Every vendor pitch for enterprise AI now includes some version of the same line: “we don’t store your data.” It sounds reassuring, it’s repeated often enough to feel like a settled fact, and it’s frequently not quite true in the way it’s implied to be.
That gap matters more this year than it used to, because AI agents aren’t just answering one-off questions anymore. They’re pulling customer records, reading internal documents, and acting across systems on a business’s behalf, often without a person reviewing each step. The question that used to be a compliance footnote, where does this data actually go, is now a live security question with a specific, checkable answer, if you know what to ask.
The Promise That’s Easy to Mishear
“Zero data retention” sounds like a simple, binary guarantee: nothing gets kept after the response comes back. In practice, most claims using that phrase are marketing shorthand rather than a precise description of what’s actually happening to your prompts and outputs.
Here’s the technical version worth holding onto: real zero data retention means the content of a request, the prompt and the output, is not stored by the inference layer once the response is delivered. No transcripts, no copies quietly sitting in an internal support tool, no shadow archive kept “just in case” for abuse monitoring. Processing happens in memory, and then it’s gone.
“If you do not ask what is actually stored, where, and for how long, you are not comparing providers, you are comparing slogans.”
That distinction is the whole game. A provider can say “we don’t train on your data” and still retain prompts for weeks under an internal safety review process. Both statements can be technically true and describe very different levels of actual exposure.
What’s Usually Still Being Kept, Even Under a ZDR Agreement
This is the part vendor pitches tend to skip past, and it’s worth knowing before you sign anything.
- The 30-day safety window is still common as a default. Even providers offering zero data retention endpoints often ship it as an opt-in configuration, not the baseline. Standard API accounts frequently retain data for around 30 days for abuse monitoring before deletion, unless a business explicitly requests and configures the zero-retention setting.
- Safety metadata often survives even when content doesn’t. A provider might genuinely delete the prompt itself while still retaining a record that a specific interaction was flagged as high-risk, sometimes for years. If your Data Processing Addendum doesn’t specify how safety classifications are handled separately from content, you don’t have the full picture.
- Technical metadata isn’t the same as content, and that’s fine, but know the difference. A serious provider can log latency, model version, and error codes without retaining the actual payload. That’s normal and not a red flag on its own. The red flag is when “metadata” quietly expands to include anything that could reconstruct what was actually asked.
- Data sovereignty has become part of the same conversation. Deletion alone isn’t the whole requirement anymore for many regulated businesses. Under an increasing patchwork of regional data laws, where the processing physically happens, not just whether it’s retained afterward, is now part of what “zero data retention” needs to cover for a business to consider itself compliant.
Why Agents Specifically Raise the Stakes
A one-off chatbot query is a contained risk. An AI agent chaining together multiple steps, reading a CRM record, drafting a response, updating a ticket, is a different category of exposure entirely, because sensitive data is now moving through several systems and several decision points instead of one.
That’s why the industry conversation has shifted from trusting a provider’s stated intentions to demanding technically verifiable enforcement. It’s no longer considered sufficient for a vendor to say they don’t retain data. Security and compliance teams increasingly want to see the architecture that makes unauthorized retention structurally impossible, not just contractually prohibited. Enforcing that in practice takes controls on both sides of the relationship, hard tenant isolation and stateless processing from the provider, and scoped permissions, approval workflows for sensitive actions, and human-in-the-loop checks from whoever’s deploying the agent internally.
What to Actually Ask Before You Deploy an AI Agent
For teams evaluating vendors right now, a handful of specific questions tend to separate a genuine zero-retention architecture from a reassuring sentence in a sales deck.
Ask exactly what “zero” covers. Prompts and completions, yes, almost always. Safety flags and classification metadata, sometimes not. Get the answer in writing, in the Data Processing Addendum, not in a conversation with a sales rep.
Ask whether zero retention is the default or something you have to explicitly configure. Many enterprise-grade providers offer ZDR-eligible endpoints that aren’t switched on by default. If your team never explicitly requests it, you may be running on the standard retention window without realizing it.
Ask where processing physically happens. For regulated data, jurisdiction matters as much as retention duration now. A provider that deletes data instantly but processes it outside the region your compliance framework requires hasn’t actually solved your problem.
Ask what happens at the agent-orchestration layer, not just the model layer. A model provider’s zero-retention policy doesn’t automatically extend to whatever platform is stitching together the agent’s multi-step actions. Consuming applications and underlying model providers frequently implement retention differently, and the gap between the two is where sensitive data often ends up more exposed than either policy suggests on its own.
Ask for a formal DPA, even with a ZDR agreement in place. A written Data Processing Addendum should spell out your rights as a data controller, the provider’s obligations as a processor, any subprocessor disclosures, and breach notification timelines. Zero retention reduces risk, it doesn’t eliminate the need for the paperwork underneath it.
A Quick Vendor-Evaluation Checklist
Use this as a working list the next time an AI vendor conversation reaches the “we don’t retain your data” stage.
- Confirm in writing exactly what data categories “zero retention” covers, prompts, outputs, safety metadata, technical logs
- Verify whether zero retention is the default setting or something your team needs to explicitly enable
- Confirm the physical processing location and whether it satisfies your specific data sovereignty requirements
- Check whether the retention policy is consistent across both the underlying model provider and the agent-orchestration platform layered on top of it
- Request a formal DPA outlining controller/processor obligations, subprocessor disclosures, and breach notification timelines
- Ask how long safety-flag metadata is retained, separately from prompt content, and for how long
- Map which internal teams are already using AI tools informally, before assuming your official vendor list is the complete picture
The Trust Question Underneath the Technical One
Strip away the architecture diagrams, and this comes down to a fairly human question: can your business actually explain, in plain language, what happens to a customer’s data the moment someone on your team pastes it into an AI tool? Most organizations can’t yet, not because the answer doesn’t exist, but because nobody’s been asked to write it down.
That’s usually a governance gap more than a technology one. The businesses handling this well aren’t necessarily using more sophisticated AI, they’ve just made someone specifically accountable for knowing the answer, and built vendor evaluation around verifying claims rather than trusting slogans. It’s a big part of why AI-readiness conversations increasingly start with data governance rather than model selection in the work we do through Kilowott Intelligence, since the second question only matters once the first one has a real answer.
If your team is currently evaluating AI vendors and isn’t fully sure which retention claims would actually hold up under a serious review, that’s worth checking before a contract gets signed rather than after. Have a look at how we’ve approached this with other clients in our case studies, or get in touch to talk through your specific evaluation.
