A data policy limits which upstream providers can serve a request, based on what each one commits to do with your prompts and responses. You can set one on a single request, or set a floor for a whole account.

## The three levels

Each provider has a data policy. The levels are ordered, and a stricter level includes the one below it: a provider that keeps nothing cannot train on your data.

| Level | What it means |
|---|---|
| **Standard** | No specific retention commitment on file. |
| **No training** | Committed not to train on your data. |
| **Zero data retention (ZDR)** | Committed to retain no request or response content. |

Models that have at least one zero-retention route are marked on the [Models](/models) page.

> Data policies reflect each upstream's own data terms and its agreement with us. We do not audit upstream implementations independently.

## Ask for a level on one request

Add a field to the [`provider` object](/docs/provider-routing):

```json
{
  "model": "deepseek/deepseek-v4-pro",
  "messages": [{ "role": "user", "content": "Hello" }],
  "provider": { "zdr": true }
}
```

| Field | Routes only to providers committed to |
|---|---|
| `"zdr": true` | Zero data retention. |
| `"data_collection": "deny"` | Not training on your data. A ZDR provider also qualifies. |

These are hard filters. If no provider for the model meets the requirement, the request fails with `503 no_provider_matches_data_policy`. It never falls back to a provider that does not qualify.

An unrecognized value returns `400` instead of being ignored. Ignoring a privacy requirement would return `200` from an upstream that keeps your data, and you would have no way to tell.

## Set a floor for the whole account

A floor applies to every request in the account, including requests from SDKs and tools you did not write, so you do not have to pass a field on every call.

To set it:

1. Open the [console](/console) and switch to the organization or personal space you want to protect.
2. Click the gear next to its name at the bottom of the sidebar.
3. Under **Access defaults**, choose **No requirement**, **No training**, or **Zero data retention**, then save.

Who can set it: an organization's admins, and the owner of a personal space. Members cannot.

A request can ask for something stricter than the floor, but never looser. If the floor is ZDR, a request that says `"zdr": false` is still routed to ZDR providers only.

### Raising the floor can make some models unavailable

Not every model has a provider at every level. When you raise the floor, models without a qualifying provider return `503` until you lower it again. Before you save, the console shows how many models stay callable, for example "41 of 65".

The floor is read on every request, so a change applies to the next call.

## What we store

We do not store request or response content, only metering metadata: model, token counts, latency, and status. A data policy is about what the upstream provider does with your content, which is a separate question from what we keep.

## Pricing at a stricter level

Prices on the Models page can change when you filter by data policy, because only providers that qualify count. If a model costs $1 on a standard provider and $3 on a ZDR provider, a request with `"zdr": true` is billed at $3. The Models page accepts a `?data_policy=` filter so what you see matches what you pay.