution (up to 30 days), the MCP connector, Agent Skills, message threads and Managed Agents are not.

The catch is enforcement. HIPAA-enabled organizations get a 400 error on a non-eligible feature, while ZDR organizations do not. Anthropic describes using one as "a choice to step outside your ZDR arrangement for that specific data," which means one engineer adding the code execution tool changes your retention posture and the API will not stop the request.

ZDR is also enabled organization by organization, and new organizations under the same account need it enabled separately. The Claude Teams and Enterprise interfaces, the Console and Claude for Excel are outside it, and our review of the Workspace add-on covers another gap of that kind. Do not pick the direct Claude API if you need EU processing: only us and global inference are offered, and workspace storage is us only.

Azure Requires Approval, While Bedrock Gives You a Setting

Azure OpenAI's equivalent is modified abuse monitoring, and it is an application. Microsoft limits it to customers and partners managed by a Microsoft account team or under an eligible program, and says some advanced models carry stricter criteria. By default, flagged prompts and completions may be sampled for automated review, with human review by authorized Microsoft employees when needed.

Approval removes storage and human review. Automated review at request time can continue, and severe or recurring abuse can still limit your access. Neither current Microsoft page states how long abuse data is kept, so ask for that number in writing. Do not pick Azure for ZDR if you buy through self-serve billing with no account team or eligible program, because you cannot apply.

Bedrock's control is an API setting. PUT /data-retention with mode none means no request or response data goes to durable storage, and an SCP can deny any other value across the organization, with separate statements for the bedrock-mantle and control plane actions. If a model requires retention, Bedrock blocks the request. AWS also says retained data is not shared with third-party model providers.

Three limits apply. The setting is per Region and does not propagate, so an unconfigured Region stays at inherit. It is documented for the Messages, Chat Completions and Responses APIs, so ask AWS about batch and Knowledge Bases. And background mode is unavailable. Do not pick Bedrock if your priority is Fable under ZDR after December 31, 2026, for the reason below.

Vertex AI Comes Last Because ZDR Is Spread Across Many Settings

Vertex AI has no single retention control, and the outcome depends on your contract, your model and each feature. The case for it is real: Google's data governance page is candid about every exception. On Google's standard models, customers on a Cloud Master Agreement are exempt from prompt logging by default, while customers on the online terms can have flagged prompts logged for up to 90 days and reviewed by Google staff.

Google's page lists the rest. Caching is on by default and must be disabled by project. Search grounding logs last up to 3 days and Maps grounding data 30 days, and neither can be turned off. For ZDR, Google recommends Web Grounding for Enterprise. The Deep Research agent keeps session data for 7 days. Interactions API storage defaults on. OpenAI flagship models on Google Cloud log for up to 30 days by default, and existing OpenAI ZDR approvals do not carry over. If your cloud commit already decides the platform, Vertex can still work. Do not pick it for ZDR if you are on online terms or depend on Grounding with Google Search or Maps.

---

Your ZDR Can Exclude the Model You Want

Some models require retention regardless of your agreement. Anthropic's Fable 5.1, Mythos 5.1, Fable 5 and Mythos 5 require 30-day retention and are not available under ZDR unless Anthropic expressly authorizes it. After enterprise pushback and discussions with more than 100 enterprise customers, eligible customers can use ZDR with Fable 5 and 5.1 for their own internal business applications for a limited time until Enterprise Frontier Safeguards replaces it, with the option to keep monitoring data in infrastructure the customer controls.

On Bedrock the end date is published. Customers eligible for Enterprise Frontier Safeguards receive ZDR through December 31, 2026, after which all Fable traffic is retained for up to 30 days for automated offline abuse detection. Accounts without ZDR approval for Fable must use the aws_review mode, which permits human review by AWS. A ZDR organization that wants Fable on the direct API can turn on 30-day retention for one workspace and leave the rest at zero, and that is the design to copy.

OpenAI reserves a similar right. It may make models ineligible for ZDR or MAM for specific customers, with advance written notice. Under Private Retention, content on those models then sits in encrypted abuse logs without human review. Under Safety Retention, which OpenAI reserves for severe-risk cases, content its classifiers flag can be retained and reviewed by people.

What Still Persists Under ZDR

Most providers here keep something under ZDR, usually safety data and whatever the law requires. Anthropic still retains User Safety classifier results under ZDR, flagged sessions can be kept for up to 2 years, and its commercial retention policy gives up to 7 years for classification scores. OpenAI retains images that a classifier flags as potential CSAM for manual review, even with ZDR active. Bedrock may store and review flagged CSAM and report it to NCMEC.

Legal holds are the other exception. In the New York Times litigation, a May 13, 2025 order required OpenAI to preserve output logs that would otherwise be deleted, and that ongoing duty ended on September 26, 2025, with already-segregated logs kept. OpenAI said API customers on ZDR endpoints were unaffected, since their content is never stored. Content held in a stateful endpoint is stored, so that argument does not extend to it.

Metadata also survives. OpenAI's residency scope excludes account, billing and usage data, and data sent to remote MCP servers follows those servers' own policies. Google records token counts and latency for OpenAI models under ZDR. Our audit logging guide covers the logs you must keep yourself, which ZDR makes more necessary.

ZDR, No-Training and Data Residency Are Three Separate Promises

These three commitments answer different questions, and holding one tells you nothing about the others. No-training governs use: OpenAI says API data is not used for training unless you opt in, and Microsoft says the same of prompts and completions on models it sells. ZDR governs storage. Residency governs location.

Buyers often assume residency comes with the other two. On Azure, a Global deployment may process prompts in any geography where the model is deployed, even though data at rest stays in yours, and batch is a Global deployment type. Bedrock cross-region inference stores retained data in the destination Region. OpenAI's non-US regions require MAM or ZDR approval, and seven of them (Australia, Canada, Japan, India, Singapore, South Korea and the UK) offer regional storage without regional processing.

Residency also costs money. As checked November 9, 2026, OpenAI charges a 10% uplift on eligible models released on or after March 5, 2026, and Anthropic prices US-only inference at 1.1x on Claude 4.6 and later.

Which Features You Lose When You Turn ZDR On

Expect to rebuild anything that relied on the provider holding state. On OpenAI, stateful Responses use stops working, so you request reasoning.encrypted_content and pass those items back yourself. Developers have reported a 404 on the second turn of computer-use calls with store: false until they did that, so test multi-turn tool flows before you switch.

On Anthropic, ZDR organizations cannot call the API from a browser, since cross-origin requests are rejected. Claude Code on Enterprise under ZDR loses cloud sessions, Remote Control, Artifacts, Claude Tag and /feedback, and developers signed in to a personal account are outside the arrangement altogether.

Bedrock under none removes background mode. Disabling Vertex caching removes its cost benefit. Azure warns that abuse detection may be less accurate without human review, and that you should be prepared to answer abuse notices quickly to avoid an interruption.

---

How to Verify ZDR in the Contract and in Production

Verify it twice, because the contract proves the promise and the configuration proves the deployment. The contract should attach an exhibit naming covered endpoints, features and models by identifier, since Anthropic itself tells readers to treat contract terms as the current source. Then ask for these terms:

1. Written notice before any model or endpoint becomes ineligible, with a right to exit.
2. A maximum retention period for flagged content, and who may review it and from where.
3. Notice of any legal hold reaching your data, where the law permits.
4. A statement of which organizations, projects and workspaces are covered.
5. A separate line for each cloud route, because a direct agreement does not bind Bedrock or Google-managed Claude, where the cloud is the processor.

In production, each vendor gives you a different check. OpenAI shows the status in a Data Retention tab under organization data controls. Anthropic shows a retention period in its privacy controls. On Azure, run az cognitiveservices account show and look for ContentLogging set to false, a property that appears only once storage is off. On Bedrock, call GET /data-retention in every Region you use, and read each model's allowed_modes on the bedrock-mantle endpoint. Also confirm model invocation logging is off, since once enabled it stores full prompts until you delete the configuration. On Vertex, GET the cacheConfig per project.

When You Should Skip ZDR

Most teams should start from a no-training clause and standard 30-day retention, and buy ZDR only for specific workloads. The strongest argument against ZDR is that it trades away provider-side debugging and stateful features for protection against a narrow set of risks, and it does not remove the safety and legal retention above. If you handle protected health information on the Claude API, Anthropic says HIPAA readiness is the arrangement to use and you do not also need ZDR.

Three criteria predict regret. Your architecture matters most: if the product depends on files, batch or hosted agents, ZDR will not cover it, and you need a retention schedule for those stores instead. Model roadmap comes next, because a team that plans on Fable needs a retention answer before it builds. Enforcement is third. If you cannot block an ineligible call, the promise depends on every future pull request.

Choose differently if EU processing is mandatory, which rules out Anthropic's direct API today, or if you are on Google's online terms and cannot move to a Master Agreement. Our SLA comparison covers the availability side of the same procurement.

---

What to Do Before Your Next Renewal

This Week:

1. Export 30 days of API calls by endpoint and tool, and mark each one against your vendor's eligibility table.
2. Ask your account team which control your amendment names: ZDR, MAM or modified abuse monitoring.
3. On Bedrock, list every Region in use and record its retention mode.

This Month:

1. Add an endpoint and tool allowlist at your LLM gateway, and alert on any request to an ineligible path.
2. Deploy the Bedrock SCP, or the equivalent approval check, so nobody can raise the retention mode without review.
3. Give files, batches and vector stores their own deletion schedule, using expires_after where the provider supports it.

Before Your Next Renewal:

1. Attach the endpoint and model exhibit, and the five terms above, to the agreement.
2. If you run Fable on Bedrock under the Enterprise Frontier Safeguards program, get your post-December 31 retention plan signed off by your security lead.

The Bottom Line

Treat ZDR the way you already treat cloud security. An auditor stopped accepting "we use AWS" long ago and asks about specific buckets and roles, and your AI approval record should list specific endpoints and model IDs in the same way.

Pull last month's API calls by endpoint and compare them with the eligibility table.

Continue Reading

• OpenAI, Azure, Bedrock, Vertex and Anthropic SLAs Compared
• Bedrock vs Vertex AI vs Foundry: Your Cloud Commit Decides
• Agent Audit Logging: Platform Logs Miss the Decision You Must Prove
• Claude Workspace Add-On Does Not Support Zero Data Retention
• Five AI Vendors Give Customers 0 to 90 Days to Get Data Out
• Anthropic Adds Red Team Access to Cyber Verification Program