Vercel adds Zero Data Retention to keep your data out of AI model training

Developers who work with several AI models at once have run into a new problem: fragmented data policies. OpenAI trains on your data by default. Anthropic does not. Google has its own terms. Instead of writing code, teams end up reading terms of service and hoping every team member configured opt-outs correctly on each request. Vercel has tackled this pain point by extending AI Gateway.

How things usually break

Every AI provider takes its own approach to data, and that creates operational chaos. Some train on requests by default and require an explicit opt-out. Others offer an opt-out only at the API level. Still others require a contract to guarantee Zero Data Retention. Managing this by hand is impossible. The only option is to read each provider's documentation, compare it against your company's security requirements, and hope developers remember how to configure every request correctly. A single missed opt-out can cost you your confidentiality.

How Vercel solves the problem

Vercel AI Gateway changes the approach. Instead of configuring each request separately, you set a policy once in the dashboard. The Gateway then automatically routes all requests only through providers that meet your requirements. You do not need to change any code.

This works because Vercel has already negotiated Zero Data Retention agreements with most major providers. OpenAI, Anthropic, Google and others offer ZDR versions of their models, and the Gateway simply picks the right one.

Three ways to control your data

Vercel offers a flexible approach with three levels of protection:

• Team-wide ZDR — turn it on in the dashboard, and all of your team's requests are routed only to ZDR models. Nobody can bypass the policy by accident
• Per-request ZDR — for individual sensitive requests, when only some of your data needs protection. It is configured in code through provider options
• Disallow Prompt Training — blocks providers from using your prompts to improve their models, useful if you send proprietary code or internal strategy

Team-wide ZDR suits teams where security is the priority: set it once in the dashboard and forget it. Per-request fits mixed scenarios, where some requests contain confidential information and others do not.

Full visibility: an audit in every response

Automation is good, but you also need transparency. Vercel includes full routing metadata in every response: which providers were considered, which were filtered out by ZDR criteria, and which one was finally chosen. This is more than logging: it is an audit trail for compliance. An example in the Gateway documentation shows the system trying several providers but selecting only those that meet the ZDR criteria.

What this means

Compliance used to be the application's problem. Developers had to remember data protection on every request. Now it is an infrastructure decision. Your team can focus entirely on the product, while the Gateway makes sure your data does not leak into the training of other companies' models.