What ZDR actually pins down
Training use, retention duration, and human access are independent axes. A ZDR agreement moves exactly one.
Training use
Business APIs from the major vendors do not train on customer data
by default, with or without ZDR. Consumer opt-outs live on this axis.
Not moved by ZDR
Retention duration
The one axis ZDR moves: prompt and response payloads are not
retained for eligible features, at the provider hop only.
Set to zero by ZDR
Human access
Abuse and safety processes govern who can look at retained data,
on their own terms. A ZDR agreement does not switch this axis.
Not moved by ZDR
One party only
Tracing stores, gateway logs, and vector
memory keep their own clocks.
Eligible features only
Batch jobs, file uploads, and code
execution store data by nature.
Mandates still apply
Fable 5 keeps its 30-day window
even for ZDR customers.