AI Gateway Puts Data Retention Policies on Autopilot

Teams building on multiple AI models face a compliance headache: every provider has its own terms of service, its own data-handling defaults, and its own opt-out mechanisms. Zero Data Retention (ZDR) is rarely the default, which means developers have to remember to configure the right flags on every request — an error-prone process that slows down shipping.

Vercel's AI Gateway offloads that burden by handling provider negotiation and enforcement at the infrastructure layer. Instead of tracking policies provider by provider, you route through the gateway, which only forwards requests to providers that have ZDR agreements in place. OpenAI, Anthropic, Google, and other major model providers are all covered. The new team-wide ZDR setting extends this from a developer convenience to an organizational control.

Three Layer-Cake Controls

The expanded compliance toolbox gives teams three separate levers to pull, depending on how their data flows:

  • Team-wide ZDR — A single toggle in the AI Gateway Dashboard Settings applies ZDR to every request the team makes, with no code changes needed. Available for Pro and Enterprise teams, this is the setting for organizations that want to guarantee no individual developer can accidentally weaken the policy.
  • Per-request ZDR — For apps where only certain workflows touch sensitive or proprietary information, request-level ZDR lets you enforce data deletion on specific calls. Enable it through provider options in any API format the gateway supports. A request is treated as ZDR-protected if either the team-wide or per-request flag is on.
  • Disallow Prompt Training — This request-level filter stops providers from using your prompts to train their models. It's a sensible safeguard for teams sending proprietary code or internal documents through LLMs. Note that ZDR is a superset: enabling ZDR automatically covers training opt-out.

Audit Trail Built In

Enforcement without visibility is a governance fiction. Each response from the gateway carries metadata indicating which providers were considered and which were filtered out by your policies. That gives teams an audit trail showing exactly how data handling rules were applied on every request.

All three controls work uniformly across the tools you already use: the AI SDK, the Chat Completions API, the Responses API, the Anthropic Messages API, and the OpenResponses API.

Moving these checks out of application code and into the gateway turns compliance into infrastructure. That's a meaningful shift for teams that would rather not re-implement the same policy logic in every route. Pricing details and the full list of ZDR-capable models are available in the Zero Data Retention documentation.