Glossary
Zero data retention
Zero data retention is a contractual commitment by an AI provider not to permanently store incoming requests and their content after processing. Prompts, documents, and responses are used only to produce the answer and are not kept afterwards. For small and medium-sized businesses this matters because confidential company data does not remain in the AI provider's systems.
Last updated: 2026-08-03
By default, many AI services keep incoming requests for a limited period – for abuse detection or quality assurance, for example. Zero data retention is the contractually agreed departure from that default: the provider processes the request, returns the answer, and does not permanently store the content. The term is distinct from a training exclusion – that governs whether data may be used to train AI models, while zero data retention governs whether it is kept at all. In practice, the two commitments are often combined.
In everyday business, confidential content quickly ends up in AI requests: customer emails, draft contracts, internal documents. Without zero data retention, every request adds to a growing pool of such data at the AI provider – a point data protection officers regularly probe when reviewing an AI tool. With zero data retention, data flows through processing instead of accumulating with the provider. That shrinks the attack surface and simplifies the answer to the question of where company data actually ends up.
Chifty builds its AI processing on this principle: with Google Cloud Vertex AI and OpenAI, it is contractually agreed that requests are not retained after processing. Your content is also not used to train the AI models in use, and AI processing defaults to the EU. On top of that comes the permission principle: the AI must not bypass permissions – answers draw only on sources approved for the asking person, with sources shown.
Zero data retention is one building block, not the whole package: the commitment covers the AI provider, not automatically every other party in the processing chain. When reviewing an AI tool, also look for a data processing agreement under Art. 28 GDPR, a transparent sub-processor list, and an enforced permission model.