Zero Data Retention

Zero data retention is a setting on an organization. Under it, ai& keeps your prompts, responses and files only in memory, for as long as it takes to answer each request, and writes none of them to storage.

Without it, ai& stores content only where a feature needs it: request bodies while content logging is on, inline PDFs and uploaded files as files, and video jobs with their prompt and video. Each is deleted within 30 days.

It is off until you turn it on. You can turn it on when you set up your account, and after that organization admins turn it on or off in the console under Settings → Organizations. A change applies to every API key and console session of the organization within about a minute.

Where an enterprise agreement requires it, ai& locks the setting, and then only your account team can change it.

What changes

Feature	Under zero data retention
Chat Completions, Responses, Messages	Work as usual. /v1/responses never stores response objects, for any organization.
Inline images	Work as usual. They are passed to the model and not stored.
Inline PDFs	Work, but are rendered in memory instead of being stored as a file. See Inline PDFs.
Request logging	Off, and cannot be switched on. GET /logs/settings reports "data_retention": "zero", and a PATCH that switches it on returns 403.
Files and Uploads APIs	Uploading returns 403. Files stored before the setting was turned on are deleted, as described below.
Video generation	Refused with 403, since a video job stores its prompt and the rendered video.
Models served by an outside provider	Refused with 403, since the provider’s own retention would apply. auto only routes to models ai& serves, and sends your request to no outside provider to classify it.

A refused request returns:

{
  "error": {
    "message": "File upload stores content, so it is unavailable to an organization on zero data retention.",
    "type": "authorization_error",
    "param": null,
    "code": "zero_data_retention"
  }
}

Inline PDFs

A PDF sent inline (file_data on Chat Completions or Responses, or a base64 document block on Messages) is rendered page by page in memory and passed to the model as images. No file is created, and nothing is reused between requests, so a PDF you send again is rendered again.

The limits are tighter than for other organizations, because the pages are held in memory for the life of the request:

• at most 100 pages per PDF;
• at most 16 MiB of PDFs per request;
• at most 10 MiB of rendered page images per request.

When PDFs in earlier messages take a request over either per-request limit, it is refused like one over the model’s context window: 400 with code context_length_exceeded, or prompt is too long on Messages, so an agent can compact its history. When the newest message’s PDFs are over a limit on their own, the request is refused with 400 and code invalid_value.

What is still kept

Zero data retention covers the content of your requests. These are kept because billing and operations depend on them, and none of them hold prompt or response text:

• Request metadata: model, token counts, cost, status and timing for each request, the same rows shown in Request Logs. Kept for 365 days.
• Prompt caching: to price cached input tokens, ai& keeps a one-way hash of each prompt prefix with its token count for 10 minutes. The hash is not the text.
• The model’s working memory: while generating, the model keeps intermediate state for your prompt (its KV cache) in GPU and server memory. It is never written to storage and is evicted within a day.
• Operational logs: request IDs, status codes and timings. They never contain prompts or responses.

Turning it on for an existing organization

Turning it on deletes what the organization has already stored, and turning it off later does not bring it back. The console shows how many files and videos will be deleted before you confirm, and offers stored request logs as a download (GET /logs/export).

• Files are deleted within 15 minutes, and uploads in progress are cancelled.
• Stored request logs and finished videos are deleted within a day. A video still being generated finishes and is deleted within a day of completing.

Content we are required to preserve, such as under a legal hold, is kept until the hold is released. Moderation records of past video requests, which include the prompt, are kept for 30 days as evidence against abuse and then deleted.

Turning it off

Request logging stays off until an admin turns it on again under Settings → Organizations. Nothing deleted while the setting was on comes back.

Note

The setting is read with the rest of your organization’s access, which is cached for up to about a minute. Requests in that minute follow the previous setting: anything they store is deleted as described above, but one sent to a model served by an outside provider has already reached that provider.