Syntheses
How Vercel AI Gateway zero data retention protects data
AI Gateway combines content deletion with provider routing agreements; model exceptions, caching, metadata and application storage limit the ZDR promise.
Summary answer
ai-gateway sits between an application and its model providers. Vercel says the gateway permanently deletes prompts and responses after requests complete, by default. Provider retention requires a separate routing control. Security documentation
The security benefit is less retained sensitive content available for later exposure. The model still processes the information to answer; retention controls do not make it blind to the prompt.
How enforcement works
Vercel negotiates ZDR agreements with providers. Enabling ZDR limits routing to those covered providers and includes a prohibition on prompt training. Team-wide enforcement centralizes the policy so individual callers cannot weaken it. Response metadata describes the routing decisions. Vercel explanation, published 2026-04-08
The filter includes fallback providers, excludes unknown ZDR status, and returns an error if no eligible provider exists. However, provider policies can exclude particular models or functions, and Vercel warns those requests are not automatically rejected. Prompt-cache compliance is provider-dependent. ZDR documentation
Scope and limits
- Operational records remain: request logs include model, provider, usage, cost, timing and routing details. ZDR does not mean all activity records disappear. Request logs
- BYOK needs its own agreement: keys are skipped unless marked ZDR; the customer is responsible for that designation. BYOK rules
- Application storage is separate: as an architectural implication, a database, application log or external tool can retain its own copy. Gateway deletion cannot remove those copies.
- Routing evidence has limits: an audit trail can show which provider was selected; it is not independent proof of deletion inside that provider.
Configuration
Enable Zero Data Retention in AI Gateway dashboard settings, or set providerOptions.gateway.zeroDataRetention: true for an individual call. Feature announcement
Current documentation lists Pro and Enterprise availability. Check the exact model, feature and cache policy before relying on ZDR for sensitive content. Current ZDR documentation
Evidence and remaining gaps
The existing ai-gateway hub supplied the product context. The older team-wide-zero-data-retention-and-prompt-training-controls-n capture is incomplete and flagged for review. Current first-party documentation fills the policy gap.
Confidence is high in the documented behavior. This review did not inspect the team's live configuration, private provider agreements or provider deletion systems. The frontmatter publication date follows Vercel's explanatory blog; verification and review dates reflect this later documentation review.