Zero retention and no-training: what enterprise AI data terms actually mean

"No-training" and "zero retention" are two different promises. No-training means the data you send is never used to build or improve a model. Zero retention means the data is not stored at all once the request has been answered — no copies, no logs of the content, nothing kept for later review. A vendor can offer the first without the second, and many do. For enterprise content work you want both, written into the contract, along with clear answers on logs, subprocessors and where the data is processed.

Why the two get confused

Both phrases sound like "your data is safe", and marketing pages tend to use them interchangeably. They protect against different risks. No-training protects against your material shaping a model that other people use — your unreleased product, your campaign line or your customer data surfacing, in some form, somewhere else. Zero retention protects against your material existing on someone else's systems at all, where it can be breached, subpoenaed, reviewed by staff or kept longer than anyone intended.

A provider that promises not to train but keeps every request for a period has solved the first problem and not the second. That may be acceptable for a public social caption. It is rarely acceptable for an unannounced launch.

The questions behind each promise

When a vendor says "we don't train on your data", ask:

• Whose models? The vendor's own, and every third-party model the request passes through? A studio that routes work across many models is only as strong as the weakest set of terms in that chain.
• What counts as data? Uploads, prompts, generated outputs, feedback and ratings. Some terms exclude one of these quietly.
• Is it the default or an opt-out? A promise that depends on someone remembering to tick a box is a setting, not a term.

When a vendor says "zero retention", ask:

• Does it cover abuse monitoring? Some providers keep requests for a limited period to check for misuse unless a separate agreement removes that. Ask whether that agreement is in place.
• What about logs? Operational logs are normal. Logs that contain your prompts and files are retention under another name.
• What does the vendor itself keep? Zero retention at the model provider is meaningless if the platform in front of it stores everything indefinitely. Your own assets should live where you decide, for as long as you decide.

Contracts, not toggles

The most important word in this area is "agreement". A setting in an admin panel can be changed by anyone with access, and a policy page can be updated without notice. A data processing agreement with named subprocessors, stated retention and stated purposes is something legal can read, audit and enforce. If the answer to "where is that written?" is a help-centre article, keep asking.

When terms are not enough

For some material, no contractual promise is sufficient: unreleased products, unannounced partnerships, regulated customer data. The control there is architectural rather than legal — models that run inside your own perimeter, or deployment in a private cloud or on-premise, so the data never reaches a third party in the first place. Data residency belongs in the same conversation: knowing that processing happens in the EU or the US is often a requirement in its own right, not a detail.

A short checklist for procurement

1. Is no-training the default, for uploads and outputs, across every model the vendor uses?
2. Are zero-retention agreements in place with every model provider, and do they cover abuse monitoring?
3. Which subprocessors touch the data, and where are they?
4. What does the vendor's own platform store, and can you delete it?
5. Can confidential work run on private or self-hosted models?
6. Is there a record of which model produced which asset?

Full disclosure: Synthetic White, the studio we build, is set up this way — nothing customers upload trains any model, zero-retention agreements with model providers, confidential work on private or self-hosted models, deployment in cloud, private VPC or on-premise, EU or US data residency, and a per-asset record of which model made what. Ask us the six questions above as well. The answers should be in writing, and they should be the same answers your lawyers would give.