I review AI tools and pricing pages for a living, and this is the question I get asked most by developers building on Websites2Know’s recommended stacks: “we have ZDR turned on, so we’re covered, right?”

No. Not for the agent parts. That’s the uncomfortable answer nobody selling you an “AI agent platform” wants to lead with.

I spent this week going endpoint by endpoint through the current documentation for Anthropic’s Claude API, OpenAI’s platform, Google Cloud’s Gemini Enterprise Agent Platform, and Amazon Bedrock AgentCore. Not aggregator posts, not sales one-pagers — the actual data-retention pages each vendor publishes and updates. What follows is my own read of that documentation, plus my honest opinion on which vendor is being the most straightforward about it.

Why “Zero Data Retention” Doesn’t Mean What Most Buyers Assume

Zero data retention is a promise about a specific pipe, not about a product name.

Anthropic’s own documentation puts it plainly: under a ZDR arrangement, the company “does not store customer prompts or responses at rest after the API response is returned.” That’s a statement about the inference call. It says nothing about the session store, the file store, or the container your agent’s code just ran inside.

Agents, almost by definition, need state. They need to remember what tool they called five steps ago, hold a file you uploaded, or resume a long-running task tomorrow. That statefulness is exactly what ZDR is built to exclude. So the more “agentic” a feature is, the less likely it is to be covered — even when the underlying model is running under a ZDR-enabled organization.

This is not a knock on any single vendor. It’s structural. If I were spec’ing out an agent stack for a client project this month, I’d budget time to map every stateful resource the workflow touches — because the provider’s marketing page will not do that mapping for me.

The Full Comparison: Agent Features Outside ZDR by Provider

Here’s the matrix I built while reading through each provider’s current docs, dated September 9, 2026. “Excluded” means the feature’s own documentation states it is not ZDR-eligible, or that it stores data by design regardless of your ZDR setting.

Table compiled from Anthropic’s API and data retention documentation, OpenAI’s data controls guide, Google Cloud’s Gemini Enterprise Agent Platform ZDR page, and AWS Bedrock AgentCore developer guide, all read September 9, 2026. This is not a legal opinion — check your own contract terms before relying on any of it.

Anthropic Claude: Where the Line Actually Sits

Anthropic is, in my opinion, the most transparent of the four about drawing this line — I’ve covered Claude’s API pricing structure before and their compliance docs get updated with the same discipline.

The plain Messages API, adaptive thinking, prompt caching, structured outputs, and the client-side tools (bash, text editor, computer use) are all listed as ZDR-eligible, assuming you’re not on a Covered Model. That’s the good news.

The bad news starts the moment you touch anything with the word “agent” in it. Claude Managed Agents — the actual hosted agent product, covering /v1/agents, /v1/sessions, and /v1/environments — is marked “No” for ZDR across the board, including its self-hosted sandbox sub-feature. Anthropic’s own wording is blunt: session transcripts persist until you delete them, full stop.

Batch processing carries a hard 29-day retention window. Code execution and programmatic tool calling — which run on the same container infrastructure — can hold data for up to 30 days. The Files API keeps whatever you upload until you explicitly delete it or it hits its configured expiry. None of that is a bug; it’s just what those features need to function.

The Covered Models Wrinkle

This is the detail I think most buyers miss. Claude Fable 5.1, Mythos 5.1, Fable 5, and Mythos 5 are designated “Covered Models” and require 30-day data retention no matter what your organization’s ZDR arrangement says, unless Anthropic expressly authorizes an exception. Try to call one of these from a strict ZDR workspace and you get a flat rejection, not a silent downgrade:

There’s a workable escape hatch worth knowing about: you can flip 30-day retention on for a single workspace and leave the rest of your organization on zero retention. That’s a genuinely sensible piece of design — it means one team running a Fable 5.1 pilot doesn’t force a retention exception on your whole company. If you’re already deep into comparing Fable 5 against GPT-5.5 for a project, this is the kind of detail that belongs in that evaluation, not an afterthought.

Claude Code is a separate case again. ZDR applies when you’re using API keys from a Commercial organization, or through Claude Enterprise with ZDR turned on — but if you’ve enabled metrics logging, your usage statistics are carved out of that protection regardless. Claude Console usage, Claude Teams and Enterprise product interfaces, and Claude for Excel are all outside ZDR entirely, no exceptions listed.

OpenAI: A Longer List of Exclusions, Framed Differently

OpenAI structures ZDR around two controls — Zero Data Retention and Modified Abuse Monitoring — and neither one is self-serve. Both require prior approval and a signed agreement with OpenAI’s sales team, which is already a meaningfully different posture from Anthropic’s more console-driven setup.

Once approved, ZDR on /v1/responses and /v1/chat/completions forces the store parameter to false permanently, even if your code tries to set it to true. That’s a genuinely useful hard guarantee — I like that it’s enforced server-side rather than trusted to the developer.

But the endpoint table tells a stricter story than the headline. /v1/conversations, /v1/assistants, /v1/threads, and /v1/vector_stores are all marked “No” for ZDR eligibility, with application state kept until you delete it. If your agent uses OpenAI’s own conversation-state primitives to remember context across a session — which is the entire point of those endpoints — you are, by definition, outside the ZDR boundary for that piece.

Background Mode’s Ten-Minute Window

This is the one detail that genuinely surprised me while reading the docs. Background mode — used for long-running agent tasks that poll for a result — is permitted from ZDR-enabled projects, but only with store=false, and even then OpenAI keeps the response on disk for roughly ten minutes to make polling work. It’s a small, honest exception, and I’d rather a vendor disclose that ten-minute window than pretend background jobs are instantaneous and stateless.

Files, batches, fine-tuning jobs, and evals all sit outside ZDR too, each retained until you delete them. Remote MCP servers are called out explicitly as third-party services — data sent to an MCP server follows that server’s own retention policy, not OpenAI’s, which is a distinction easy to miss if you’re skimming a sales deck instead of the actual guide. And Codex cloud, OpenAI’s hosted coding agent, simply doesn’t have a documented ZDR eligibility answer as of this write-up. That’s not a red flag by itself, but it is a question worth putting directly to your account rep before you route anything sensitive through it.

Google Cloud: Grounding Logs You Can’t Turn Off

Google’s Gemini Enterprise Agent Platform documentation is refreshingly direct about one thing most vendors bury: plain model inference is conditionally ZDR-eligible depending on configuration and model, but grounding tools are a separate story entirely.

If you use search grounding, Google keeps derived query and context logs for up to three days to support debugging — and the documentation states outright that this logging cannot be disabled. Maps grounding is worse for retention purposes: prompts, context, and output are kept for a full 30 days. If your agent’s value proposition depends on grounding answers in live search or maps data, you should assume those specific calls sit outside a zero-retention promise no matter what your organization-level ZDR contract says.

Live session resumption is another one to watch — cached inputs and outputs are held for up to 24 hours to allow a session to resume, and you have to explicitly disable resumption if you want the ZDR path.

Managed Agents Is Still a Preview, and It Shows

Google’s Managed Agents API on Agent Platform is a Pre-GA offering, and the developer guide says so in language that leaves no ambiguity: “do not use proprietary, sensitive, or other confidential data with these products,” and “you may not use them for commercial or production purposes.” That’s not a retention nuance — that’s a usage restriction sitting one layer above the retention question. If you’re weighing Gemini for a client build, this belongs in the same conversation as my Gemini Code Assist Standard vs Enterprise comparison, because the tier and the product maturity both matter here, not just the model.

On the Gemini Developer API side, stored interactions default to a 55-day retention window, configurable down to 7, 14, or 28 days — but not to zero unless you use the separate stateless interactions mode with store=false. Files on that API expire automatically after 48 hours.

AWS Bedrock AgentCore: Memory Is the Whole Product

AgentCore is a slightly different animal from the other three. Amazon markets it around persistent memory as a feature, not a compromise — “AgentCore Memory addresses a fundamental challenge in agentic AI: statelessness,” is how AWS’s own developer guide frames it. That’s honest, but it also means the entire product is built around the thing ZDR excludes.

Short-term memory events can be retained for up to 365 days depending on how you configure the memory store. Data is encrypted at rest with AWS KMS keys, which is good security hygiene, but encryption at rest is not the same thing as non-retention — a distinction I think gets flattened a lot in vendor comparisons.

The detail I’d flag hardest for anyone doing compliance work: deleting a short-term memory event through the DeleteEvent operation does not remove the long-term memory AgentCore may have already derived from it. That’s a separate resource with its own DeleteMemoryRecord API call. If your deletion workflow only calls one of those two operations, you have not actually deleted the memory — you’ve deleted half of it. That’s exactly the kind of gap that looks fine in a demo and fails an actual data-subject-access-request review.

At a Glance: Excluded Agent Features by Provider

This is an illustrative count, not a scorecard — providers group features differently, so a lower number doesn’t automatically mean “better.” It reflects how many major agent-relevant features from this article’s review sit outside ZDR for each vendor.

How to Audit Your Own Agent Stack for ZDR Gaps

If you’re responsible for a real deployment rather than a demo, here’s the process I’d actually run through, in order.

My Take: Who Handles This Honestly, and Who’s Hiding Behind the Term

I’ll say the opinionated part plainly, since I’ve read all four vendors’ actual documentation this week rather than their sales pages.

Anthropic’s docs are the clearest about the boundary. They name the exceptions, give you the actual error text you’ll hit, and — notably — let you carve out a single workspace for Covered Models instead of forcing an all-or-nothing retention decision on your whole org. That workspace-level control is a genuinely developer-friendly design choice I don’t see matched elsewhere.

OpenAI’s underlying controls are solid — the hard store=false enforcement under ZDR is a real technical guarantee, not just a policy statement. My complaint is discoverability: the eligibility answers are scattered across an endpoint table, several per-endpoint footnotes, and a separate HIPAA guidance page. You have to assemble the picture yourself.

Google gets credit for one thing most vendors won’t say out loud: that its Managed Agents product simply isn’t ready for confidential or production data, full stop, no asterisks. I’d rather have that blunt warning than a vague “beta” label. But the fact that search grounding logs can’t be disabled at all, even under otherwise ZDR-configured inference, is the kind of detail that belongs on page one of the pitch, not buried in a resources page.

AWS AgentCore isn’t trying to sell you zero retention in the first place — it’s selling persistent memory as the product. That’s actually the most honest framing of the four, even though it means AgentCore has the least ZDR coverage on paper. If you need an agent that genuinely forgets nothing was ever the plan, don’t fault AWS for that; fault your own procurement checklist if it assumed otherwise.

If you’re doing broader AI tool vetting beyond just retention policy, it’s worth pairing this with a look at how each provider’s models actually perform — I’ve broken down Claude’s hallucination rate against ChatGPT’s separately, since accuracy and data handling are two different risk categories that get conflated far too often.

FAQ

Does ZDR cover the whole platform once it’s enabled for my organization?

No. Every major provider publishes a feature-by-feature eligibility table because ZDR applies per endpoint, not per organization. Enabling it turns on the arrangement for the features that qualify; stateful features like managed agents, files, and batch jobs remain outside it regardless.

Is Claude Managed Agents ever eligible for zero data retention?

No, not currently. Anthropic’s documentation lists Managed Agents sessions, including the self-hosted sandbox sub-feature, as excluded from ZDR because session transcripts are stateful and persist until you delete them.

Can I use OpenAI’s background mode under a ZDR arrangement?

Yes, with store=false, though OpenAI temporarily stores the response for roughly ten minutes to support polling before it’s deleted. That’s a documented exception, not a full stateless guarantee.

Does deleting an AWS AgentCore event remove everything the agent learned from it?

No. Deleting a short-term memory event through the DeleteEvent operation doesn’t remove any long-term memory AgentCore derived from that event. You need a separate DeleteMemoryRecord call to remove the derived record.

Is Google’s search grounding covered under Gemini’s zero data retention setup?

No. Google’s documentation states that search grounding logs derived query and context data for up to three days and that this logging cannot be disabled, even when the surrounding model inference is otherwise ZDR-configured.

Conclusion

Zero data retention was never designed to cover agents. It was designed to cover a stateless inference call, and every provider’s own documentation says as much once you read past the marketing headline.

If you’re building or buying an agent product this quarter, don’t ask “is this ZDR?” Ask which specific endpoints your workflow calls, then check each one against the provider’s current eligibility table — because that table changes as products move out of preview and models get replaced. I’ll be revisiting this comparison as Anthropic, OpenAI, Google, and AWS keep shipping new agent features, since this is exactly the kind of page that goes stale within a few months.

For now, treat any feature that remembers, stores a file, or runs in the background as outside zero data retention until the provider’s own docs say otherwise in writing. That single habit will save you a very uncomfortable compliance conversation later. If you’re weighing broader stack decisions around AI agent frameworks and internal tooling policy, my guide to picking an agent framework for simple workflows and my breakdown of GitHub Copilot’s token and credits policy changes both cover adjacent ground worth reading alongside this one — and if you’re building content around any of this for search visibility, see my notes on SEO strategy for AI tool pages and how retrieval differs from citation in how AI systems ground their answers.