Skip to main content
Watch: I Built an AI App Without Leaving Databricks

Data retention - verified

Does OpenRouter store your API prompts?

Default retention: not retained by default. Trains on your API data: No (openRouter's own use; each downstream provider has its own policy). Zero data retention: self-serve (routing control: send requests only to ZDR endpoints). Regional processing: US and EU.

Read from openrouter.ai. Compare every AI API's data retention

Trains on data
No
ZDR
Self-serve
Regions
US and EU
Verified
2026-10-18

How long are prompts kept by default?

Default retention

Not retained by default

OpenRouter does not store prompts or responses unless you opt in to private logging or to OpenRouter's use of inputs/outputs. Request metadata (token counts, latency) is always stored.

“OpenRouter does not store your prompts or responses, unless you opt in to one or both of the following:”
openrouter.ai
“OpenRouter does store metadata (e.g. number of prompt and completion tokens, latency, etc) for each request.”
openrouter.ai
Duration
Not stated
Purpose
Not stated

Does it train on your API data?

No

OpenRouter's own use; each downstream provider has its own policy

OpenRouter's own use of inputs/outputs to improve the product is off by default (opt-in gives a 1% discount). Downstream training is governed by each provider and filterable.

“OpenRouter Use of Inputs/Outputs: Allow OpenRouter to use your prompt and completion data to improve the product. In exchange, you receive a 1% discount on all model usage. Off by default.”
openrouter.ai

Zero data retention (ZDR)

Availability

Self-serve: you can switch it on yourself

Routing control: send requests only to ZDR endpoints

Who can get it

Routing control for all accounts: enforce ZDR-only endpoints globally, per model group, per guardrail, or per request (provider.zdr: true).

Not covered

Applies only to provider routing for inference, not to plugins or server tools you enable. In-memory prompt caching is not treated as retention.

From the docs
“OpenRouter has privacy settings that, when enabled, only allow you to route to endpoints that have a Zero Data Retention policy. You can enforce ZDR globally, per model group, per guardrail, or per request.”
openrouter.ai
“When zdr is set to true, the request will only be routed to endpoints that have a Zero Data Retention policy.”
openrouter.ai
“OpenRouter has taken the stance that in-memory caching of prompts is not considered “retaining” data, and we therefore allow endpoints/models with implicit caching to be hit when a ZDR routing policy is in effect.”
openrouter.ai
“If OpenRouter is not able to establish or ascertain a clear policy for a provider or endpoint, we take a conservative stance and assume that the endpoint both retains and trains on data and mark it as such.”
openrouter.ai

Features kept longer

Stateful features hold your content until a job finishes, a window expires or you delete it, often regardless of the default above.

OpenRouter features with their own retention
FeatureRetentionThe docs say
Private Input & Output Logging (opt-in, off by default)Minimum 3 months, may be longer at OpenRouter's discretion unless deletion requested“Retention: Data is retained for a minimum of 3 months, and may be retained beyond 3 months at OpenRouter’s discretion unless you request deletion.”openrouter.ai
Anonymous input categorization (sampled)Not stated“OpenRouter samples a small number of prompts for categorization to power our reporting and model ranking. If you are not opted in to OpenRouter use of inputs/outputs, any categorization of your prompts is stored completely anonymously and never associated with your account or user ID.”openrouter.ai
Batch APINot stated“The Batch API currently runs on US-based storage and queueing infrastructure and does not yet support regional data residency.”openrouter.ai

Where is your data stored and processed?

Regional processing

US and EU

Business and Enterprise plans; EU covers the EU/EEA, UK and Switzerland

Stated location

Global routing on the default domain

Recorded as: Global domain: global routing; no fixed location stated.

How to choose
Not stated
What it covers

Processing of prompts and completions (OpenRouter handling plus provider inference on shared endpoints). Not account/operational records.

Summary

Business and Enterprise plans: in-region routing via eu.openrouter.ai (EU/EEA, UK, Switzerland) or us.openrouter.ai; prompts and completions processed in-region and routed only to in-region shared endpoints, failing closed. Account, billing, auth, security logs and abuse-monitoring metadata may be stored or processed in the US. Global domain uses global routing.

From the docs
“When you send a request through a region-specific base URL, the request is decrypted within that region and routed only to shared provider endpoints in that region: Europe (the EU/EEA, the UK, and Switzerland) for `eu.openrouter.ai`, and the US for `us.openrouter.ai`.”
openrouter.ai
“EU in-region routing (`eu.openrouter.ai`) and US in-region routing (`us.openrouter.ai`) are available on the Business and Enterprise plans.”
openrouter.ai
“In-region routing covers the prompts and completions in requests sent to a regional domain and served by shared provider endpoints. Account and operational records, BYOK deployments, and destinations you configure are outside that boundary.”
openrouter.ai

Regional endpoints

Data policy routing controls

OpenRouter routes requests to other providers; these settings decide which ones.

  • data_collection: "deny"

    “To exclude providers that don’t comply with your data policies, set data_collection to deny:”
    openrouter.ai

  • Account training setting

    “If you opt out of training in your account settings, OpenRouter will not route to providers that train. This setting has no bearing on OpenRouter’s own policies and what we do with your prompts.”
    openrouter.ai

  • Retention not a routing rule

    “OpenRouter does not have routing rules that change based on data retention policies of providers, but the retention policies as reflected in each provider’s terms are shown below.”
    openrouter.ai

  • zdr (per request / account / guardrail / model group)

    “The request-level zdr parameter operates as an “OR” with your account-wide and guardrail ZDR settings.”
    openrouter.ai

  • allowed_data_regions guardrail

    “A request that arrives through a domain not in the list is rejected with a 403 Forbidden error before any inference or endpoint selection happens, so no prompt is ever processed outside the permitted regions.”
    openrouter.ai

Certifications

Certifications on the pages checked: Not stated

Research notes

  • Downstream provider terms intentionally not recorded. OpenRouter's provider table reflects its own per-endpoint arrangements and may differ from a provider's direct-API defaults. Private logging is skipped for requests through regional endpoints. DPA offers an EU-only processing addendum (Exhibit A) for API payloads when elected in writing.

FAQ

Does OpenRouter store your API prompts?

Not retained by default. OpenRouter does not store prompts or responses unless you opt in to private logging or to OpenRouter's use of inputs/outputs. Request metadata (token counts, latency) is always stored. The provider says: "OpenRouter does not store your prompts or responses, unless you opt in to one or both of the following:"

Does OpenRouter train on your API data?

No (openRouter's own use; each downstream provider has its own policy). The provider says: "OpenRouter Use of Inputs/Outputs: Allow OpenRouter to use your prompt and completion data to improve the product. In exchange, you receive a 1% discount on all model usage. Off by default."

Does OpenRouter offer zero data retention?

Self-serve (routing control: send requests only to ZDR endpoints). Routing control for all accounts: enforce ZDR-only endpoints globally, per model group, per guardrail, or per request (provider.zdr: true).

Where does OpenRouter process your data?

Regional processing options: US and EU (Business and Enterprise plans; EU covers the EU/EEA, UK and Switzerland). Stated processing location: Global routing on the default domain.

Sources

Last verified from OpenRouter's own pages below. Quotes are verbatim.

This page summarizes what each provider's own pages say. It is not legal advice; your contract, data processing addendum and the provider's current terms govern what happens to your data.

Newsletter

Know when a provider changes its data terms

One email per week. New model releases, pricing and policy changes, and what they mean for what you build.