Which AI Agent Features Fall Outside Zero Data Retention

A model can support a zero-data-retention arrangement while the agent feature around it stores sessions, files or memories. The purchase decision therefore belongs at the feature level. Start with the workflow you intend to run, identify every place it creates persistent state, and check each against the applicable provider arrangement.

This census records 31 feature and delivery-surface combinations across Anthropic, OpenAI, Google and AWS. It separates what provider documentation states from what remains unknown. It is a procurement reference, not a legal opinion or a certification that any deployment meets its obligations.

ZDR means zero data retention under the provider’s defined arrangement. BAA means a HIPAA business associate agreement; DPA means a data processing agreement, with Google’s CDPA label retained where documented. Eligibility does not establish that your organization has executed the required agreement.

Read the contract and deletion fields separately even where they share a column. “Conditional” requires the applicable account, model and feature settings. “Unknown” means the inspected source does not establish the field; it does not mean the provider has no agreement or deletion mechanism. Source letters resolve directly to provider pages.

Anthropic’s eligibility documentation adds model-specific exceptions: Fable 5/5.1 and Mythos 5/5.1 require 30-day retention without express authorization. Search/fetch dynamic filtering is excluded from the eligible path. Flagged content may be retained up to two years, with legal exceptions. A feature-level yes cannot override those conditions.

OpenAI’s HIPAA guidance requires an executed BAA and Modified Retention for covered API use unless specified otherwise. Codex cloud is excluded. The API data-controls page separately conditions the cache-only web-search BAA path on supported non-preview tooling, disabled external web access and ZDR at organization and project level.

These details change how a procurement question should be phrased. Ask whether the exact model, endpoint, tools and settings are covered by the proposed agreement. A response about the general API may be accurate while leaving the intended hosted feature unanswered.

Our Astra–Fable comparison covers model selection. Use this feature census as a separate filter before running an evaluation with confidential material.

Persistent state can be useful: it lets work resume, keeps files available and avoids asking the user to repeat context. The review cost is identifying which resources exist, who can access them, how long they remain and which operation removes them. That work is part of choosing the runtime.

Claude Managed Agents documentation says the stateful service is outside current ZDR and HIPAA BAA eligibility. Session deletion and uploaded-file deletion are separate. The question for a buyer is whether that persistence fits an acceptable arrangement, not whether persistence is automatically disqualifying.

The current OpenAI background-mode guide permits requests from ZDR projects with store=false while retaining temporary polling data for roughly ten minutes. That is a specific documented exception to a literal expectation of no storage. Quote the behavior when assessing it rather than relying on an older blanket description of background mode.

Google’s managed-agent preview guide restricts confidential input and commercial/production use. General cloud data-governance statements do not remove those preview restrictions. Our Google managed-agent analysis provides product context; the current feature terms decide the allowed use.

Draw a simple resource list for a representative task: input request, session, uploaded file, tool result, memory, trace and export. Identify the owner and deletion operation for each. A request to delete the session should not be treated as proof that the other resources were removed.

AWS short-term event deletion documentation says deleting an event does not remove derived long-term memory. The latter has a separate DeleteMemoryRecord operation. Similarly, runtime lifecycle limits describe instance lifetime, not a universal data-retention promise. A stopped process and erased data are different outcomes.

Include destinations outside the runtime. A remote tool may receive information under its own policy, and an exported trace may remain in your observability system. The provider’s deletion operation cannot establish what your own retained export contains. Keep the data-flow map narrow enough that an engineer can verify it.

Our agent runtime and sandbox matrix helps identify execution boundaries. Add storage and deletion ownership to that runtime decision before calling the workflow ready for sensitive work.

An unknown cell should produce a question with a subject and a requested answer. For example: does this feature retain session content after an explicit delete request, and what documented window applies to primary copies and backups? Avoid asking whether the whole platform is compliant; that invites an answer too broad to settle the deployment.

Attach the model ID, region, feature name and enabled tools to the question. Ask which contract covers the service and whether an eligibility exception requires approval. Request a source or written commitment that can be retained with the deployment record.

For implementation, test the operations available to you using non-sensitive sample data: create the resource, find it, delete it and confirm the visible result. Such a test can establish that the control works in your application. It cannot independently establish deletion of provider backups or other internal copies; those require the provider’s documented commitment.

Keep the census at the same URL and re-check it when the provider changes a feature or your workflow adds a new destination. A table read today is evidence for today’s decision, not a permanent certification. Our Claude Managed Agents update guide illustrates how runtime features can change the scope of an earlier review.