# Zero Data Retention

Source: https://aiand-docs-staging.pages.dev/organizations/zero-data-retention/

Zero data retention is a setting on an organization. Under it, ai& keeps your prompts, responses and files only in memory, for as long as it takes to answer each request, and writes none of them to storage.

Without it, ai& stores content only where a feature needs it: request bodies while [content logging](/analytics/logs/#content-logging) is on, inline PDFs and uploaded files as [files](/api/file-lifecycle/), and video jobs with their prompt and video. Each is deleted within 30 days.

It is off until you turn it on. You can turn it on when you set up your account, and after that organization admins turn it on or off in the [console](https://console.aiand.com/settings/organizations) under **Settings → Organizations**. A change applies to every API key and console session of the organization within about a minute.

Where an enterprise agreement requires it, ai& locks the setting, and then only your account team can change it.

## What changes

| Feature | Under zero data retention |
| --- | --- |
| Chat Completions, Responses, Messages | Work as usual. `/v1/responses` never stores response objects, for any organization. |
| Inline images | Work as usual. They are passed to the model and not stored. |
| Inline PDFs | Work, but are rendered in memory instead of being stored as a file. See [Inline PDFs](#inline-pdfs). |
| Request logging | Off, and cannot be switched on. `GET /logs/settings` reports `"data_retention": "zero"`, and a `PATCH` that switches it on returns `403`. |
| Files and Uploads APIs | Uploading returns `403`. Files stored before the setting was turned on are deleted, as described [below](#turning-it-on-for-an-existing-organization). |
| Video generation | Refused with `403`, since a video job stores its prompt and the rendered video. |
| Models served by an outside provider | Refused with `403`, since the provider's own retention would apply. [`auto`](/models/auto/) only routes to models ai& serves, and sends your request to no outside provider to classify it. |

A refused request returns:

```json
{
  "error": {
    "message": "File upload stores content, so it is unavailable to an organization on zero data retention.",
    "type": "authorization_error",
    "param": null,
    "code": "zero_data_retention"
  }
}
```

## Inline PDFs

A PDF sent inline (`file_data` on Chat Completions or Responses, or a `base64` `document` block on Messages) is rendered page by page in memory and passed to the model as images. No file is created, and nothing is reused between requests, so a PDF you send again is rendered again.

The limits are tighter than for other organizations, because the pages are held in memory for the life of the request:

- at most 100 pages per PDF;
- at most 16 MiB of PDFs per request;
- at most 10 MiB of rendered page images per request.

When PDFs in earlier messages take a request over either per-request limit, it is refused like one over the model's context window: `400` with code `context_length_exceeded`, or `prompt is too long` on Messages, so an agent can compact its history. When the newest message's PDFs are over a limit on their own, the request is refused with `400` and code `invalid_value`.

## What is still kept

Zero data retention covers the content of your requests. These are kept because billing and operations depend on them, and none of them hold prompt or response text:

- **Request metadata**: model, token counts, cost, status and timing for each request, the same rows shown in [Request Logs](/analytics/logs/). Kept for 365 days.
- **Prompt caching**: to price cached input tokens, ai& keeps a one-way hash of each prompt prefix with its token count for 10 minutes. The hash is not the text.
- **The model's working memory**: while generating, the model keeps intermediate state for your prompt (its KV cache) in GPU and server memory. It is never written to storage and is evicted within a day.
- **Operational logs**: request IDs, status codes and timings. They never contain prompts or responses.

## Turning it on for an existing organization

Turning it on deletes what the organization has already stored, and turning it off later does not bring it back. The console shows how many files and videos will be deleted before you confirm, and offers stored request logs as a download ([`GET /logs/export`](/analytics/logs/#export-stored-content)).

- Files are deleted within 15 minutes, and uploads in progress are cancelled.
- Stored request logs and finished videos are deleted within a day. A video still being generated finishes and is deleted within a day of completing.

Content we are required to preserve, such as under a legal hold, is kept until the hold is released. Moderation records of past video requests, which include the prompt, are kept for 30 days as evidence against abuse and then deleted.

## Turning it off

Request logging stays off until an admin turns it on again under **Settings → Organizations**. Nothing deleted while the setting was on comes back.

<Aside type="note">
  The setting is read with the rest of your organization's access, which is cached for up to about a minute. Requests in that minute follow the previous setting: anything they store is deleted as described above, but one sent to a model served by an outside provider has already reached that provider.
</Aside>