Zero data retention: what it is and why it matters

When you type into an AI tool, your words go to the provider’s computers, usually overseas. Those computers work out the answer and send it back. The provider then keeps a copy for a time. Chat apps such as Claude and ChatGPT keep your conversations until you or your organisation delete them. The services that other products are built on keep a copy for up to 30 days, so that the provider can check for misuse. Neither laboratory trains on business data without the customer’s permission.

Zero data retention is an agreement under which the provider deletes your material as soon as it has answered. It is granted by agreement, after approval, to eligible business customers. It is not available in the ordinary Claude or ChatGPT apps. A legal product built on these models holds whatever that product’s own terms provide.

The arrangement is narrower than its name. Your material still goes to the provider’s servers and is processed there. Safety classifiers still screen each request as it arrives. Features that store material by design sit outside it: uploaded files, saved conversation threads, batch jobs and connections to other services. Anthropic may keep inputs and outputs its safety systems flag for up to two years, even under zero data retention. OpenAI keeps any image flagged as possible child sexual abuse material for manual review, whatever the arrangement.

Anthropic calls its most capable models Covered Models: Fable 5, 5.1 and 5.2, and the Mythos models built on them. Prompts and responses sent to them are kept for at least 30 days. They are then deleted automatically, unless they are under a safety investigation or the law requires them to be kept. Anthropic does not offer zero data retention for them in Claude Enterprise organisations, in API workspaces, or on Amazon Bedrock, Google Cloud’s Agent Platform or Microsoft Foundry.

Products built on Claude can differ. Microsoft says some organisations can use Fable 5.1 in Microsoft 365 Copilot under Microsoft’s own data protection terms, with Anthropic retaining no prompts or responses. Other Fable-class models in Copilot are off by default. An administrator who turns them on accepts Anthropic’s own terms and the 30-day record.

Opus 5.5, Sonnet 5.5 and Haiku 5.5 are not Covered Models. All three can still be used with zero data retention.

Anthropic says no member of its staff can read the retained material by default. Human review happens only through a controlled path, for example after an automated flag, by a small group of approved reviewers. Every access is recorded in a log the reviewers cannot alter.

OpenAI offers zero data retention to approved API customers. Its terms reserve the right to withdraw it for a particular model and customer, on written notice. Where that is done to investigate or prevent severe risk activity, OpenAI may keep and review content its classifiers flag. For GPT-6 Cyber, a cybersecurity model OpenAI released on 5 November 2026, zero-retention API customers generally must use Private Safety Processing (section 5).

Anthropic gives three reasons for the record.

Some attacks are spread across many requests. A best-of-N jailbreak sends hundreds of slight variations of a prompt until one gets through. Anthropic’s August 2026 risk report says the problem is “particularly true for offensive cyber and biological weapons development, where no single request looks harmful on its own”.

The same pattern-matching protects the customer. The report gives the example of “a compromised account or API key being used to attack that company’s own systems”. It says Anthropic has caught attacks of that kind “only because we could look across many requests over time”.

Zero-retention services have been used to hide misuse. Anthropic’s September 2026 threat report describes a platform serving dozens of life-sciences researchers with links to civilian and military institutions, in countries Anthropic does not serve. It routed traffic through United States infrastructure to get round Anthropic’s regional blocks. It also “used a zero data retention (ZDR) service to hide content”.

The risk report records the cost. Anthropic has less confidence in flagging this kind of probing where zero data retention applies. For one category of chemical and biological threat actor, it knows no answer other than keeping sufficiently capable models off zero-retention services those actors could reach.

New laws require incident reporting. California’s frontier AI law requires critical safety incidents to be reported to the state within 15 days. On 10 November 2026 Australia announced that frontier AI companies will have to notify incidents to its Government rapidly. Our view: duties of this kind assume the laboratory can see what happened.

An open-weight model is one whose files are published free, so anyone can download it and run it on their own computer. The objection runs as follows. A person intent on misuse can download an open-weight model and run it on their own machines. Most of the strongest are Chinese. No laboratory sees what they do. On that view, monitoring the frontier models inconveniences paying customers and stops nobody. Zero data retention becomes a marketing contest between laboratories.

Anthropic’s own reports support part of it. The platform Anthropic banned in May “re-established access within days”. It sent requests Claude refused to a competitor’s model. The risk report accepts that tighter controls on legitimate access, limits on zero-retention deployments among them, increase the incentive to steal Anthropic’s model weights.

The open models are well behind on capability. The retention attaches to capability. Anthropic designates a Covered Model when it crosses capability thresholds. On the independent Artificial Analysis index, read on 12 November 2026, the best open-weight model, Moonshot’s Kimi K3.1 Pro, scores 46. Fable 5.2 scores 65. Epoch AI estimated in May 2026 that open models trail the closed frontier by about four months. The United States Government’s AI evaluation centre, CAISI, put DeepSeek V4 about eight months behind.

Our view: the monitoring will not stop a determined, well-resourced actor. It raises the cost of misusing the most capable models while the open models lag. That advantage lasts only as long as the gap. On these figures the gap is measured in months.

Both laboratories have a commercial interest in their positions. Anthropic’s risk report presents the retention policy as an example of the safeguards on which it believes it leads the industry. It also records that the decision “will be unpopular with customers who have come to expect zero retention”. OpenAI’s alternative is built to let its customers keep zero retention. Our view: the safety reasoning stands on the evidence the laboratories publish. The commercial motive does not displace it.

Anthropic announced Enterprise Frontier Safeguards on 1 September 2026, after working with more than 100 customers, law firms among them. It reports that those customers generally accepted the safety case for retention. Their difficulty was procurement: adding another trusted data vendor means notifying their own customers and updating contracts.

The record used for monitoring is kept in the customer’s own cloud storage, under the customer’s keys. When the automated systems flag a pattern, the flag goes to the customer’s own people. No Anthropic employee needs to review it. Anthropic names privileged legal material among the information its customers’ rules restrict. The system rolls out in phases from late 2026. Until then, eligible customers can use Fable with zero data retention for their own internal business applications, for a limited time.

OpenAI’s Private Safety Processing works in a similar way. Selected interactions are encrypted and written to the customer’s own cloud storage. An automated review system, which OpenAI says disables human access, reads them. Only “bounded safety signals” leave it. The customer must keep the encrypted records for at least 30 days.

Our view: under both designs a monitoring record is still kept. The customer holds it. For a law firm that record is client material in the firm’s own systems, exposed to breach and legal process like the rest of its files. Someone in the firm also has to decide who reads a flag.

Zero data retention leaves no routine copy at the provider for a court or an intruder to reach. In 2025 a United States court, in the New York Times’ copyright case against OpenAI, ordered OpenAI to preserve output logs it would otherwise have deleted. ChatGPT consumer accounts and ordinary API use were caught. Zero-retention API customers were outside the order. OpenAI’s explanation was that “because it is not stored, this court order doesn’t affect that data”. The obligation ended on 26 September 2025.

It also gives a short answer when a client, an insurer or a regulator asks what the provider holds.

Four questions decide whether client material is safe in an AI tool: whether the provider trains on it, who can read it and when, which country’s law can compel it, and what your own tools keep. On their paid business plans, Anthropic and OpenAI do not use your material to train their models. We call a plan of that kind a no-training business plan. Zero data retention shortens the provider’s hold on the material sent to the model. It does nothing about your own tools. Chat history, memory, uploaded files, connectors and agent logs all sit outside it. In Claude Team and Enterprise organisations created on or after 31 October 2026, memory starts on for each member.

Our view, as in July: a short-lived record held on no-training terms, read only after a safety flag, does not by itself put confidentiality, privilege or the Privacy Act in issue. Firms already keep client material for years with cloud email and document providers on comparable terms. Most prompts are drawn from documents the firm already holds in those systems. Zero data retention removes one short-lived copy of material the firm keeps elsewhere for years.

Zero data retention is worth having where a client, a regulator or an undertaking requires that the provider hold no copy.

A false safety flag can put material before a reviewer at the provider. Litigation papers describe fraud, violence and cyberattacks in detail. That is the material a safety classifier is built to flag. OpenAI’s standard zero-retention arrangement keeps no flagged text. Anthropic may keep flagged content for up to two years under zero data retention too.

Our retention guidance sets out which plans and models offer zero data retention. Our privilege note sets out why confidential use of a no-training tool does not waive privilege under section 65 of the Evidence Act 2006.