AI Vocabulary

Zero retention: what does the undertaking actually cover?

Zero retention means the provider does not keep the data you transmit once it has processed it. It is a real undertaking and narrower than it appears: it covers durable storage, not what happens during processing, nor technical logs, nor what its own suppliers do.

What the undertaking covers

That transmitted content is not retained in the provider's systems beyond the time needed to process it. Concretely, your request and the attached document are not stored for later reuse.

It usually comes with a prohibition on using that content to train models, which is the concern most often voiced and to which it does respond.

What it does not cover, and must be asked about

Technical logs. Any infrastructure records calls, errors, response times. Those logs do not always contain content, and sometimes do — an error message may include an extract of the text being processed. How long logs are kept is a separate question, to be asked separately.

Temporary retention for safety. Several providers keep content for a few days to detect abuse, including under a zero-retention undertaking. That is generally stated in the documentation, rarely in the sales pitch.

Downstream suppliers. If the provider relies on a host or a model laboratory, its undertaking holds only if it has passed it down contractually. The question is not rhetorical: the chain often has three links.

And access during processing. Zero retention covers what remains afterwards; it says nothing about who can see during.

How to verify it

Ask for the undertaking in writing, with three specifics: its exact scope, its transmission to downstream suppliers, and an obligation to notify you of any change affecting these points.

The last matters most over time. A provider may change host or model without breaching anything, and you will not know unless the contract requires it.

One nuance worth knowing about consumer offerings: the equivalent there takes the form of a setting, switchable in preferences, not a contractual undertaking. A setting can change, including through an update that resets defaults.

The difference between a setting and a clause is therefore not one of degree but of nature: one describes a current state, the other creates an enforceable obligation.

What it does not solve

Zero retention is a contractual undertaking, not a technical property. It organises an obligation whose breach opens a remedy; it does not materially prevent retention.

That distinction is decisive where professional secrecy is concerned, since the breach is itself the harm: compensation does not restore information that has circulated.

And it says nothing about what belongs to you. A provider that keeps nothing returns nothing either: what you recover on leaving is an independent question.

Why it matters to a lawyer

Because it is the undertaking most often put forward, and it answers a legitimate concern — the use of data for training — while leaving the other three open.

Better to take it for what it is: a necessary condition, obtained by contract, which does not dispense with examining what leaves your infrastructure and in what form.