This is a Tautoru view, not a settled position.
Every AI provider keeps a copy of what you send it for a time. It keeps it to show you your past conversations, to check that the service is not being misused, to train its models where your plan and settings allow, to investigate conversations its safety systems flag, and because the law requires it. How long depends on the reason. A chat app keeps your conversations until you delete them or an auto-delete period runs out, and for a short time after that. The business plans let an administrator set the period. The developer services, the APIs that other products are built on, keep prompts and responses for a monitoring period: up to 30 days at Anthropic, OpenAI and xAI, and 55 days on Google’s Gemini API. A conversation a safety system flags can be kept far longer. At Anthropic that is up to two years.
Zero data retention (ZDR) is an arrangement under which the provider does not store your prompts or its responses once it has answered. Your text is processed to produce the reply and then discarded. It is offered to business customers by agreement, and almost always on the developer services. Anthropic and OpenAI offer it on their APIs. Google offers it on Gemini Enterprise Agent Platform, its business cloud service formerly called Vertex AI, where the customer reaches it largely through its own settings. The paid Gemini API no longer offers it. Microsoft offers its equivalent on Azure, on application, to customers its account teams manage. xAI lets API teams switch it on where it makes it available. DeepSeek does not offer it. No consumer plan offers it, free or paid. Nor do the chat apps Anthropic and OpenAI sell to businesses. Claude Team and Enterprise, and ChatGPT Business and Enterprise, keep conversations for a period the administrator sets. A legal AI product built on one of these services may hold ZDR with the provider underneath it. Its vendor can tell you.
What ZDR changes is the provider’s copy. A stored copy is exposed in four ways. A person at the provider may read it if a safety system flags it. A court or government may order the provider to hand it over. In 2025 a United States court in the New York Times copyright case ordered OpenAI to preserve consumer and API conversations, including chats users had deleted. The order did not reach customers with ZDR. OpenAI explained why: "Because it is not stored, this court order doesn't affect that data." A stored copy can also be taken in a breach. And it can be put to the provider’s own uses, if its terms allow. Under ZDR, ordinary traffic leaves no routine copy at the provider for any of these to reach.
The legal analysis in our other notes does not depend on ZDR. A provider that keeps your material for 30 days, on a no-training footing, is still processing it for you. Under section 11 of the Privacy Act 2020 the information is treated as held by you. Confidential use does not waive privilege. ZDR narrows one risk our privilege note leaves open: that a provider outside New Zealand is compelled by its own law to produce what it holds. Under ZDR it holds no routine copy to produce.
ZDR has limits. It governs storage. Your prompts still travel to the provider and are processed on its computers, which for most New Zealand users are overseas. Safety classifiers still read each request as it passes. Material they flag can still be kept. Anthropic says it may keep a flagged conversation for up to two years, even under ZDR. OpenAI keeps images flagged as possible child sexual abuse material for review and reporting. The law can still require retention. ZDR also covers only the parts of a service that need to store nothing. Uploaded files, batch jobs, code execution, saved threads and agent sessions store data by design. Using one of them takes that material outside the arrangement. The service will not stop you. Finally, ZDR is granted organisation by organisation, or project by project. A second account, a new project or a colleague’s personal plan sits outside it.
ZDR now depends on the model as well as the plan. Anthropic designates its most capable models "Covered Models": Fable 5, 5.1 and 5.2, and the Mythos models it offers only to vetted organisations. What you send them is kept for at least 30 days. ZDR is not available for them unless Anthropic expressly authorises it. An organisation with ZDR can reach them only by switching on 30-day retention for a workspace. For a limited time Anthropic is offering eligible customers ZDR with Fable for their own internal business use. It describes the offer as a step towards Enterprise Frontier Safeguards, a product that keeps the safety-monitoring data in the customer’s own cloud. Anthropic says that product will roll out in phases from the northern autumn of 2026. Opus 5.5, Sonnet 5.5 and Haiku 5.5 remain available under ZDR.
OpenAI has taken a different course. Since 22 September 2026 it has been rolling out Private Safety Processing. That system checks a customer’s interactions for patterns of misuse while the content stays in storage the customer controls. OpenAI says it is what allows it to keep offering ZDR as its models become more capable. Its most capable cyber model, GPT-6 Cyber, released on 5 November 2026 to approved security customers, shows what that means in practice. ZDR customers using it generally must use Private Safety Processing, which keeps encrypted records in the customer’s own storage for 30 days. OpenAI says its staff cannot read them. It reserves the right to make a particular model ineligible for ZDR for a particular customer, on written notice. Microsoft 365 Copilot shows the same split between models. Anthropic’s retention-requiring models are off there until an administrator opts in, and then sit under Anthropic’s own terms. For some eligible organisations Microsoft offers Fable 5.1 with no retention. Google’s own frontier model, Gemini 4 Carbon, logs prompts and responses for up to 30 days in the customer’s own environment. Google says those logs meet its ZDR standard for customers on a Cloud Master Agreement, because no person reviews them.
Our view
For most legal work zero data retention adds little to a no-training business plan. The terms the material is held on carry the confidentiality question: whether the provider trains on it, who can read it and when, which country’s law can compel it, and what your own tools keep. On a business plan the first answer is already no. A short-lived record held on no-training terms, and read only after a safety flag, does not by itself put confidentiality, privilege or the Privacy Act in issue. Firms already keep client material for years with cloud email and document providers on comparable terms. ZDR removes one short-lived copy of material the firm holds elsewhere for years. It does nothing about your own tools: chat history, memory, uploaded files, connectors and agent logs all sit outside it. Nor does it reach the flagged path, which survives every arrangement and which our note on human review deals with.
Zero data retention is worth having where a client, a regulator or an undertaking requires that the provider hold no copy. The choice of model then matters. On Claude that means Opus 5.5, Sonnet 5.5 or Haiku 5.5 under an API agreement. Fable 5.2 keeps a 30-day record and is ruled out. Check too that the arrangement covers the account or project you are using. Check that the features you use fall inside it. Put the same questions to the vendor of any legal AI product you use. Ask it, too, what it keeps itself. How that applies to your matter is your judgment, on your facts.
