Zero data retention

Zero data retention (ZDR) limits routing to vendors that have agreed not to store or train on your prompts and completions. Turn it on when customer contracts or your security review require it.

How it works

• Routing fails closed. Only ZDR vendors are candidates, even if your routing policy lists others. If none can serve the request, Gateway rejects it instead of falling back.
• BYOK vendors count as compliant. Traffic on your vendor key runs under your agreement with that vendor.
• The model list follows it. GET /v1/models shows only ZDR routes and omits models with none.
• The response store is off. store: true retains nothing, so conversation resumption is unavailable.
• Web search skips Browserbase. Every other web search engine (exa, youcom, parallel, interfaze, tavily) qualifies; engine: "auto" skips browserbase.

ZDR governs vendors only. Keeping request and response bodies in your logs is the payload logging setting under Settings → Organization.

Turn it on

Turn on Zero data retention under Configure → Request settings → Routing restrictions in the dashboard. It applies from the next request and needs Manage organization settings.

Scoped controls

Projects and end customers can override ZDR and vendor and region restrictions. The most specific scope wins (customer → project → organization), and each control inherits separately. Whether a scope can relax the organization depends on how the request reaches it:

• Pinned by the API key (a project- or customer-scoped key): the override applies in full, on or off
• Named on the request (the X-Project-Id header, a body project_id, or a body customer): the override can only tighten; a relaxing value is ignored

Set overrides on a project’s or customer’s Controls tab or over the API. Only the dashboard, with Manage organization settings, can save an override that relaxes the organization; the API returns 403 scoped_controls_loosening_forbidden.

# Turn ZDR on for one project (management key)
curl -X PUT https://api-gateway.merge.dev/v1/projects/$PROJECT_ID/controls \
  -H "Authorization: Bearer $MERGE_GATEWAY_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"zero_data_retention": true}'

GET on the same path returns override, effective, and sources (the scope behind each value). DELETE clears the override.

Check which models qualify

GET /v1/models?zero_data_retention=true lists models with at least one ZDR vendor, and vendors.<slug>.zero_data_retention marks which routes qualify. GET /v1/vendors?zero_data_retention=true lists ZDR vendors, flagged with supports_zdr.

curl "https://api-gateway.merge.dev/v1/models?zero_data_retention=true&limit=500" \
  -H "Authorization: Bearer $MERGE_GATEWAY_API_KEY" \
  | jq -r '.data[] | "\(.model): \([.vendors | to_entries[] | select(.value.zero_data_retention) | .key] | join(", "))"'

Supported vendors

• Amazon Bedrock
• Augure
• Baseten
• BytePlus
• Cohere
• Fireworks AI
• Google Vertex AI
• Interfaze
• Makora
• MiniMax
• Modal
• Moonshot AI
• MorphLLM
• OpenAI
• Parasail
• Pareto
• Particle AI
• Sail Research
• Sakana AI
• Tera
• Together AI
• TypeSafe AI
• xAI

Models with ZDR coverage

With ZDR on, each model below routes only to the vendors shown, and unlisted models are rejected. For live data, use the model catalog ZDR filter or the API calls above.

Errors

If a request pins a model, vendor, or web search engine that doesn’t meet the ZDR restriction, Gateway returns 400 invalid_request_error. The code is zdr_vendor_unavailable for model or vendor routes, and server_tool_zdr_unavailable for a pinned web search engine. A policy with no eligible ZDR route returns the same error type without a code.

Next steps