--- title: "Data policy & ZDR" description: "pirouter is 100% zero data retention: it never stores prompts or completions and records only the metadata billing and troubleshooting need; every provider's data policy is public, and data_collection or zdr on a request keeps it to the providers that qualify." canonical: "https://pirouter.ai/docs/guides/data-policy" last-updated: "2026-10-17" lang: "en" source: "content/docs/en/guides/data-policy.mdx" --- # Data policy & ZDR pirouter is 100% zero data retention: it never stores prompts or completions and records only the metadata billing and troubleshooting need; every provider's data policy is public, and data_collection or zdr on a request keeps it to the providers that qualify. pirouter is 100% zero data retention: your prompts and completions are never stored, and only the metadata that billing and troubleshooting need is recorded. Providers have terms of their own, so pirouter publishes every provider's data policy and lets you send requests only to the providers that meet your requirements. ## What pirouter stores Request and response bodies pass through the gateway in memory and are never written to disk. For billing and troubleshooting, pirouter records only the metadata below: | Category | What is recorded | | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Request | Time, model, the provider and deployment that served it, endpoint, success or the failure reason, whether it streamed, trace ID | | Usage and cost | Token counts by kind (input, output, cache reads and writes, reasoning, image, audio), web search and fetch counts, images generated, each cost and the unit prices in effect | | Latency | Time to first byte, generation time | | Client | IP address, country, User-Agent, the origin part of the Referer (scheme, host and port, never the path or query), the app name from `X-Title` | | IDs you send | `X-Pi-Session-Id` | | Ownership | Workspace, user, API key | | Fallback | Whether the next attempt replaced this one | | Provider | The provider's own request ID, response ID and reported model name, and the allow-listed provider response headers (the provider's request IDs and rate-limit headers) | | **Never stored** | **Prompts, completions, tool call arguments, image and file contents** | This metadata is used for billing and troubleshooting, and is kept as described in the [Privacy Policy](https://pirouter.ai/privacy). ## Provider policies Requests are served by providers, and each one has its own terms. pirouter publishes the data policy, `data_policy`, of every provider of every model, on the model pages and in the API: | Field | Meaning | | ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | `prompt_training` | Whether the provider trains models on prompts. `null` means it has not disclosed | | `data_retention` | `zero` for no retention, `limited` for a bounded period, `unlimited` for no declared bound, `unknown` when not disclosed | | `moderation` | Who is responsible for content moderation: `provider` for the provider, `developer` for the developer, `none` when nothing is declared | | `reviewed` | Whether pirouter has checked the three fields above against the provider's published terms. Model pages mark an unchecked policy **Unverified** | Each provider entry also has a `headquarters` field: the country of the provider's headquarters as an ISO 3166-1 alpha-2 code, or `null` when not declared. It is not part of `data_policy`. - [On each model page](https://pirouter.ai/models): Open a model and look at the Providers section. Every provider row shows its data policy. - [In the API](https://pirouter.ai/docs/api/list-model-endpoints.md): `GET /v1/models/{vendor}/{model}/endpoints` returns the `data_policy` of each provider. ## Your controls | Setting | Effect | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `"data_collection": "deny"` | Keeps only providers that meet both conditions: they declare that they do not train on prompts, and their data retention is zero or limited. A provider that has not disclosed is excluded | | `"zdr": true` | Keeps only providers with zero data retention (`data_retention` is `zero`) | ### Per request Put `data_collection` (`"allow"` or `"deny"`) and `zdr` (a boolean) in the `provider` object at the top level of the request body. Requests in the OpenAI, Anthropic and Gemini protocols all accept it. See [Provider routing](https://pirouter.ai/docs/guides/routing.md#override-per-request) for the format. ```json { "model": "openai/gpt-6.1-sol", "messages": [{ "role": "user", "content": "Hello!" }], "provider": { "data_collection": "deny" } } ``` To use only providers with zero data retention, replace `provider` with `{ "zdr": true }`. Only some models have such a provider today, so check the model page first. > **Planned, not available yet:** More zero data retention providers are being added. ### For the workspace In the console, open the **Preferences** page and turn off **Allow providers that may train on your data** in the **Privacy** card. This sets `"data_collection": "deny"` for the whole workspace. Only the workspace owner can change it; other members see the switch disabled. When both layers are set, limits only tighten: with the switch off for the workspace, a request that sends `"data_collection": "allow"` is still denied. See [How the two layers combine](https://pirouter.ai/docs/guides/routing.md#how-the-two-layers-combine). ## Edge cases ### No provider meets the policy A policy is a hard filter. When no provider of the chosen model meets it, the request returns `404` with the error code `no_eligible_provider`, and `error.metadata.failed_step` is `data_policy`. The request is never sent to a provider that does not qualify, and nothing is billed. For an example body see [When no provider is left](https://pirouter.ai/docs/guides/routing.md#when-no-provider-is-left); for what to do see [`no_eligible_provider`](https://pirouter.ai/docs/api/errors.md#no_eligible_provider). ### With fallback models When the request names fallback models in `models`, a primary model emptied by the policy does not end the request: the gateway tries the next model in order, and the policy applies to it too. Only when every model is emptied does the request return `404 no_eligible_provider`. ## Not available today - **Zero data retention for the whole workspace.** The **Zero data retention only** switch under Preferences is marked **Unavailable**. To use only providers with zero data retention, send `"zdr": true` in the request. ## Next steps - [Provider routing](https://pirouter.ai/docs/guides/routing.md): Every field of the `provider` object, and how the two layers combine. - [Edge network](https://pirouter.ai/docs/guides/edge-network.md): The path a request takes from your client to the provider. - [List model endpoints](https://pirouter.ai/docs/api/list-model-endpoints.md): The full definition of `data_policy` in the API response.