What Zero Data Retention Actually Means

Zero data retention normally means the vendor does not store your inputs and outputs after the request completes. It does not mean your text was never transmitted, never processed on someone else’s hardware, never held in memory, never logged for abuse detection, and never seen by a subprocessor.

All of those can be true simultaneously with a truthful zero retention claim. That is not necessarily dishonest. It is just a narrower promise than most people hear.

The Claims and What They Cover

“We do not train on your data.” This is about model improvement only. Your text is still transmitted, still processed on vendor infrastructure, and may still be retained for a period. It is a good policy and it answers one specific worry.

“Zero data retention.” Inputs and outputs are not persisted after processing. Ask three follow-ups: does this apply to all tiers or only enterprise, does it cover abuse-detection logs, and what is the retention period for those logs. Many implementations retain content for 30 days for safety review even under a zero retention headline.

“Encrypted in transit and at rest.” Table stakes, and largely irrelevant to the question people are actually asking. It protects against interception and stolen disks. It does nothing about the vendor’s own access, since they hold the keys.

“SOC 2 Type II certified.” An audit that the organization follows its own stated controls consistently. It says nothing about what those controls permit. A company can be rigorously SOC 2 compliant while retaining everything you send, as long as it says so.

“Enterprise grade security.” Not a defined term. Ignore it and read the data processing addendum instead.

Five Questions That Get Straight Answers

Send these to the vendor in writing. Vague answers are answers.

Where is my text processed, in which countries and regions? This drives GDPR transfer analysis and many public sector requirements.

Which subprocessors receive it? Most AI products sit on top of another provider’s model API. Your data reaches at least two companies, sometimes four.

What is retained, for how long, and under what legal basis? Ask separately about content, metadata, and logs. They frequently have different retention periods.

Can retention be disabled, and on which plan? The answer is often that it can, on a tier above the one you are on.

What happens on a legal request? A vendor holding your text can be compelled to produce it. A vendor that never received it cannot.

The Structural Point

Every one of these questions exists because the text left your machine. Retention policy, subprocessor lists, transfer mechanisms, and audit certifications are all mitigations for a risk created at the moment of transmission.

If the text never leaves the device, most of the questions dissolve. There is no retention period because nothing was received. No subprocessor list, because there is no processing chain. No transfer mechanism required, because there was no transfer. No legal request risk at the vendor, because they hold nothing.

That is a categorical difference from a strong policy, not a stronger version of one. A policy is a promise backed by a contract and an audit. Locality is an architectural fact.

Be Precise About Local Claims Too

The same skepticism should apply to local tools, including this one. Honest local processing still involves some network activity, and a vendor claiming absolutely none is overstating.

Wrivio’s Local mode processes rewrites in-process on your machine with no text transmitted. The network actions that do exist are user-initiated and worth naming: downloading the model file the first time, checking for updates, and sending an error report if you explicitly click to send one, which shows you the exact payload first and never includes your rewrite text. Cloud mode is a separate, clearly labeled path where text does go to a backend, and the choice is yours per rewrite.

That level of specificity is what you should demand from any vendor, including when the answer is inconvenient.

Writing the Question

If you need to ask a vendor formally, keep it short and answerable.

Before:

We were just wondering if you could tell us a bit about your approach to data privacy and security, as this is something that’s quite important to us as an organization and we want to make sure we’re comfortable before proceeding.

After:

Before we proceed, please confirm in writing: which regions process our content, which subprocessors receive it, what content and log retention periods apply on our plan, whether retention can be disabled at our tier, and your process for responding to legal requests for customer content.

The second one gets a real answer, because it is specific enough that a vague reply is visibly evasive.

Common Questions

Is zero retention meaningless then?

No, it is genuinely valuable. It is just narrower than the phrase implies, and it should be read alongside the log retention answer.

Does an enterprise plan solve this?

It usually improves the terms substantially. It does not change the fact that the data is transmitted and processed externally.

How do I verify a local processing claim?

Watch network activity while running a rewrite. Windows Resource Monitor is enough for a basic check.

Download Wrivio for Windows to handle sensitive drafts with an architecture that makes retention policy a question you do not have to ask.