What ZDR does not cover

ZDR protects what remains. Not what runs.

Zero Data Retention is valuable: it limits logs, storage, and secondary use after processing. It is not a complete security boundary because conventional inference still receives usable plaintext.

Follow one request through product, runtime, state, safety, and tool boundaries. Then run the cryptographic controls that cover those stages.

PRIMARY-SOURCE REVIEW · 22 AUG 2026

How five providers handle one agent request.

Flow view shows how account and product choices change one request. Matrix view audits eight boundaries against the same provider documentation.

Use the flow for context and the matrix for sources.

Color shows the control state. Ribbon width separates outcomes, not traffic volume.

APPROVED ZDR

OpenAI API

See where retention terms change across one request.

Read the map Controlled Conditional Retained or exception Plaintext processing Select a node for the documented control and sources.

01Input and output are not the whole story.

Safety review, caches, stateful APIs, grounding, files, vector stores, and external tools create separate retention boundaries.

02The strongest controls are enforceable.

AWS can deny incompatible models through IAM. Azure exposes its content-logging state. OpenAI and Anthropic expose organization-level eligibility.

03ZDR is not a data-use boundary.

It governs eligible retention paths. It does not by itself protect assembled context, tool payloads, memory, or inference data while systems use them.

WHAT CHANGED IN THE CURRENT DOCUMENTATION

Frontier-model ZDR is splitting into two designs.

OpenAI is previewing private safety processing intended to preserve ZDR across related interactions. Anthropic requires retention for designated Covered Models. The model-level architecture now matters as much as the account label.

OPENAI Detect cross-interaction risk without giving personnel the underlying content.

Private Safety Processing is an early-customer preview for frontier-model ZDR. Content remains on customer-controlled infrastructure, or in a planned OpenAI store encrypted with customer-controlled keys. Automated systems return narrow safety signals. Rollout and a technical white paper are planned for September 2026.

Read OpenAI's frontier-model ZDR announcement

ANTHROPIC Model choice can override an otherwise ZDR workspace.

Eligible ZDR products remain organization-scoped, but designated Covered Models require 30-day prompt and output retention. Anthropic directs customers to use a retention-enabled workspace or separate cloud scope for those models.

Read Anthropic's Covered Model policy

REAL EXECUTION PROOF

Test all eight boundaries in one run.

One agent task runs context binding, retrieval protection, encrypted inference, tool binding, memory protection, telemetry controls, sealed evaluation, and local output release.

01

REQUEST CONTEXTBind the assembled context
The SDK seals private instructions and actor context to this run before any downstream operation.

READYWaiting for run
02

KNOWLEDGEEncrypt vector context
The Mirror SDK creates an authenticated vector envelope and releases it with the customer-held key.

READYWaiting for request context
03

INFERENCECompute on ciphertext
A real mirror/glm-5.3-flash request must report encrypted ingress, ciphertext compute, and encrypted egress.

READYWaiting for prior evidence
04

TOOL EXCHANGEBind the tool invocation
The private tool payload is sealed to the run and call identity while the evidence event contains only its artifact reference.

READYWaiting for inference evidence
05

AGENT STATESeal state to this run
The SDK seals a private state record to the run and rejects it when the session binding changes.

READYWaiting for tool evidence
06

LOGS AND TRACESSuppress sensitive content capture
The SDK runs a sensitive encrypted operation under a forced no-content telemetry policy, even when full capture is requested.

READYWaiting for sealed state
07

ASSURANCEBind private evaluation
A sealed case consumes the state artifact reference and must fail under a changed evaluation binding.

READYWaiting for telemetry evidence
08

OUTPUT RELEASERelease only at the customer boundary
The final stage requires encrypted egress and successful local decryption from the same live inference run.

READYWaiting for evaluation evidence

READYNo lifecycle claim before execution.

Each stage consumes evidence from the run. A missing stage stops the chain and no passing fingerprint is issued.

run fingerprint: pending

WHAT ZDR DOES NOT COVER

ZDR controls retention. It does not cover the full agent lifecycle.

ZDR can limit what eligible provider services retain after processing. It does not automatically govern assembled context, retrieval stores, tool payloads, checkpoints, traces, evaluation datasets, or what remote systems see while processing.

01 · BEFORE A REMOTE CALLContext and knowledge

Bind private instructions and actor context to the run. Encrypt retrieved knowledge at the customer boundary before it enters the next operation.

02 · DURING EXECUTIONInference and tool exchange

Use Fully Homomorphic Encryption for supported inference. Seal tool payloads to their call and run identity. Return model output through encrypted egress.

03 · BETWEEN AND AFTER TURNSMemory, telemetry, evaluation, and output

Bind memory to its session, suppress sensitive telemetry content, seal private evaluation cases, and release the agreed output only at the customer boundary.

ZDR asksWhat may each eligible service retain?

Use it to minimize residual plaintext under documented product controls.

Mirror asksWho can see data at every stage?

Apply cryptographic controls while agents assemble context, run tools, store state, and evaluate results.

COMBINED CONTROLUse ZDR to limit retention and cryptography to limit exposure.

Provider ZDR covers eligible residual data. The receipt above tests eight Mirror boundaries during one live agent run.

Browse all research