Method & scope. Statements below are drawn from each provider’s official documentation and public privacy policies, verified against the live pages on 26 June 2026. Exact terms (scope, price, eligibility, regions) must be confirmed in your signed contract and subprocessor list. Public ZDR and contractual ZDR do not always overlap. Items that could not be confirmed from a static official page are explicitly flagged as to confirm contractually.
How to read this page
Two things are frequently conflated and should be kept distinct:- Opt-out of training — the provider does not train on your data. Common, often default on paid tiers.
- Zero Data Retention (ZDR) — the provider does not store your inputs/outputs at all (beyond what is technically required to return the response).
Summary table
| Provider | ZDR by default | How to obtain ZDR | Scope covered | Hosting / residency |
|---|---|---|---|---|
| OVHcloud AI Endpoints | Yes — contractual (no storage, even ephemeral) | Nothing to configure | Inference (open-weight models) | OVHcloud (European / sovereign positioning) |
| Mistral La Plateforme | No | Scale plan, stateless API calls only | Stateless inference | EU by default; explicit US endpoint hosts in US |
| Anthropic (direct API) | No, but minimal retention | ZDR arrangement on approval | Messages API, Token Counting, Claude Code (Commercial/Enterprise) | Region-routed (data residency feature) |
| AWS Bedrock | Yes for standard models | Set mode none (lock via SCP) | Inference; some models excluded | Per chosen AWS region; cross-region inference can move processing |
| Google Vertex / Gemini | No | Disable cache + opt out of abuse logging | Inference; not all features | Per chosen GCP region; residency configurable |
| Azure AI Foundry / OpenAI | No | ”Modified abuse monitoring” (Limited Access) | Stateless inference | Per region; deployment type (Global / DataZone) affects processing |
Provider details
OVHcloud AI Endpoints
Default (contractual). OVHcloud’s Conditions Particulières des Services Public Cloud (Annex 10 — AI Endpoints, version 28 April 2025) state that the service “ne comprend ni sauvegarde ni stockage, même éphémère” (no backup or storage, even ephemeral) and that “OVHcloud n’a aucune connaissance des Inputs et des Outputs … ne les réutilise pas, de quelque manière que ce soit … n’effectue aucune sauvegarde des Inputs ou des Outputs” (OVHcloud has no knowledge of, does not reuse, and does not store inputs or outputs). The marketing page adds that only billing data is kept and that data is never used to train or improve models. Models are third-party open-weight products under their own open-source licences — there is no access to proprietary models such as Claude or GPT.Hosting is positioned as European / sovereign (OVHcloud), but the public page does not enumerate specific regions — confirm the serving region in your contract.
Mistral La Plateforme
Default. No ZDR. Inputs and outputs are kept for 30 rolling days for abuse monitoring, then deleted (“unless zero data retention is activated”). Data from the paid API tiers is not used for model training (contractual). ZDR. Available only on the Scale plan and only for stateless API calls. It does not apply to stateful APIs/products — the documentation lists agents, batch processing files, conversations, libraries,/v1/files, Vibe Work, and Chat.
Residency. “By default, your data is hosted in the European Union.” You may explicitly use the US API endpoint, in which case data is hosted in the United States.
Subprocessors (Mistral Trust Center, as of 26 June 2026). Cloud infrastructure: Microsoft — Sweden, Norway (Le Chat, La Plateforme, Mistral Code) and Google — Netherlands, United States (Le Chat, La Plateforme US API). Billing: Stripe (United States) and Lago (Ireland) for paid subscriptions. This confirms the EU-by-default route via Microsoft and the US-endpoint route via Google US. Certifications: ISO 27001, ISO 27701, SOC 2 Type II (GDPR is a regulation the policy complies with, not a certificate). Subscribe to Trust Center notifications to track subprocessor changes.
Anthropic (direct API)
Default. No contractual ZDR by default, but retention is already minimal: “Conversation content (your prompts and Claude’s outputs) is not retained by default.” Standard backend deletion happens within 30 days; safety-flagged data is kept longer (documented as up to 2 years for flagged inputs/outputs and up to 7 years for classifier scores). “Retained data is never used for model training without your express permission.” ZDR. Available on approval for the Claude Platform (API) and Claude Code for Enterprise. It applies to the Messages API and Token Counting API, and to Claude Code when used with Commercial organization API keys or via Claude Enterprise.A blanket “United States hosting” statement is not asserted on these pages; they describe a configurable data residency / geographic routing feature instead — confirm the routing for your account.
AWS Bedrock
Default. Bedrock uses a zero data retention security model: “by default, Amazon Bedrock does not store model inputs or outputs”, alongside a zero operator access model (“no operators of the service can access model input or output”). Modes. Thedata_retention_mode setting has four values, not two: default, none, provider_data_share, and inherit (the default for new accounts/projects). none is strict ZDR (nothing written to durable storage, nothing shared); provider_data_share retains and shares inference data with the model provider; the default mode may retain data for safety/abuse purposes.
Locking. Configurable at account or project level via API/CLI (no console UI at launch). Org-wide enforcement is possible via an SCP using the condition key bedrock-mantle:DataRetentionMode. Each Region has one Model Deployment Account per model provider; for AWS-sold models the provider has no access to data.
Who sells the model matters. On Bedrock, models such as Amazon Nova, AI21, and Qwen are sold by AWS — the model provider has no access to the deployment accounts. Anthropic (Claude) models are sold by Anthropic, governed by Anthropic’s Commercial Terms of Service (version 18 August 2025) and its Data Processing Addendum, with the EEA/UK/Switzerland contracting entity being Anthropic Ireland, Limited. Those terms state Anthropic does not train on Customer Content, but when
provider_data_share is used (required for Claude Fable 5 / Mythos 5) inputs and outputs are shared with Anthropic and retained up to 30 days. So the “provider has no data access” guarantee applies to AWS-sold models, not to Anthropic-sold ones.Google Vertex AI / Gemini Enterprise Agent Platform
Default. No ZDR. Published Gemini models cache data in-memory only (not at rest), isolated per project, with a 24-hour TTL, respecting the project’s data-residency selection. Prompts may be logged for abuse monitoring (retained up to 90 days in the customer-selected region/multi-region). Logged data is not used to train or fine-tune models. ZDR. Requires two actions: (1) disable the data cache at project level (PATCH thecacheConfig endpoint with disableCache: true) and (2) opt out of abuse logging (request form, or switch to invoiced billing).
“Zero data retention may not be possible when using some Advanced AI features.” In the current docs this ties to an Advanced AI Safety Addendum for certain higher-risk/dual-use scenarios — clarify with your Google account team. Residency is configurable per project (region pinning).
Azure AI Foundry / Azure OpenAI
Default. No ZDR. A sample of prompts and completions may be selected for human review in a logically separated, per-resource abuse-monitoring store. Reviewers are “authorized Microsoft employees” accessing data via point-wise request-ID queries, Secure Access Workstations (SAWs) and Just-In-Time (JIT) approval. Inputs/outputs are “NOT used to train any generative AI foundation models without your permission or instruction.” ZDR. Obtained via the Modified abuse monitoring program (Limited Access) — no self-service toggle; managed customers apply via a form and approval. Once approved, theContentLogging capability shows as false on the resource (visible in the portal JSON, or via az cognitiveservices account show -n <resource> -g <group>).
Third-party models. For “Models sold by Azure” (which includes Azure OpenAI models), the page states data stays in Microsoft’s Azure environment and these models do not interact with the model providers’ services. Partner / community models offered as Models-as-a-Service are governed by separate terms — verify residency and retention per model there; do not assume the “sold by Azure” guarantees apply.
Cross-cutting pitfalls
ZDR covers stateless inference only
As soon as a feature stores data to function (memory, agents, persistent conversations, Files/batch APIs, fine-tuning), ZDR does not apply. This holds across all providers.
Some models mandate retention
Frontier / “Covered” models can force retention regardless of your setting. Example: Claude Fable 5 and Claude Mythos 5 require 30-day retention — each platform sets its own rule.
ZDR moves the audit log, it doesn't remove it
No retention on the provider side does not remove the need to trace what was sent, by whom, and what came back. That responsibility sits with the customer or the orchestration layer.
Residency depends on region AND route
The same provider can host in the EU, the US or elsewhere depending on region, deployment type and subprocessors. Fix it explicitly per requirement.
Policy is not a contract
Several providers present an opt-out of training as if it were ZDR. For strong requirements, require a signed ZDR arrangement and a SOC 2 Type II or ISO 27001 report auditing the retention policy.
Verify, don't assume
Program names, mode names and retention periods change. Confirm against the official page and your signed terms at the time of deployment.
Reference sources
- OVHcloud AI Endpoints — ovhcloud.com — AI Endpoints
- Mistral privacy policy — legal.mistral.ai — privacy policy · Trust Center
- Anthropic API & data retention — platform.claude.com — API and data retention
- AWS Bedrock data retention — docs.aws.amazon.com — Bedrock data retention
- Google Zero Data Retention — docs.cloud.google.com — Zero Data Retention
- Azure Foundry data privacy — learn.microsoft.com — Foundry data privacy
Last verified against official sources on 26 June 2026. Provider terms change frequently — re-check the linked pages and your contract before relying on any specific figure.