Zero Data Retention stops at OpenAI's edge. Your logs are still your problem

The word doing the work in "we do not store it" is "we" ^[8]. A single AI feature can leave a copy of the same user text in an error log, in a tool call forwarded onward, in the row you write with the result, and in the analytics event that fired when the button was pressed ^[9]. Every one of those copies is inside your trust boundary, and none of them are covered by anything OpenAI signs.

The provider's own documentation makes the boundary explicit rather than hiding it. Only some API features are eligible for Zero Data Retention; others hold application state until you delete it, or carry storage behaviour specific to that feature ^[5]. Data sent onward to remote MCP servers or other third-party services is governed by those services' retention policies, not OpenAI's ^[6]. Standard abuse monitoring may hold customer content for up to 30 days unless an approved ZDR or Modified Abuse Monitoring control changes that handling ^[4]. So the honest reading of a ZDR badge is narrow: for approved customers ^[7], on eligible endpoints, the model provider's copy goes away. Yours does not.

That matters more because of how AI features get built. The prompt gets whatever data is close at hand, because more context feels like insurance ^[21]. It is not; it is just easier to write ^[22]. The dev.to author's rule is the one worth stealing: the model should not receive a field merely because your database already has it ^[16]. The test is cheap. Remove one field from a test request at a time, and if the answer is still useful, that field never earned the trip ^[18]. An invoice-description helper does not need the customer's full name, email, payment history, tax details and every prior invoice to produce a clearer line item ^[17].

OWASP puts sensitive-information disclosure among the major risks in LLM applications and points at sanitisation, validation, least-privilege access, restricted data sources, retention policies and tokenisation or redaction ^[19]. It also warns that instructions in the prompt are not a reliable way to stop disclosure ^[20], which disposes of the popular fix of appending "do not reveal PII" and calling it a control.

There is a second, quieter retention surface opening up. Private Safety Processing is designed to spot misuse across a series of related interactions while keeping prompts and responses away from OpenAI staff ^[1], returning only a narrow signal describing the type and severity of the activity ^[2]. Aleah Houze, OpenAI's head of product policy, told Axios that risk in capable models can appear across multiple interactions rather than in one prompt-response pair, giving the example of separately unremarkable questions about software weaknesses, remote access and security tooling ^[3]. A signal is still an artefact. The public materials do not specify the cryptographic design, the signal taxonomy, false-positive rates or customer controls ^[10], and letsdatascience.com notes that the promised white paper is what would show whether abuse detection has been bought without creating a new retained telemetry surface ^[11]. September is when that arrives ^[12].

Meanwhile the contrast with Anthropic is the part procurement will actually price. Axios reports Anthropic requires 30-day retention for business customers on Fable 5 and Mythos 5, and characterises that retention as necessary for security work ^[13]; The Register reports it can hold inputs and outputs longer when it detects policy violations ^[14]. Choosing OpenAI's zero on that basis buys you exactly one leg of the journey. Write down, before you code, the minimum data allowed across the boundary, every place a copy can come to rest, and the evidence that each copy expires ^[15]. That inventory is the deliverable. The toggle is a line item in it.