Definition
Zero data retention is a vendor configuration in which a service processes audio or text to return a result and does not store the inputs or outputs afterward. It has no legal definition, so its exact scope depends on the vendor's contract and settings.
What it covers
Zero data retention, often shortened to ZDR, is a product setting rather than a legal category. No statute or regulator defines it. A vendor that offers it commits, in its terms or settings, not to keep the data a request carries once the response has been returned. For a speech service that means the audio, the transcript or both. For an LLM service it means the prompt and the output.
The phrase hides several choices, and two vendors can use it for different things. Does it cover audio only, or text as well? Does it apply to every endpoint or to some? Are metadata such as timestamps, durations or request identifiers kept? What about error traces, caches, abuse monitoring and backups? A setting that covers one of these and not the others is still called zero retention by some vendors, so the contract is the source of truth.
What it requires
Nothing in law requires it and nothing in law grants it a status. It is a way to meet obligations that do exist, such as the storage limitation principle in GDPR Article 5(1)(e), which says personal data should be kept in identifiable form no longer than necessary. Keeping nothing makes that easier to show for that vendor’s step. It does not give you a lawful basis to process the data in the first place, and it does not remove other duties.
It also does not settle whether a vendor is a business associate under HIPAA. HHS’s cloud computing guidance treats a cloud provider that maintains electronic PHI as a business associate even if it cannot view the data, and describes the conduit exception as limited to transmission services that store information only temporarily. Whether a processing service that keeps nothing falls inside or outside that line is a question for counsel. See HIPAA and GDPR.
What it means for a voice agent
Zero retention at one vendor is one link in a chain. A voice agent call can touch a telephony carrier, a speech recognition service, an LLM, a speech synthesis service, your own platform and your analytics. If one provider keeps nothing, the others may still keep audio, transcripts and logs, and so may you.
It also trades away things you may want. With no stored audio or transcripts, debugging a bad call, quality review, dispute resolution and training data are harder, and some rules may require you to keep a record elsewhere. See data retention for how to set periods by kind of data, and call recording consent for when recording is allowed at all.
A SOC 2 report can show how a vendor controls access to the data it holds, but it is not proof that nothing is held. Ask for the retention terms in writing. The guide on on-premise voice AI covers deployment choices that keep data inside your own infrastructure.
Questions to ask counsel
- What exactly does this vendor not store, and which endpoints, plans or regions does that cover?
- Which metadata, logs, caches and backups remain, and for how long?
- How is the setting enabled and verified, per account or per request?
- Does a vendor that keeps nothing still need a business associate agreement or a data processing agreement?
- Which records must we keep ourselves, given sector rules and possible disputes?
Related terms
Guides
Sources
- HHS Office for Civil Rights, Guidance on HIPAA and cloud computing (context on stored and transient data)
- Regulation (EU) 2016/679 (GDPR), Article 5(1)(e), storage limitation (context, not a definition of the term)
This page is general information, not legal advice. Rules differ by country, state and use case, and they change. Check the linked sources and ask qualified counsel before you rely on it.
Last reviewed October 19, 2026