OpenRouter Zero Data Retention vs Zero Data Protocol
OpenRouter provides routing controls that can restrict AI requests to endpoints operating under Zero Data Retention policies. Zero Data Protocol goes upstream: it also questions what enters the prompt, what metadata exists and whether any information may be exploited beyond the necessary purpose.
OpenRouter ZDR is a valuable routing and retention control, but it is not equivalent to Zero Data Protocol. ZDR restricts storage of prompts and responses by eligible providers. ZDP combines zero unnecessary collection, zero unnecessary retention and zero secondary exploitation across the complete architecture.
What is OpenRouter Zero Data Retention?
OpenRouter is a multi-provider AI routing platform. Its Zero Data Retention controls can restrict a request so that it reaches only model endpoints identified as operating under a ZDR policy.
OpenRouter states that its own service does not store prompt or response content unless the user explicitly opts into input and output logging or permits use of that content. It does retain request metadata such as token counts and latency for reporting and model ranking.
Request created
The application sends messages, files or other input to OpenRouter.
Policy applied
Privacy settings, guardrails and provider preferences filter eligible endpoints.
Inference performed
A compatible model endpoint processes the prompt and returns a response.
Four ways to enforce ZDR
At request level, the application can explicitly require Zero Data Retention for the selected provider route:
The request-level setting adds a stricter requirement. It does not override an existing account or guardrail requirement to make routing less private.
What ZDR covers—and what still exists
OpenRouter also distinguishes retention from training. A provider can decline model training while retaining content for another stated reason. The platform therefore provides controls for both dimensions.
ZDR is scoped, not magical: it reduces persistent content storage after processing. It does not mean that no data was submitted, no metadata was generated or no third-party inference occurred.
The important caching distinction
OpenRouter documents implicit prompt caching in provider memory as compatible with its ZDR routing position. The reasoning is that temporary in-memory caching used during processing is not treated as persistent retention.
OpenRouter also offers an optional response-caching feature at its own edge layer. Its documentation states that account-level ZDR disables that response cache because it requires temporary storage of response data. This demonstrates why every “zero retention” claim must define memory, cache, content, duration and storage layer.
Under ZDP, a cache is evaluated by purpose and necessity: what is cached, for how long, under which identifier, who can retrieve it, and whether the same function can be delivered without persistence.
What Zero Data Protocol adds
Zero Data Protocol is an independent architectural framework. ZDR corresponds mainly to its retention pillar, while ZDP adds two surrounding controls:
ZDP therefore begins before the router receives the request. It encourages local redaction, data abstraction, anonymous identifiers and minimal context so the routing layer never receives information that does not need to leave the originating environment.
OpenRouter ZDR vs Zero Data Protocol
| Dimension | OpenRouter ZDR | Zero Data Protocol |
|---|---|---|
| Primary objective | Route requests only to endpoints with a ZDR policy | Remove unnecessary personal-data dependency across the system |
| Main control | Provider selection and retention-policy enforcement | Collection, retention and exploitation architecture |
| Starting point | A prompt or request is ready to be routed | Question what should enter the request before transmission |
| Prompt processing | Prompt passes through OpenRouter and an eligible model provider | Processing is permitted only with necessary and minimized content |
| Prompt storage | Not retained by default by OpenRouter; eligible endpoints follow ZDR policy | Persistent content storage rejected unless functionally necessary |
| Metadata | Operational metadata is retained | Metadata must also be minimized, delinked and purpose-limited |
| Training controls | Managed separately from retention through provider policies | Unrelated training is prohibited by Zero Exploitation |
| Caching | Some in-memory prompt caching can be treated as ZDR-compatible | Evaluated by necessity, duration, accessibility and linkability |
| Type | Commercial AI routing platform and privacy control | Independent architectural framework |
| Relationship | OpenRouter ZDR can implement part of a ZDP-oriented AI architecture, but does not establish full ZDP alignment | |
A ZDP-oriented OpenRouter deployment
- Redact before transmission. Remove names, email addresses, account numbers, confidential attachments and unnecessary context locally.
- Enforce ZDR at the highest level. Prefer account or organizational controls for sensitive workloads instead of relying only on developer discipline.
- Deny training and collection where required. Treat provider training policy as separate from data retention.
- Restrict eligible providers. Use allowlists and routing rules that match contractual, regional and security requirements.
- Control logging explicitly. Keep optional prompt and response logging disabled unless a defined need and retention period justify it.
- Review caches and derived stores. Include response caches, embeddings, vector databases, traces, evaluations and observability tools.
- Minimize metadata. Assess whether user IDs, IP addresses, project identifiers and request histories can be reduced or separated.
- Audit policy changes. Provider endpoints and policies can change; validate the current routing result rather than relying on an old configuration.
Frequently asked questions
What does OpenRouter Zero Data Retention mean?
It means a request can be restricted to model endpoints identified as not storing prompt and response content after processing. OpenRouter also states that it does not retain prompts or responses by default unless the user opts into logging or data use.
Does OpenRouter store any data under ZDR?
Yes, operational request metadata such as token counts and latency can still be retained. The prompt must also be processed transiently by OpenRouter and the selected provider.
Is no training the same as zero retention?
No. A provider may refrain from training while retaining content for security, legal or operational reasons. OpenRouter treats provider training and retention as separate policy dimensions.
Can OpenRouter cache prompts under ZDR?
OpenRouter documents some implicit in-memory provider prompt caching as compatible with its ZDR position. Its separate response cache is disabled when account-level ZDR is enforced because response caching requires temporary content storage.
Is OpenRouter ZDR compliant with Zero Data Protocol?
Not automatically. It can support the Zero Retention pillar, but ZDP also requires minimizing collection, metadata and secondary exploitation throughout the surrounding application.
Are OpenRouter and Zero Data Protocol affiliated?
No affiliation or endorsement is implied. This is an independent architectural comparison based on public OpenRouter documentation.
Editorial notice: OpenRouter and the names of model providers may be trademarks of their respective owners. They are cited for identification and comparative analysis only. No commercial relationship, endorsement or equivalence with Zero Data Protocol is claimed. Provider endpoints, features and data policies can change; consult the current documentation and contractual terms before processing sensitive information.