Zero Data Retention
Prompts that are never stored, cached, or kept upstream
A no-retention promise is easy to make and hard to keep, because a prompt can persist in more places than the provider: request logs, response caches, provider prompt caches, and stored Responses API state. The Zero data retention (ZDR) policy closes all of them at once. Requests route only to providers that do not log prompts and declare a zero-day retention period, and every check fails closed. LLM Gateway keeps metadata only, bypasses its response cache, strips provider prompt-cache markers, and rejects Responses API requests unless they set store: false. Settings that would weaken the policy, such as Retain All Data or project response caching, stay locked until ZDR is turned off. Apply it to the whole organization, or to a single API key when only one workload needs it. ZDR is part of Provider Compliance Policies and composes with every other requirement.
Why teams turn it on
Only qualifying providers
Requests reach only providers that do not log prompts and declare a zero-day retention period. An unknown retention policy never qualifies.
Nothing stored at the gateway
Logs keep metadata such as model, tokens, cost, and latency. Prompts, completions, and tool payloads are never written.
Caches closed too
The gateway response cache is bypassed and provider prompt-cache markers are stripped, so no copy of the prompt is kept for reuse.
Hard to weaken by accident
While ZDR is on, Retain All Data and project response caching cannot be enabled. Turning them back on means disabling ZDR first.
How it works
From decision to deployed in three short steps
- 01
Clear the prerequisites
For organization-wide ZDR, set data retention to Metadata Only and turn off response caching in every project.
- 02
Enable the policy
Turn on Zero data retention (ZDR) under Settings → Compliance, or on one API key from its Compliance action.
- 03
Enforced on every request
Non-qualifying providers are skipped, payloads are not stored, caches are bypassed, and a request with no compliant provider is rejected with a 403 before it leaves the gateway.
Real-world use cases
Why customers actually adopt this
Regulated data
Healthcare, legal, and financial workloads where a stored prompt would be another copy of customer data to account for.
Contractual no-retention clauses
Back a customer's no-retention requirement with an enforced policy instead of a promise.
One sensitive workload
Set ZDR on a single API key: its requests are metadata-only and uncached, while other keys and organization settings stay as they are.
Frequently asked
- What changes for the Responses API?
- While ZDR is active, Responses API requests must set store: false, and the gateway does not retain compaction state.
- Does anything stop working under ZDR?
- Asynchronous video generation is unavailable, because video jobs need temporary output storage. Response caching and Retain All Data stay unavailable until ZDR is disabled.
- How is key-level ZDR different?
- It forces metadata-only logging and bypasses caching only for requests through that key, without changing organization retention or other keys, and it does not require turning off caching in every project first.
More enterprise capabilities
The rest of the enterprise stack
Organization-Wide Analytics
Cost, requests, and tokens totaled across every project, with breakdowns by model, project, API key, and member. Built on pre-aggregated rollups, so any date range stays fast.
Per-Member Budgets & Developer Role
Per-member spend caps enforced at request time, org-wide default developer limits, and a project-scoped Developer role. An over-budget request is rejected before it ever reaches a provider.
Teams & Directory Sync
Group developers under a shared project ceiling, per-developer budgets, and IAM rules. Microsoft Entra groups map onto teams over SCIM.
Enterprise Audit Logs
Tamper-evident audit trails for SOC 2, HIPAA, ISO 27001, and internal investigations. Every config change, key rotation, and admin action — captured, attributed, exportable.
Data Streams to Your SIEM
Forward audit logs to your SIEM and export request log metadata to your own HTTPS endpoint in signed, ordered batches, with replay of up to 30 days.
Per-Project Routing Overrides
Override global routing rules at the project level — region, provider order, fallback chain, and cost ceilings. Production stays pinned; experimental teams stay flexible.
Dynamic Routes
Named, versioned routing flows with conditions, classifier branches, A/B splits, and model targets. Call one with dynamic/<name> and roll back instantly.
Enterprise Guardrails
Server-side detection for prompt injection, PII, secrets, and policy violations. Configured centrally, enforced at the gateway, auditable per-request.
Provider Compliance Policies
Require SOC 2, ISO 27001, GDPR, zero data retention, no prompt training, or approved headquarters countries, and the gateway refuses every provider that falls short.
Discord & Slack Alerts
Native webhook integrations for Discord and Slack. Get the enterprise contact-sales form, billing events, guardrail trips, and SLA breaches in the channels your team already monitors.
Single Sign-On (SAML / OIDC)
SAML 2.0 and OIDC SSO with SCIM provisioning, group-based role mapping, and enforced-only access. No local credentials, no shared passkeys, no off-boarding gaps.
Master Keys & Provisioning API
Org-scoped bearer tokens that create projects, gateway API keys, IAM rules, and custom providers from your backend, and report cost per member and model.
Organization Skills
Publish shared agent skills once and let developers install them into Claude Code, Codex, Cursor, OpenCode, and other agents with one CLI command.
White-Label Chat & Playground
Embed or stand up a fully white-labeled chat app and playground under your own domain. Customize branding, default models, system prompts, and feature toggles.
See zero data retention on your real workloads
Bring a sample workload to a 30-minute call. We'll wire it up live and show you the actual experience your team will get.