Zero data retention promises: what B2B software vendors must be able to prove

What a zero data retention promise actually covers#

A zero data retention promise says that customer inputs and outputs sent to an AI feature are processed and then not stored, by the model provider or by you. It is narrower and stricter than a promise not to train on customer data, which allows storage but forbids using the data to improve models.

Vendors scope these promises in different ways, so read your own wording precisely. Notion, for example, states that its LLM providers use zero data retention by default for Enterprise plan workspaces, while for other plans they retain customer data for 30 days or fewer before deletion. A promise that depends on plan, region or feature needs evidence for each variant.

Write down what your promise covers in plain terms: which features, which data, which providers, what exceptions and from what date. That document is the index for every piece of evidence that follows.

The evidence list: what to keep and where it comes from#

The evidence for a zero data retention promise comes from five main sources, plus the contracts that tie them together. Keep each item dated and owned by a named person, because security reviewers ask when it was last checked as often as what it says.

Where zero-retention promises usually break#

Zero-retention promises usually break inside the vendor's own stack, not at the model provider. Engineers add tracing to debug a slow AI feature, an error tracker captures the request body, or an analytics event records the prompt length and the prompt with it.

Derived data is the second gap. Embeddings, caches and evaluation sets built from production traffic can all hold customer content after the request ends. Notion's AI security page, for instance, gives embeddings their own rule, saying they are removed from its vector databases within 60 days of a page or workspace being deleted, which shows how a retention promise has to name each derived store.

• 1Request and response bodies in application logs or API gateway logs.
• 2Span attributes in distributed tracing and payloads in error tracking tools.
• 3Prompts pasted into support tickets, Slack threads or Jira issues during debugging.
• 4Vector stores, semantic caches and retry queues.
• 5Evaluation and regression datasets sampled from production.
• 6Fallback providers used during outages that sit outside the approved list.
• 7Provider exceptions for abuse monitoring or legal holds that the customer promise does not mention.

Sub-processors and the chain of promises#

Sub-processor commitments are the links in the chain behind your promise, and customers increasingly ask to see each link. GitLab's Duo documentation, for example, states that GitLab does not train generative AI models and that all of its AI model sub-processors are restricted from using model input and output to train models. Atlassian's AI trust page states that its third-party-hosted LLM providers do not use customer inputs and outputs to improve their services.

Statements like these show the pattern customers expect: a public commitment backed by contract terms with each sub-processor. Keep the contract excerpt next to each entry on your sub-processor list, and follow the notice process in your DPA before adding a new AI provider.

An independent audit report supports the chain but does not replace it. SOC 2 examinations use the AICPA Trust Services Criteria, and a Type 2 report tests whether controls operated effectively over a period. Whether that covers your AI retention controls depends on the report's scope, so check the system description before relying on it.

Changing the promise later#

Changing an AI data promise later is where vendors take the most reputational and legal risk. FTC staff took up the point in a post dated February 13, 2024, cautioning that loosening data practices, for instance to begin training AI on consumers' data, and disclosing the change only by slipping it retroactively into a terms of service or privacy policy update could amount to an unfair or deceptive practice. The post addresses consumer data, but business customers apply the same test in security reviews and renewals, and contract law may apply to any change to negotiated terms.

Customers also read the fine print. TechCrunch reported in May 2024 that Slack drew backlash when its privacy principles were found to allow customer data to train its machine-learning models unless an organization opted out, and Slack responded that it does not train its generative AI models on customer data. Version your AI terms, give notice before changes and keep a record of which customers accepted which version.

Illustrative: a security review finds prompts in a trace#

Illustrative: a fictional SaaS company sells work order software to commercial property maintenance teams and has added an AI feature that summarizes technician notes. Its contract template promises zero data retention for that feature. An enterprise prospect's security team asks for evidence.

Assembling the evidence, the platform team finds that a tracing library records the full prompt as a span attribute, retained under the observability vendor's default settings. They remove the attribute, purge stored traces, add a test that fails the build if prompt fields appear in telemetry and record the fix in a change ticket.

The final evidence pack contains the provider's zero-retention approval, a console export, the tracing configuration, the sub-processor list with contract excerpts and the current SOC 2 report. The prospect accepts it, and the team adds the telemetry test to its release checklist.

Can a vendor with a no-training promise still license data?#

A vendor with a zero-retention or no-training promise can often still license records it owns, such as source code, code reviews, Jira issues and internal engineering discussions, because those promises cover customer data, not the vendor's own work. Customer content stays excluded unless the contract clearly permits otherwise.

In the SourceX five-step transaction (Supply, Rights, Preparation, Approval, Delivery), zero-retention and no-training commitments are read during Rights as limits on scope, and Preparation strips personal and confidential details from what remains. The vendor's SourceX Evidence Packet then documents provenance, licensing rights, permitted use, the privacy record and release authorization, which lets the vendor answer a customer's question about its data with a document rather than an assurance.