Data retention - verified
AI API data retention and residency: how long each provider keeps your prompts, and where
We read the data retention, training and residency terms of 18 AI API providers on October 18, 2026. Of those, 5 let you switch on zero data retention (ZDR) yourself, 2 say they keep no prompts by default, 4 grant ZDR by approval, 3 offer it to enterprise customers only; 1 does not offer it and 3 do not mention it. 8 offer a way to keep processing in the EU and 10 in the US, often only on approved or enterprise plans. 11 say they do not train on your API data by default, 5 do not say, and for 2 it depends on the tier or the provider's own pages disagree.
Retention vs training vs residency - Where the docs disagree
- Self-serve ZDR
- 5
- EU processing
- 8
- No training
- 11
- Docs disagree
- 4
Every provider, side by side
Not stated means the provider's own pages do not say, not that the answer is no. Labels are our short reading of the provider's words; open a provider for every verbatim quote, the features kept longer and the regional endpoints.
18 providers
| Provider | Default retention | Trains by default?API data | Zero data retention | Regional processingregions you can choose | Stated location |
|---|---|---|---|---|---|
| No providers match these filters. | |||||
| OpenAI | Up to 30 days, abuse monitoring | No | By approvalZero Data Retention or Modified Abuse Monitoring, after OpenAI approval | US, EU and UAEProcessing in the US, EU and UAE; storage only in 7 more regions. Approval needed outside the US | Not stated |
| Anthropic | Within 30 days, or not retained by defaultThe docs disagree | No | By approvalBy arrangement with Anthropic sales, per organization | USUS-only inference with inference_geo, Claude 4.6 and later | Global inference by default |
| Gemini API | 55 days, abuse monitoring (paid tier) | Depends on tierPaid tier: No. Unpaid tier: Yes, except in the EEA, Switzerland and the UK | Not offeredNo exemption from abuse logging documented; Google points to Vertex AI | None documented | Logged data may be stored in any country where Google or its agents have facilities |
| Vertex AI | Only flagged prompts, up to 90 days | No | By approvalConfiguration plus an abuse-monitoring exception request on the online Google Cloud terms | US, EU, UK, APAC, Canada and BrazilMulti-region and country endpoints; the global endpoint has no guarantee | Follows the endpoint you call |
| Azure OpenAI | Flagged content only; duration not stated | No | Enterprise onlyModified abuse monitoring, for Microsoft-managed customers, by application | US, EU and APACData Zones, or one Azure geography with Standard deployments | The resource's Azure geography, unless Global or Data Zone |
| Amazon Bedrock | Depends on the model; up to 30 days for some | No | Self-servedata_retention_mode none, per Region; some models require retention | US, EU and APACGeographic cross-Region profiles, or one AWS Region | The AWS Region you call, unless you use cross-Region inference |
| Mistral | 30 rolling days, abuse monitoring | Not statedOpt-out toggle exists; the default for paid API use is not stated | By approvalOn request; Mistral may approve or denyThe docs disagree | US and EURegional endpoints at 1.1x list price | No commitment on the global endpoint; EU hosting by default per the help center |
| xAI | 30 days, abuse auditing | No | Self-serveTeam admins in the xAI Console, where available | USUS endpoint, 10% higher token price, selected models | Not guaranteed on the global endpoint |
| DeepSeek | While the account is active | Not statedThe privacy policy lists training as a purpose; the API terms do not address it | Not stated | None documented | People's Republic of China |
| Moonshot AI | While the account is active | The docs disagreeTerms: content may be used unless agreed in writing. Help center: not used for trainingSee both quotes | Not stated | None documentedSeparate China and overseas base URLs; no residency guarantee documented | Singapore |
| Z.ai | Not retained by default | NoThe no-improvement sentence is printed in square brackets in the terms | Not statedNo named ZDR program; the API DPA says content is not stored | None documented | Singapore |
| Alibaba Cloud (Qwen) | Up to 30 days | No | Enterprise onlyEnterprise customers with an account manager, after a needs assessment | US, EU, APAC and ChinaRegion sets storage; deployment scope sets where inference runs | The region and deployment scope you choose |
| Cohere | 30 days | Not statedOpt-out toggle in the dashboard; the default is not stated | Enterprise onlyEnterprise customers who make additional usage commitments | None documented | Not stated |
| Groq | Not retained by defaultThe docs disagree | Not stated | Self-serveAny customer, in Data Controls settings | None documented | Not statedRetained data: United States (GCP) |
| Cerebras | Not retained by default | Not stated | On by defaultNo separate program; the privacy policy says inputs and outputs are not retained | None documented | United States and other countries |
| Together AI | Stored by default; no duration stated | No | Self-serveOrganization admins turn off prompt storage; off by default | EUDedicated or VPC deployments only; serverless has no region choice | Not stated |
| Fireworks AI | Not retained by default (open models) | No | On by defaultDefault for open models; an enforced account-wide policy is an Enterprise feature | USEnterprise accounts | Not stated |
| OpenRouter | Not retained by default | NoOpenRouter's own use; each downstream provider has its own policy | Self-serveRouting control: send requests only to ZDR endpoints | US and EUBusiness and Enterprise plans; EU covers the EU/EEA, UK and Switzerland | Global routing on the default domain |
Where a provider's own docs disagree
On 4 providers, two official pages say different things. We quote both and do not pick one; ask the provider which applies to your account.
The docs disagree
Anthropic: Default retention
Anthropic's privacy center says API inputs and outputs are deleted within 30 days of receipt or generation. Its API data retention doc says conversation content is not retained by default, except for Covered Models, which require 30-day retention. Both pages are Anthropic's own; we show both and do not pick one.
“For Anthropic API users, we automatically delete inputs and outputs on our backend within 30 days of receipt or generation, except:”
“Only what is technically necessary for the feature to work is retained. Conversation content (your prompts and Claude's outputs) is not retained by default; the exception is Covered Models, which require 30-day retention.”
The docs disagree
Mistral: Who can get ZDR
Mistral's docs say ZDR is available on paid plans. Its help center says ZDR is available only with pay-as-you-go. Both say stateless API calls only.
“ZDR is available on paid plans for supported stateless API calls.”
“Zero Data Retention (ZDR) is available only with pay-as-you-go and only for stateless API calls.”
The docs disagree
Moonshot AI: Training on API data
Moonshot's OpenPlatform terms say Customer Content may be used to improve the Services unless agreed otherwise in writing, and point to enterprise arrangements for training restrictions. The Kimi help center says API data is not used to train or improve Kimi models. The help page is served for the China locale and its examples use api.moonshot.cn, so it may describe the China platform.
“We may use Content to provide, maintain, develop, support, and improve the Services, comply with applicable law, enforce our terms and policies, and keep the Services safe and secure. Customer who requires restrictions on the use of Customer Content for training or improving Moonshot AI models may contact Moonshot AI to discuss available enterprise arrangements or separate written agreements. Unless otherwise expressly agreed in writing, Customer Content may be used for the foregoing purposes.”
“No. User data submitted via the API, including input content and model outputs, will not be used to train or improve Kimi models.”
The docs disagree
Groq: Default retention
The body of Groq's Your Data page says inference data is not retained by default. The same page's meta description still mentions standard 30-day retention, which reads as stale against the body.
“By default, Groq does not retain customer data for inference requests.”
“standard 30-day retention”
How to read this
Retention, training and residency are not the same thing
Retention, training and residency are three separate promises
Retention is how long the provider keeps your prompts and outputs, usually for abuse monitoring. Training is whether it uses them to build models. Residency is where it stores and processes them. A provider can keep your data for 30 days and still never train on it, and a no-training promise says nothing about the country your request runs in.
“By default, all API requests and responses are stored on our servers (encrypted at rest) for 30 days for auditing purposes in the event of suspected abuse or misuse. SpaceXSI does not train on this data, and it is automatically deleted after 30 days.”
xAI - docs.x.ai Storage is not processing
Many residency offers pin data at rest to a region while inference can still run elsewhere, or the reverse. Read which one a region covers before you rely on it.
“If your selected Region does not support regional processing, as identified below, OpenAI may also process and temporarily store Customer Content outside of the Region to deliver the services.”
OpenAI - developers.openai.com “Regional inference does not provide regional storage for all control-plane data. For example, account configuration, API keys, billing, access management, usage analytics, and other operational metadata may still be handled by Mistral systems outside the selected inference geography.”
Mistral - docs.mistral.ai Why stateful features sit outside ZDR
Files, batch jobs, stored responses, conversations and fine-tuning only work if the provider keeps your content until the job finishes or you delete it. Zero data retention usually covers stateless calls only, so those features are blocked, forced off or excluded when ZDR is on.
“For example, the Files API stores uploaded files and is outside the scope of ZDR.”
Mistral - docs.mistral.ai “none | Zero data retention. No request or response data is written to durable storage by AWS or shared with the model provider. On the Responses API, store defaults to false and store=true is rejected. Background mode is not available. Chat Completions and Messages requests are never retained.”
Amazon Bedrock - docs.aws.amazon.com
FAQ
Which AI APIs offer zero data retention?
Of the 18 providers checked on October 18, 2026: Amazon Bedrock, xAI, Groq, Together AI and OpenRouter let you turn on zero data retention yourself. Cerebras and Fireworks AI say prompts are not retained by default. OpenAI, Anthropic, Vertex AI and Mistral grant it by approval; Azure OpenAI, Alibaba Cloud (Qwen) and Cohere offer it to enterprise customers only. The Gemini API does not offer it (no exemption from abuse logging documented; Google points to Vertex AI). DeepSeek, Moonshot AI and Z.ai do not mention a ZDR program. Stateful features such as files, batches and stored responses usually stay outside ZDR.
Which AI APIs can keep processing in the EU?
8 of the 18 document an EU processing option: OpenAI (processing in the US, EU and UAE; storage only in 7 more regions. Approval needed outside the US), Vertex AI (multi-region and country endpoints; the global endpoint has no guarantee), Azure OpenAI (Data Zones, or one Azure geography with Standard deployments), Amazon Bedrock (geographic cross-Region profiles, or one AWS Region), Mistral (regional endpoints at 1.1x list price), Alibaba Cloud (Qwen) (region sets storage; deployment scope sets where inference runs), Together AI (dedicated or VPC deployments only; serverless has no region choice) and OpenRouter (Business and Enterprise plans; EU covers the EU/EEA, UK and Switzerland). Gemini API, DeepSeek, Moonshot AI, Z.ai, Cohere, Groq and Cerebras document no region choice.
Do AI API providers train on your API data?
11 of 18 say they do not train on API data by default: OpenAI, Anthropic, Vertex AI, Azure OpenAI, Amazon Bedrock, xAI, Z.ai, Alibaba Cloud (Qwen), Together AI, Fireworks AI and OpenRouter. Mistral, DeepSeek, Cohere, Groq and Cerebras do not state a default. For the Gemini API it depends on the tier. Paid tier: No. Unpaid tier: Yes, except in the EEA, Switzerland and the UK. Moonshot AI's own pages disagree. Terms: content may be used unless agreed in writing. Help center: not used for training.
How long do AI APIs keep your prompts by default?
OpenAI: up to 30 days, abuse monitoring; Anthropic: within 30 days, or not retained by default; Gemini API: 55 days, abuse monitoring (paid tier); Vertex AI: only flagged prompts, up to 90 days; Azure OpenAI: flagged content only; duration not stated; Amazon Bedrock: depends on the model; up to 30 days for some; Mistral: 30 rolling days, abuse monitoring; xAI: 30 days, abuse auditing; DeepSeek: while the account is active; Moonshot AI: while the account is active; Z.ai: not retained by default; Alibaba Cloud (Qwen): up to 30 days; Cohere: 30 days; Groq: not retained by default; Cerebras: not retained by default; Together AI: stored by default; no duration stated; Fireworks AI: not retained by default (open models); OpenRouter: not retained by default. Flagged content, feature state and legal holds can be kept longer.
This page summarizes what each provider's own pages say. It is not legal advice; your contract, data processing addendum and the provider's current terms govern what happens to your data.
Verified from each provider's own docs, terms and privacy pages. Retention terms change without notice; check the linked source before you rely on one.
Newsletter
Know when a provider changes its data terms
One email per week. New model releases, pricing and policy changes, and what they mean for what you build.
Keep exploring
Free LLM API tiers
Which APIs are free to start, and what their free-tier data terms say.
OpenAI-compatible API endpoints
Base URLs and auth for every provider's compatibility layer.
AI rate limits and usage limits
Paid-tier limits per provider, copied verbatim from the docs.
Run models locally
Open-weight models that keep every prompt on your own hardware.