Best LLM API Providers with ZDR and privacy

Zero Data Retention is the clause enterprise buyers ask for when a standard data processing agreement is not enough. It promises that prompts and completions are not written to durable storage after the response, and that the provider cannot replay them later. On paper the promise looks uniform. In practice every provider defines a different scope, gates it behind a different approval path, and keeps a different set of exceptions.

For teams handling customer data, health data, or any workload that must survive a procurement audit, the provider choice turns on those details, not on the headline. This article compares the major LLM API providers, the hyperscalers that resell them, and the neoclouds that host open weights, with the conditions that determine whether ZDR is available, what it covers, and what remains outside it.

Three separate privacy layers

Buyers conflate three commitments that never arrive as a bundle:

No training. The vendor promises not to use API inputs and outputs to train future models. Every major API now defaults to no training without an opt-in, a shift that became standard after March 2023. It addresses model improvement, not storage.

Zero Data Retention. The vendor promises not to retain prompts and completions after the request completes. Content lives in volatile memory during inference and is discarded. ZDR is never the default except at a few platforms. It requires a contract, a project-level configuration, and often an account-team approval.

Data residency and audit. Where data is processed, which subprocessors can see it, and whether you can prove it. Hyperscaler deployments change this layer even when the underlying model vendor stays the same.

ZDR matters when the audit requires proof that the provider did not store the data at all. No training alone leaves the 30-day abuse-monitoring window in place.

Frontier labs: direct APIs

Anthropic (Claude)

Direct Claude API stores inputs and outputs for 7 days by default, reduced from 30 days in September 2025, and never uses them for training without explicit opt-in. ZDR is an enterprise arrangement, not a self-serve toggle. Eligibility requires a commercial organization and account-team enablement, confirmed in Console under Settings, Privacy Controls. ZDR is limited to eligible APIs and to products that use the commercial organization key, including Claude Code on that key.

What survives under ZDR is documented. User Safety classifier results are retained, longer retention applies after a Usage Policy violation up to two years for the session, and code execution containers plus MCP connector traffic sit outside ZDR entirely. Two frontier models, Claude Fable 5 and Claude Mythos 5, are designated Covered Models that require 30-day retention and are not ZDR-eligible on any surface as of June 9, 2026. Requests to those models from a ZDR-enabled workspace return an error. Workspace-level scoping allows one workspace to allow retention for Covered Models while others keep ZDR, which is the model-aware routing detail most teams miss. Anthropic offers a HIPAA BAA as a separate path, now decoupled from ZDR.

Verification is concrete: console confirmation, contractual addendum, and a separate check that the model your traffic actually calls is not a Covered Model.

OpenAI (direct API and platform)

Direct OpenAI platform retains inputs and outputs for up to 30 days for abuse monitoring unless ZDR is approved. OpenAI does not use API data for training by default, and enterprise customer data never trains models without explicit opt-in. ZDR is gated behind sales approval and is configured at the organization or project level in Settings, Data controls. The implementation forces store=false on eligible endpoints even if the request sets it to true.

Eligibility follows the endpoint table, not the account. Stateless endpoints such as chat completions, responses, embeddings, audio transcription, and moderations are eligible. Stateful endpoints such as threads, vector stores, files, batches, evaluations, and fine-tuning are not. Using an ineligible endpoint on a ZDR organization steps outside the arrangement for that call. Since August 19, 2026, OpenAI previews Private Safety Processing for ZDR deployments, which runs cross-interaction safety detection on customer-controlled infrastructure or on OpenAI infrastructure encrypted with customer-held keys, returning only narrow safety signals without exposing content to personnel. Even under ZDR, CSAM-flagged image content is retained for mandatory reporting. A related nuance for 2026 is extended prompt caching: ZDR organizations default to in-memory on older models but GPT-5.5 and later only support the 24-hour cache mode, which requires stored KV tensors even when raw prompts are discarded.

ChatGPT Business, Plus, and Free run under consumer terms and do not offer ZDR. They are not an appropriate destination for regulated data regardless of which API configuration you hold.

Mistral

Mistral stores API data for up to 30 days for abuse monitoring on the standard tier and does not use it for training. ZDR is available on the Scale plan (paid API) via support request with justification and a signed DPA. ZDR covers stateless API endpoints only. Agents, batch files, conversations, libraries, Files endpoints, and Vibe Work are explicitly excluded. Metadata for billing is retained even under ZDR. Mistral is headquartered in France and serves EU data in EU regions, so EU residency arrives without cross-border transfer mechanisms. For teams that need EU-native residency with a short procurement path, that is the structural advantage.

Cohere and xAI

Cohere offers ZDR as an enterprise option with flexible retention, and enterprise tier API data is not used for training. xAI offers enterprise-only ZDR with no persisted request or response data and no server-side threaded history. Both reserve rights in de-identified data under baseline enterprise terms, and both require account-team enablement for the strongest posture.

Hyperscalers: the same models, a different contract

Hyperscalers resell models and change who can see the data and which compliance artifacts cover it.

AWS Bedrock

Bedrock does not store or log prompts and completions by default and does not share inputs and outputs with model providers. No training on customer data applies across hosted models, and encryption is applied in transit and at rest with AWS KMS including customer-managed keys. Invocation logging and prompt caching are opt-in only, and PrivateLink is available for Bedrock Runtime and Mantle to keep traffic inside the VPC.

Invocation logging is the customer-side knob that teams forget. Enabling it recreates persistence on the AWS side even when the model provider sees nothing. Data residency is explicit: in-region inference keeps requests in one region for strict compliance, geo and global profiles route more broadly. Bedrock is HIPAA eligible and FedRAMP High authorized in GovCloud, with an AWS Healthcare BAA that can cover Claude via Bedrock as a sub-processor chain. Anthropic as sub-processor must be acknowledged in the BAA. For workloads that require ZDR for Claude on Bedrock, eligibility is managed jointly by Anthropic and AWS and requires a sales conversation.

Azure OpenAI

Azure OpenAI runs OpenAI models inside Microsoft's tenancy, identity, and compliance boundary. Microsoft does not use customer data to train OpenAI models, and Azure Private Link can isolate the Foundry resource to a VNet with no public access. Abuse-monitoring storage and human review for that purpose can be disabled via a modified abuse-monitoring agreement, gated behind EA or MCA agreements and a support ticket. Stored features such as Threads, Files, vector stores, and stored completions persist data by design and remain outside any ZDR-equivalent opt-out. ZDR in the Azure sense is therefore an abuse-monitoring exception. It does not act as a platform-wide toggle.

HIPAA BAA is available through the Microsoft enterprise agreement, and FedRAMP High authorization exists for Azure OpenAI within Azure Government. EU Data Boundary coverage now applies to EU tenants. Region pinning is available via deployment types: global types may process anywhere, data zone types stay inside the declared zone, and regional types process in the deployment region.

Google Vertex AI

Vertex AI stores prompts transiently and does not use them for training without permission. ZDR-equivalent terms are available via data processing addenda, with product-level choices. Vertex is SOC 2 Type II, ISO 27001, HIPAA eligible via Google Cloud Healthcare BAA, and FedRAMP High for Vertex AI Search and Generative AI. KMS, IAM, and VPC Service Controls provide perimeter control, and Model Garden allows deploying open models inside the customer's GCP project for a path closer to self-host.

Exceptions are product-driven. Search and Maps grounding retains data for 30 days, Files and caches persist by design, and sanitized logs can still be written. Like the other hyperscalers, customer-enabled logging or caching recreates persistence even when the provider's ZDR term holds.

Neoclouds and inference specialists

These platforms host open weights such as DeepSeek, Qwen, GLM, Llama, and Mistral at low cost and with simpler ZDR posture. They are relevant when the workload can run on an open model and the contract can be held by a U.S.-operated inference provider. That avoids contracting directly with the original lab.

Fireworks AI

Fireworks retains ZDR by default on its inference service. Prompts and generations exist only in volatile memory for the request. Metadata such as token counts is logged for service delivery. Prompt-caching KV data can linger in volatile memory for several minutes when caching is active but is not written to persistent storage. Users can opt in to logging for features such as FireOptimizer.

The Response API is the exception. With store=true (the default) the Response API retains full conversation data, including prompts, responses, and tool calls, for 30 days, with immediate deletion available via the DELETE endpoint. Setting store=false restores ZDR for that API. Training never uses customer data. Fine-tuning data is minimal and deletable: datasets on managed storage are customer-deletable, checkpoints and traces are kept 30 days then removed, and BYOB plus customer-managed encryption keys allow the dataset to stay in the customer's bucket.

SOC 2 Type II and HIPAA BAA available on enterprise tier, with dedicated single-tenant deployments. Region pinning via support request.

Together AI

Together does not store inputs and outputs by default and does not train on customer data without explicit opt-in. ZDR is available via a self-serve toggle in Organization Settings under Privacy, global or per-feature, not gated behind sales. The control is effective from the moment it is enabled and does not retroactively erase prior data. The platform separates standard models from passthrough models that forward prompts to an upstream provider under that provider's policy; the passthrough toggle is independent, so disabling it keeps traffic inside Together's infrastructure. Distribution covers major Chinese-hosted models such as DeepSeek and Qwen from North American data centers with a no-provider-sharing stance.

SOC 2 Type II, ISO 27001, and dedicated single-tenant endpoints are available. Together explicitly notes that temporary caching may be used for performance unless disabled.

Groq, Cerebras, and others

Groq does not retain inference inputs and outputs by default and does not train on customer data. Retention applies only for batch jobs and fine-tuning artifacts, and for two operational cases: troubleshooting reliability or investigating abuse, with logs kept up to 30 days when used. ZDR is self-serve in Data Controls, globally or per feature. When enabled, Groq does not retain data for reliability or abuse monitoring, which also disables features that depend on retention such as batch and fine-tuning. After contract termination, Groq commits to deletion on request within 180 days. SOC 2 Type II.

Cerebras, Baseten, Nebius, Parasail, and DeepInfra all publish ZDR-capable postures with no training on customer data. The operational detail to check is passthrough behavior and whether the gateway you use forwards to the provider directly or via an operator that self-reports its backing provider.

Complete comparison

Provider	Default retention (no ZDR)	ZDR how to enable	ZDR covers	Notable exceptions that survive ZDR	Training on API data	HIPAA BAA	FedRAMP High	Residency control	Verification
Anthropic API	7 days (30 days pre Sep 2025)	Enterprise arrangement, account-team approval, console Privacy Controls	Eligible APIs and products on commercial org key, including Claude Code on that key	Covered Models Fable 5 and Mythos 5 excluded, User Safety classifier results retained, code execution and MCP traffic outside ZDR, legal and flagged-session holds up to 2 years	No, by default	Yes, separate from ZDR	Via Bedrock or Vertex path	US + SCCs direct, residency via Bedrock/Vertex	Console + contract + model routing check
OpenAI platform	30 days abuse monitoring	Sales approval, org or project toggle, store forced false	Stateless endpoints: chat completions, responses, embeddings, audio, moderations	Threads, vector stores, files, batches, evaluations, fine-tuning not eligible, Private Safety Processing runs on customer or customer-key-encrypted storage, CSAM image retention, GPT-5.5+ only 24h cache mode	No, by default since Mar 2023	Via ChatGPT Enterprise and BAA-eligible API endpoints	Via Azure OpenAI path	US + SCCs direct, EU Data Boundary via Azure	Admin API data_retention status, org Settings
Mistral API	30 days	Scale plan, support request with justification, DPA	Stateless API endpoints only	Agents, batch files, conversations, libraries, Files, Vibe Work, metadata for billing	No	Via EU DPA	-	France/EU native, no SCCs for EU	Account settings, DPA
Cohere API	Configurable	Enterprise arrangement	Selected endpoints	Feature-specific	No on enterprise tier	On request	-	EU available	Sales documentation
xAI API	Temporary audit storage	Enterprise ZDR addendum	API inference	No server history, de-identified data rights reserved	Temporary audit, else no persisted training use	-	-	US	Contract
AWS Bedrock	No storage by default, no provider sharing	Default, invocation logging opt-in only, provider-specific ZDR via sales where needed	All hosted models at provider layer	Customer-enabled logging and caching recreates persistence on AWS side, provider-specific exceptions where declared	No	Yes (AWS Healthcare BAA, Bedrock eligible)	Yes (GovCloud)	In-region, geo, global profiles, PrivateLink	Console logging config, BAA artifact
Azure OpenAI	Abuse monitoring storage unless opted out	Modified abuse monitoring agreement, EA/MCA plus support ticket	Inference on opted-out resources	Threads, Files, vector stores, stored completions persist by design	No	Yes (Microsoft BAA)	Yes (Azure Government)	EU Data Boundary for EU tenants, Private Link, regional types	Support ticket confirmation, deployment type
Google Vertex AI	Transient, sanitized logs may persist	DPA arrangement, product-level	Selected Vertex services	Grounding 30 days, Files and caches persist, live session state, sanitized logs	No without permission	Yes (Google Cloud BAA)	Yes (Search and Generative AI)	VPC Service Controls, regional deployment	DPA, Cloud Data Processing Addendum
Fireworks AI	Zero by default (volatile memory only)	Default, no enablement needed; Response API requires store=false	All inference except Response API with store=true	Response API conversations 30 days when stored, KV cache minutes in volatile memory, opt-in FireOptimizer logging	No	Yes (enterprise, sales-gated)	-	Region pinning via support	Docs plus store flag audit
Together AI	Zero by default	Self-serve Privacy toggle, immediate effect, global or per feature	Standard non-passthrough models	Passthrough models follow upstream provider, temporary caching, prior data not retroactively erased	No without explicit opt-in	-	-	Dedicated endpoints, region select	Org Settings, passthrough toggle
Groq	No retention by default except two operational cases up to 30 days	Self-serve Data Controls, global or per feature	Inference endpoints	Batch 30 days, fine-tuning until deleted, reliability and abuse logs when enabled	No	-	-	GCP US buckets	Data Controls page

Choosing by procurement context

EU data residency as a hard requirement. Use Mistral on EU regions or Azure OpenAI with an EU tenant under EU Data Boundary. Both keep processing inside the EU without SCCs for that hop. Vertex AI in EU regions is an alternative when Gemini or Claude via GCP is the architectural match.

HIPAA with private networking. Bedrock and Azure OpenAI are the most audited paths, with HIPAA-eligible services, BAA via AWS Artifact or Microsoft agreement, and PrivateLink patterns that keep PHI inside the VPC. Vertex AI is also HIPAA eligible. Direct Anthropic API offers a BAA as well, now without requiring ZDR first, but verify per-endpoint scope.

FedRAMP High for government workloads. Bedrock, Azure OpenAI, and Vertex AI Search plus Generative AI all hold FedRAMP High for their core generative services. The diligence is service-specific: confirm the exact model, endpoint, and region you plan to use sits inside the authorization boundary.

Open-weight economics with control. Fireworks, Together AI, and Groq provide ZDR by default with no training, low latency on open models, and a path to self-host when even a managed provider is not desired. Fireworks adds HIPAA BAA for regulated open-weight workloads, Together adds self-serve ZDR without sales.

Multi-provider routing. OpenRouter and gateways that expose a zdrEnabled flag let the router skip non-ZDR providers and drop operators that self-report an unverified backing provider. The value is request-level enforcement. An account-level promise alone leaves exposure at the layer where one request in a batch lands on a non-ZDR endpoint.

Enforcing ZDR in your stack

A signed ZDR addendum does not enforce itself. Three controls determine whether the promise survives a production deploy.

1. Enforce at the request before it leaves. Account-level settings help, but per-request flags govern what happens when routing logic or a cache changes. Set store=false on OpenAI Responses, store:false on Fireworks Response API, enable ZDR globally plus per-feature in Groq Data Controls, and use a gateway with zdrEnabled when routing across providers. The direct OpenAI API failure pattern most teams hit is a signed BAA without ZDR enabled on the specific call, which places that call outside HIPAA scope.

2. Track model and endpoint eligibility. Not every model at a ZDR provider is ZDR-eligible. Anthropic Covered Models, Mistral stateful features, OpenAI Threads and Files, and Fireworks Response API with store=true all override the account promise. Maintain an allowlist of ZDR-compatible models and endpoints and block others at the gateway.

3. Keep the audit trail on your side. Providers may retain classifier results, sanitized logs, or metadata even under ZDR. Your own logging of provider name, model ID, endpoint, store flag, and response ID gives the compliance team a record that does not depend on the provider's interpretation of zero. That record is also the remediation path when a model release falls outside an existing BAA and must be deployed through a different channel.

ZDR is a strong baseline for privacy-sensitive AI workloads, and it is not the whole compliance story. It removes the provider-side durable copy that most reviews flag first. Data residency, BAA scope, feature eligibility, and your own logging fill the rest. Choose the provider whose narrowest ZDR definition still matches the narrowest data flow your app will generate.

Sources

• Zero Data Retention how to enforce it across AI providers, PCTechMag, July 6, 2026. Accessed August 27, 2026.
• Cross-provider zero-data-retention commitments, OpenAgreements. Accessed August 27, 2026.
• Offering Zero Data Retention for frontier models, OpenAI, August 19, 2026. Accessed August 27, 2026.
• OpenAI Zero Data Retention research guide, CASRAI, August 17, 2026. Accessed August 27, 2026.
• Data Controls in the OpenAI platform, OpenAI. Accessed August 27, 2026.
• API and data retention, Anthropic. Accessed August 27, 2026.
• I have a zero data retention agreement with Anthropic. What products does it apply to, Anthropic Privacy Center, June 9, 2026. Accessed August 27, 2026.
• How long do you store my organization's data, Anthropic Privacy Center. Accessed August 27, 2026.
• Zero data retention - Claude Code Docs, Anthropic. Accessed August 27, 2026.
• AI Infrastructure Privacy Data Residency and Self-Host Comparison, SideGuy Solutions, May 11, 2026. Accessed August 27, 2026.
• Privacy-First AI APIs 5 That Won't Train on Your Data, AI Policy Desk, April 29, 2026. Accessed August 27, 2026.
• Zero Data Retention, Fireworks AI Docs. Accessed August 27, 2026.
• Privacy and security - Together AI docs, Together AI. Accessed August 27, 2026.
• Your Data in GroqCloud, Groq Docs. Accessed August 27, 2026.
• Groq Cloud Data Retention Policy - Does Groq Train on Your Data, Meetily, May 11, 2026. Accessed August 27, 2026.
• Amazon Bedrock Security and Privacy, AWS. Accessed August 27, 2026.
• Amazon Bedrock vs Azure OpenAI vs Vertex AI 2026 Comparison, AgileSoftLabs, May 28, 2026. Accessed August 27, 2026.
• Azure OpenAI vs Bedrock vs Vertex Enterprise AI Cloud War 2026, TheBriefScript, July 9, 2026. Accessed August 27, 2026.
• BAAs with OpenAI Anthropic and AWS Bedrock 2026 Healthcare Guide, TactionSoft, May 15, 2026. Accessed August 27, 2026.