Zero-data-retention is a privacy and security control where processed data is not stored after the request finishes. In practice, the service may handle the content in memory long enough to answer, but it does not keep prompts, files, or derived outputs in durable logs, databases, or archives.
This matters in cyber security because less retained data means less material for attackers to steal, subpoena, or accidentally expose. It also reduces the impact of breaches, insider abuse, and overbroad logging. Security teams use zero-data-retention to lower risk when handling credentials, customer data, or regulated information.
In real systems, attackers often target residual data in API logs, caches, crash dumps, or message queues. Defenders respond by minimizing telemetry, using stateless services, encrypting transient buffers, and verifying vendor retention settings. Zero-data-retention is not the same as “no processing,” but it is a strong defense when the service can operate without keeping the data afterward.