The ZDR verdict on
six MaaS platforms
Before an enterprise sends data to a MaaS platform, it needs one question answered: after the prompt goes out and the response comes back, is either still in the platform's hands. All six vendors promise not to train on customer data, and that promise does not answer the question. Zero data retention (ZDR) does: the platform discards the input and output once the request is served, writing neither to durable storage.
ZDR rather than "not used for training", because terms can be amended, reinterpreted and overridden by a court, while data that does not exist cannot be produced. This audit sorts the six platforms into four tiers on that basis.
The one thing all six can be compared on
"Not used for training", "not read by humans" and "not stored long term" are three different claims. Each vendor presents an internally coherent account, but those accounts are difficult to compare. One question can be compared across all six: after the request ends, do the prompt and completion enter durable storage?
Answering that question requires checks at three layers. The prompt is what is sent to the model, and the completion is what the model returns. The provider layer covers storage by the model provider. The platform layer covers storage by the cloud service. The tool layer covers storage by an intermediary such as Cursor.
Retention at any one of these layers breaks end-to-end zero data retention (ZDR). The verdicts that follow use four tiers.
| Platform | Tier | Condition for ZDR | Best attainable | Residual, non-eliminable |
|---|---|---|---|---|
| Amazon Bedrock | A | Zero retention by default. The account mode is a ceiling rather than a floor: a model whose allowed_modes includes none operates at zero retention under any mode |
Five OpenAI models are C (classifier-flagged traffic retained up to 30 days; requestable per account and per model, with none appearing in allowed_modes once approved). Fable 5 and Mythos 5 share data with Anthropic by default, and the two documents disagree |
CSAM hits; the metadata notice for Claude Code and computer use. Where none is not set explicitly, add retention arising from interface semantics such as store=true and the Batch API |
| Google Gemini Enterprise Agent Platform | A / C forks on contract identity |
Customers under a GCMA are exempt from abuse-monitoring prompt logging by default (A); self-serve customers under the GCP Terms of Service are logged for up to 90 days and must apply for an exception (C) | GCMA, plus avoiding Advanced AI models, Grounding with Google Search and Grounding with Google Maps, plus disabling the Gemini in-memory cache per project via cacheConfig |
Once grounding is used, retention cannot be disabled: Search keeps de-associated queries and contextual information for up to 3 days, excluding generated output, and Web Grounding for Enterprise is offered as an alternative; Maps keeps 30 days including generated output, with no alternative |
| Microsoft Foundry | C gate effectively closed |
Once approved for modified abuse monitoring, the data storage and human review process is not performed | A self-serve purchaser lands at D in practice: an official document states it is not currently possible to become a managed customer | Automated review still runs in line; after approval a customer may be asked to re-enable abuse monitoring with human review; preview features carry a separate privacy posture |
| Cursor | B | With Privacy Mode on, Cursor does not use customer data for training and maintains ZDR agreements with all providers; Enterprise has it on by default | Non-ZDR models are either designated as such, or require an admin to opt in for the workspace before they can be used | The temporary file cache used to cut latency; codebase indexing; retention following a risk-classifier hit |
| BytePlus ModelArk | B → D | The content pre-filter can be disabled per inference endpoint. The data-processing page ties the 180 days to traffic triggered by the filter; the pre-filter page ties retention to the customer enabling the feature but states only a limited period | Disabling removes the documented path, but the retention posture of the baseline content safety layer is not published and there is no zero-retention product commitment, so it cannot be verified | Baseline content safety policies; no zero-retention commitment |
| Alibaba Cloud International Model Studio | D cannot be determined |
No published path | Neither the terms nor the documentation publishes a platform-side default retention window, and there is no zero-retention product commitment. This is not a finding that nothing is retained, only that the public material does not support a judgment | All unknowns; the terms also permit disclosure to enforcement agencies, regulators, government bodies and other appropriate third parties |
The table distinguishes between what the public material says and what the platforms retain. Azure and Alibaba Cloud International both read does not publish, not does not retain. The first describes the public material. The second would be a conclusion. In an audit, the two are not interchangeable.
What each platform can reach, and what stays behind
The comparison now turns from the shared test to how each platform applies it. The differences are not about how many days each vendor keeps data. They concern whether the state can be verified at all, and which layer controls access.
Amazon Bedrock · A
The audit places Amazon Bedrock in tier A. Zero retention is the default. The account-level retention mode sets a ceiling: the most retention the customer will accept. It does not decide how every request is handled.
That distinction produces a simple operational rule. A customer can confirm it without reading a contract.
The rule is directly testable. GET /v1/models returns a data_retention object containing mode, source and allowed_modes. In us-east-1 on 2026-07-27, the API returned 55 models. 8 model ids lacked none, mapping to 6 models, while 47 allowed all three modes.
No other platform in this comparison exposes its per-model retention rule as a readable API field.
none in allowed_modes, mapping to 6 modelsThe exceptions fall into two groups. The first involves abuse monitoring. The platform runs classifiers over inputs and outputs to identify policy violations and may retain flagged traffic for review. This group names 6 models: GPT-5.4, GPT-5.5, GPT-5.6 Sol, GPT-5.6 Terra, GPT-5.6 Luna and Claude Fable 5.
The five OpenAI models are tier C. Classifier-flagged traffic may be retained for up to 30 days. ZDR must be requested per account and per model. Once approved, none appears in allowed_modes.
The data-retention page also names Mythos 5, bringing the combined total to 7 models. Fable 5 and Mythos 5 share data with Anthropic by default. On these models, the AWS and Anthropic materials point in opposite directions.
The public documents do not resolve that discrepancy. The signed contract governs.
The retention mode does not protect every Bedrock path. Child sexual abuse material, or CSAM, may be retained after a classifier hit. The retention mode also does not remove the metadata notice associated with Claude Code and computer use.
An organisation can prevent member accounts from changing retention settings through a service control policy (SCP). An SCP sets an organisation-wide permission ceiling in AWS Organizations that member accounts cannot exceed.
Google Gemini Enterprise Agent Platform · A / C
Google Gemini Enterprise Agent Platform divides customers by contract identity. A Google Cloud Master Agreement (GCMA) is negotiated directly with Google. Self-serve signup instead uses the Google Cloud Platform (GCP) Terms of Service.
Customers under a GCMA are tier A, because they are exempt from abuse-monitoring prompt logging by default.
Self-serve customers under the GCP Terms of Service are tier C. Their regular abuse-monitoring prompt logs may be retained for up to 90 days. An exception requires an application.
The best attainable configuration combines a GCMA with avoiding Advanced AI models and both grounding features. It also disables Gemini's in-memory cache for each project through cacheConfig. That cache has a time to live (TTL) of 24 hours. Google states that disabling it is supported: This feature can be disabled at the project level.
Grounding introduces separate retention rules. Grounding with Google Search stores de-associated queries and contextual information, but not generated output, for up to three (3) days for debugging. Web Grounding for Enterprise provides an alternative.
Grounding with Google Maps stores prompts, contextual information and generated output for thirty (30) days, with no published alternative. Its no-disable wording is identical to the corresponding wording for Grounding with Google Search: There is no way to disable the storage of this information if you use Grounding with Google Maps.
Advanced AI features may separately retain prompts and responses for 30 days. Contract identity therefore sets the starting tier. The features used determine whether that tier survives the full request path.
Microsoft Foundry · C, with the gate closed
Microsoft Foundry falls into tier C, but its eligibility gate is effectively closed to self-serve purchasers. Approval for modified abuse monitoring removes the documented storage and human-review process. Azure does not publish a retention duration for abuse monitoring.
ms.date 2026-05-18 · captured 2026-07-26Access to that approval is limited to customers and partners managed by a Microsoft account team or covered by an eligible program. A managed customer is one managed directly by such a team. However, a second Microsoft document points the other way.
In practice, a self-serve purchaser therefore lands at tier D. This conclusion is an inference from a shared eligibility gate. The sentence about becoming a managed customer appears in the modified-content-filter context and is not repeated on the abuse-monitoring page.
Even after approval, three residuals remain. Automated review continues inline. Preview features carry a separate privacy posture. Microsoft may also require human review to be restored later.
Cursor · B
Cursor falls into tier B. With Privacy Mode enabled, customer data is not used for training, and Cursor relies on ZDR agreements with its model providers. Enterprise workspaces have Privacy Mode enabled by default.
Non-ZDR models follow one of two paths. The level of protection depends on the path.
A model’s non-ZDR designation alone does not block the call. The administrator opt-in requirement does block it, unless the workspace accepts the model. That second path resembles Bedrock making a model unavailable when it falls outside the permitted retention mode.
Those controls do not cover every form of retention. Privacy Mode does not remove the temporary file cache used to reduce latency, codebase indexing, or retention following a risk-classifier hit.
BytePlus ModelArk · B → D
BytePlus ModelArk initially resembles tier B, but it returns to tier D. Its content pre-filter is enabled by default when an inference endpoint is created. The filter can be edited later and disabled separately for each endpoint. The data-processing page ties retention to traffic that triggers the filter.
Disabling the pre-filter removes that documented retention path. However, it does not establish end-to-end ZDR.
The public material does not disclose the retention posture of ModelArk’s baseline layer. It also contains no zero-retention product commitment. ModelArk therefore remains in tier D because ZDR cannot be verified.
Alibaba Cloud International Model Studio · D
Alibaba Cloud International Model Studio also falls into tier D. Here, the reason is the lack of a determinable answer, not proof that ZDR is impossible.
The international Product Terms of Service, dated 2026-05-29, and the Model Studio privacy notice, which carries no public version date, do not publish a platform-side default retention window for inference data. Both were captured on 2026-07-26. Neither provides a zero-retention product commitment.
The tier D verdict is not a finding that the platform retains nothing. It means that the public material does not support a judgment either way.
Retention windows: every figure that appears in this audit
Exit paths: where each platform's gate sits
Google appears twice because its tier depends on whether the customer signed a GCMA or the GCP Terms of Service. Azure’s approval path is unavailable in practice to self-serve purchasers because an official document states that it is not currently possible to become a managed customer.
One, measurability. Only Bedrock makes the platform’s per-model retention rule directly readable through an API. The other five can be confirmed only indirectly through contract text or a console attribute. That gap matters more than any comparison of retention days.
Two, "not attainable" has two forms. One is explicitly unsupported. The other is unverifiable. The second is harder to handle because an organisation cannot explain to a regulator a state it cannot itself measure.
Three, the real gate is contract identity, not technical configuration. Google looks at whether the customer signed a GCMA or the GCP Terms of Service. Azure looks at whether the customer is a managed customer. Two companies on the same technical platform can therefore have entirely different default privacy states.
Four, the approval and eligibility paths are broadly revocable. Eligibility, once granted, is not a permanent property of the account.
"Not used for training" can be entirely true while the data is still kept
The next step separates training from retention. All six vendors publish some version of a commitment not to train models on customer data. Its scope, however, is often narrower than it first appears.
First layer: model type
Slack’s privacy principles show why model type matters. Generative models produce content, as a large language model does.
Predictive models perform a different task. They score or rank options, as systems for emoji suggestions, channel recommendations or search ordering do. Slack places two statements side by side:
The generative-model and predictive-model statements can both be true. Customer messages, content and files are excluded from generative-model development but remain available for developing predictive features.
The next distinction is procedural. Slack states:
An opt-in requires active consent before the practice begins. Predictive-model training instead uses an opt-out: it applies by default and must be actively declined.
The Slack dispute recorded on 2024-05-17 shows how that opt-out worked. An organization or workspace owner had to email a named address using a specified subject line. There was no console switch.
Second layer: product improvement is counted separately
Zoom’s terms add a second distinction. Product improvement can sit outside the category called AI training. Its current terms, effective 2023-08-11, state:
The same terms also provide:
The two clauses coexist because customer content and aggregated data are treated as different categories. De-identification removes or replaces the parts of a dataset that point to a specific person.
Once data has been de-identified or anonymized and aggregated, Zoom reserves the right to use it for service analysis, development, improvement, support and operation. That right applies both for the customer and for unrelated customers, during and after the agreement.
The timing also has historical relevance. Contemporaneous press reporting indicates that Zoom added disputed wording in March 2023 that placed AI training within a product and service development clause. Zoom then revised the terms repeatedly in August 2023 under public pressure.
The contemporaneous press reporting is used here only to establish the timeline because no primary snapshot of the March 2023 text is available.
Third layer: changing terms and contractual regimes
The third layer concerns contractual scope over time. The same vendor can operate under several different contractual regimes and can amend one without changing the others. On 2025-08-28, Anthropic updated its consumer terms.
For users who allowed their data to be used for training, the retention period changed from 30 days → five years. Existing users had to make a decision by 2025-10-08 to continue using Claude.
The consumer-terms change did not extend across Anthropic’s commercial services:
A reference to Anthropic’s policy is therefore incomplete unless it identifies the contractual layer. Consumer use, direct commercial use and API access through another cloud provider do not necessarily carry the same terms.
Turning off the consumer training setting also operates only prospectively. Data already included in a training run cannot be withdrawn from that run.
Under one order, the deletion promise failed and non-existence held
The audit now turns from platform policy to the legal exception. This is the hardest layer of the test. The record in The New York Times litigation against OpenAI shows that the exception is not merely standard contractual boilerplate.
2025-05-13 · Preservation order
That record begins on 2025-05-13, when Magistrate Judge Ona T. Wang issued a preservation order in case 25-md-3143 (SHS) (OTW). A preservation order directs a party to stop destroying material that may be relevant, even when the party would otherwise have an obligation to delete it. The order stated:
The order expressly included:
2025-05-16 · Reconsideration denied
The next step was reconsideration. The court denied reconsideration on 2025-05-16. In that order, the court acknowledged that compliance would proceed:
After reconsideration was denied, the order remained in place.
2025-05-27 · Enterprise and Edu excluded
The impact then depended on whether the relevant data existed. ChatGPT Free, Plus, Pro and Team users were affected. So were API customers without a ZDR agreement. ChatGPT Enterprise and Edu were not affected.
On 2025-05-27, the court clarified the Enterprise exclusion. OpenAI later described that clarification on its page published 2025-06-05:
ZDR endpoints: the order cannot reach them
The same distinction applied to API customers using ZDR endpoints. They were also outside the order’s practical reach. OpenAI explained the distinction directly:
Under the same preservation order, a deletion commitment did not prevent retention, while non-existence did. The difference did not lie in the wording of a privacy promise. It depended on whether the prompts and completions had been stored in the first place.
2025-09-26 · Obligation ends, residue remains
The preservation obligation lasted from 2025-05-13 to 2025-09-26, roughly four and a half months. OpenAI later stated:
On 2025-10-22, OpenAI updated its page. It said that standard 30-day deletion had resumed. It also said that limited historical user data from April to September 2025 would remain securely stored.
Continued retention no longer applied to conversations originating in the European Economic Area, Switzerland and the United Kingdom.
2025-11-07 · 20 million logs ordered produced
Preservation was not the final step. Stored material could later become subject to a motion to compel production, an order requiring one party to hand material to the opposing side.
On 2025-11-07, the court ordered OpenAI to produce 20 million de-identified consumer ChatGPT logs to the plaintiffs. Production was due 2025-11-14 or within 7 days of completing de-identification. The order found:
The plaintiffs stated that de-identifying the records had taken two and a half months. OpenAI sought reconsideration and a stay on 2025-11-12. The request was denied. De-identification therefore did not make the retained material immune from compelled production.
Not one vendor's problem
The pattern extended beyond OpenAI. The same order cited Concord Music Group v. Anthropic, where the court had directed production of the entire five-million record sample to the plaintiff. The common factor was that the data existed. It could therefore be placed under preservation and compelled disclosure.
Terms can be amended, reinterpreted and overridden by a court. Data that does not exist cannot be produced. ZDR is not merely a stricter privacy preference. It is the only state that still holds when a third party compels disclosure.
Terms change, so every verdict is anchored to a version
Each judgment applies only to the versions listed below. If a page is revised, the conclusion may no longer hold and has to be re-checked.
That happened once during this audit. A documentation page that recorded the grounding retention posture went dead, and its content does not match the current page.
Versions of the audited terms and documents
| Platform | Document | Date marked on page | Captured |
|---|---|---|---|
| Amazon Bedrock | AWS Service Terms §50 (incl. §50.12.2) | 2026-07-17 | 2026-07-26 |
| Amazon Bedrock | Data retention / Abuse detection user guide | no public version marker | 2026-07-26 |
| Amazon Bedrock | Enforce zero data retention (AWS Security Blog) | 2026-07-07 | 2026-07-26 |
| Amazon Bedrock | GET /v1/models measurement (us-east-1, 55 models) | not applicable | 2026-07-27 |
| Microsoft Foundry | Limited access | ms.date 2023-11-03 (page renders Last updated on 2026-05-19 UTC) | 2026-07-26 |
| Microsoft Foundry | Data privacy (source of the modified abuse monitoring wording) | ms.date 2026-05-18 | 2026-07-26 |
| Microsoft Foundry | Abuse monitoring | ms.date 2026-05-13 | 2026-07-26 |
| Microsoft Foundry | Configure content filters (source of the managed-customer sentence) | Last updated 2026-02-27 | 2026-07-26 |
| Google Agent Platform | Abuse monitoring | Last updated 2026-07-23 | 2026-07-26 |
| Google Agent Platform | Zero data retention (grounding and in-memory cache clauses) | Last updated 2026-07-23 | 2026-07-27 |
| Advanced AI Safety Addendum | Last modified 2026-06-17 | 2026-07-26 | |
| Service Specific Terms (grounding, Section 20) | Last modified 2026-07-16 | 2026-07-27 | |
| Alibaba Cloud Intl | International Website Product Terms v3.8.0 | 2026-05-29 | 2026-07-26 |
| Alibaba Cloud Intl | Membership Agreement (cited from the /id/ path) | Last Updated 2025-09-25 (the /en/ path of the same document reads 2026-05-12; §4.1 and §5.2 are word-for-word identical) | 2026-07-26 |
| Alibaba Cloud Intl | Model Studio help-centre documentation | no public version marker | 2026-07-26 |
| BytePlus ModelArk | Data Processing / Content Pre-filter | Last updated 2026-07-05 | 2026-07-26 |
| Cursor | Data use | Last updated 2026-07-15 | 2026-07-26 |
| Anthropic | Data retention practices for Covered Models | no public version marker (help centre shows relative time only) | 2026-07-26 |
| Anthropic | Covered Models (source of the no-ZDR sentence) | no public version marker (as above) | 2026-07-26 |
Timeline of external events
Supports sections 3 and 4. The three rows marked [press] rely on contemporaneous reporting rather than a primary snapshot of the terms. They are not used as clause evidence.
| Date | Event | Basis |
|---|---|---|
| 2023-03 | Zoom adds AI training wording inside a product and service development clause | [press] |
| 2023-08-07 to 08-11 | Zoom revises the text repeatedly, adding a consent requirement | [press] |
| 2023-08-11 | Effective date of Zoom's current terms, retaining the Aggregated Anonymous Data clause | [official] |
| 2024-05-17 | Slack's default use of customer messages to train predictive models draws public criticism | [press] |
| 2025-01-22 | Court first addresses OpenAI's deletion of output logs; wholesale preservation denied | [court filing] |
| 2025-05-13 | Preservation order issued, covering data deleted at a user's request and data privacy laws would require deleting | [court filing] |
| 2025-05-16 | OpenAI's motion for reconsideration denied | [court filing] |
| 2025-05-27 | Court clarifies that ChatGPT Enterprise is excluded from preservation | [official] |
| 2025-06-05 | OpenAI publishes its response page, confirming ZDR API customers are unaffected | [official] |
| 2025-08-28 | Anthropic updates consumer terms, extending retention from 30 days to five years | [official] |
| 2025-09-26 | Preservation obligation ends | [official] |
| 2025-10-08 | Deadline for Anthropic consumers to make their selection | [official] |
| 2025-10-22 | OpenAI updates the page: 30-day deletion resumed, April to September data still held | [official] |
| 2025-11-07 | Court orders production of 20 million de-identified consumer logs | [court filing] |
| 2025-11-12 | OpenAI seeks reconsideration and a stay; denied | [court filing] |
| 2026-07-26 / 27 | Capture and measurement dates for this article | this article |
The clause text this article rests on
The clauses below are quoted verbatim for cross-checking. The full list contains 61 entries. These are the entries on which the argument above directly depends.
| Source | Verbatim |
|---|---|
| AWS · abuse-detection | Amazon Bedrock uses a zero data retention (ZDR) data security model. This means that by default, Amazon Bedrock does not store model inputs or outputs. |
| AWS · data-retention | If a model's allowed_modes includes none, we won't persist anything. |
| AWS · Security Blog | Models that support zero data retention will still operate with zero retention regardless of your account-level setting. |
| AWS · abuse-detection | For these models, eligible customers may request full ZDR through their AWS account team. |
| AWS · data-retention | Setting store=false does not guarantee zero data retention. |
| AWS · Security Blog | We may store and review flagged content to determine if it is CSAM for reporting purposes, even when mode is none. |
| Anthropic · Covered Models | zero data retention is not available in workspaces, Claude Enterprise organizations, or third-party platforms (e.g., Azure Subscriptions) where Covered Models can be accessed |
| Google · abuse-monitoring | customers with a Google Cloud Master Agreement are exempt from prompt logging for this abuse monitoring by default |
| Google · zero-data-retention | Google collects and stores logs, which contains the following Customer Data: queries derived from End User prompts and contextual information that Customer may provide along with the prompts that are not associated with any Customer or its End Users for up to three (3) days |
| Google · zero-data-retention | Google stores prompts and contextual information that customers may provide, and generated output for thirty (30) days for the purposes of creating grounded results |
| Google · zero-data-retention | There is no way to disable the storage of this information if you use Grounding with Google Search. |
| Azure · data-privacy | If the customer has been approved for modified abuse monitoring..., the data storage and human review process described above is not performed. |
| Azure · content-filters | At this time, it is not possible to become a managed customer. |
| Cursor · data-use | Non-ZDR models will be designated as such or require an admin to opt-in to enable the model for your workspace. |
| BytePlus · data processing | input and output triggered by the filter are retained for 180 days in Malaysia |
| BytePlus · content pre-filter | even if you disable this feature, our services still maintain baseline content safety policies |
| Court filing · preservation order 2025-05-13 | whether such data might be deleted at a user’s request or because of “numerous privacy laws and regulations” that might require OpenAI to do so |
| OpenAI · response page | You are not impacted. If you are a business customer that uses our Zero Data Retention (ZDR) API, we never retain the prompts you send or the answers we return. Because it is not stored, this court order doesn’t affect that data. |
| Court filing · production order 2025-11-07 | OpenAI has failed to explain how its consumers’ privacy rights are not adequately protected by: (1) the existing protective order in this multidistrict litigation or (2) OpenAI’s exhaustive de-identification of all of the 20 million Consumer ChatGPT Logs. |
| Slack · Privacy Principles | We do not develop generative AI models using Customer Data. To develop predictive models for features such as emoji and channel recommendations, our systems analyze Customer Data (e.g. messages, content, and files) submitted to Slack |
| Zoom · Terms of Service | Zoom may use the Aggregated Anonymous Data in accordance with applicable Law, including to analyze, develop, improve, support, and operate the Services and Software provided to you or other unrelated customers, during and after the term of this Agreement |
| Anthropic · consumer terms update | They do not apply to services under our Commercial Terms, including Claude for Work, Claude for Government, Claude for Education, or API use, including via third parties such as Amazon Bedrock and Google Cloud’s Vertex AI. |