Model providers as processors: DPAs and retention

When your application sends a prompt to a hosted model, the provider is processing personal data on your behalf. Whether that is a clean processor relationship depends on details buried in retention pages, feature eligibility tables and DPA clauses: how long abuse logs are kept, which features fall outside zero-retention deals, where inference runs, and whether the provider ever acts as a controller.

This article goes through six providers using their own documentation as published in October 2026. Every number below is taken from the linked page; where a provider does not publish a figure, the table says so rather than guessing. Terms change often, sometimes with a new model release, so treat this as a map of what to check, and check it again before you sign. For the general contract checklist, see the DPA guide and the sub-processor guide. Nothing here is legal advice.

What to look for in any model provider's terms

1. Role. Is the provider your processor for all of the processing, or does it act as a controller for some purposes (abuse monitoring, safety research, training)? Controller purposes are disclosures you must cover in your notice and ROPA.
2. Training. Is customer content used to train or improve models by default? Can you opt out, and is the opt-out the default for your plan?
3. Retention. How long are prompts and completions kept, for what purpose, and who can read them (automated systems only, or humans)?
4. Zero data retention. Is it available, how do you get it, and which endpoints and features does it exclude?
5. Stateful features. Files, vector stores, stored responses, threads, batches, fine-tuning data. These persist until deleted and are usually outside zero retention.
6. Location. Where does inference run, where is data stored at rest, and are these controlled separately?
7. Sub-processors. Where is the list, how are changes notified, how long do you have to object?
8. Consumer vs business. Consumer chat products often have different defaults from the API. Staff using a personal account for work data bypass your contract entirely.

OpenAI (API)

As of October 2026, OpenAI's developer documentation states that data sent to the API is not used to train or improve its models unless you explicitly opt in, and that abuse-monitoring logs are retained for up to 30 days unless longer retention is required by law (OpenAI, Your data).

Two controls reduce retention further: Modified Abuse Monitoring, which excludes customer content from abuse-monitoring logs, and Zero Data Retention, which does the same and also changes endpoint behavior. Both are subject to prior approval; you contact sales to check eligibility.

The same page has the most detailed eligibility table of any provider. Under ZDR, the store flag on Responses and Chat Completions is treated as false. Without ZDR, Responses application state is kept for 30 days by default. Files, vector stores, Assistants, Threads, Conversations, Agents, Batches, Fine-tuning and Evals are not ZDR-eligible: their objects persist until you delete them. Embeddings, Moderations, Audio, Completions and Realtime are listed as eligible.

Data residency is offered through regional domain prefixes. The page lists the United States and Europe (EEA plus Switzerland) for both storage and processing, the UAE for storage with processing for select endpoints (and additional approval), and Australia, Canada, Japan, India, Singapore, South Korea and the UK for storage only. Any region other than the US requires approval for abuse monitoring controls (Modified Abuse Monitoring or ZDR) and a Modified Retention amendment, and data residency endpoints carry a 10% uplift for eligible models released on or after March 5, 2026. The page also notes that data residency does not cover system data.

On the consumer side, OpenAI's help center says content from individual ChatGPT accounts may be used for training, controlled by the "Improve the model for everyone" setting, while ChatGPT Business, Enterprise, Edu and API inputs and outputs are not used by default (OpenAI Help Center). OpenAI publishes a DPA (effective January 1, 2026; section 2.9 gives 30 days to object to a new sub-processor after notice) and a sub-processor list.

Anthropic (Claude API)

As of October 2026, Anthropic's Privacy Center states that for API users, inputs and outputs are deleted from its backend within 30 days of receipt or generation; content flagged by its automated trust and safety systems as violating its Usage Policy can be retained for up to 2 years, and trust and safety classification scores for up to 7 years; feedback submissions are retained for 5 years (Anthropic Privacy Center, updated July 1, 2026). The API documentation adds that conversation content is not retained by default except for designated "Covered Models", which require 30-day retention and are not available under ZDR unless Anthropic expressly authorizes it, and that retained data is never used for training without express permission (Anthropic, API and data retention). Read the two pages together and check which models you call.

ZDR is an arrangement for commercial customers, with a per-feature eligibility table. Stateful features are excluded: the Files API, Batch API, code execution, the MCP connector, Agent Skills and Managed Agents retain data per their own policies. Even under ZDR, Anthropic may retain flagged content for up to 2 years or where required by law.

Data residency on the first-party API is split into inference geo (per request, "us" or "global") and workspace geo (storage at rest, currently "us" only). US-only inference is priced at 1.1x standard rates on Claude 4.6 and later models (Anthropic, Data residency). There is no EU option on the first-party API at the time of writing; EU teams that need EU processing of Claude models typically reach them through a cloud platform's regional offering, where the cloud provider is the processor.

The DPA (effective February 24, 2025) makes Anthropic a processor, incorporates the EU SCCs (Modules Two and Three) with UK and Swiss addenda, gives customers fifteen days to object to a new sub-processor after notice, and requires return or deletion of customer data within thirty days of termination. The sub-processor list is on Anthropic's trust center.

Consumer accounts work differently. Since Anthropic's August 2025 terms update, Free, Pro and Max users choose whether their chats are used for training, and choosing yes extends retention to five years; the update does not apply to services under the Commercial Terms, including the API (Anthropic announcement).

Google (Vertex AI and the Gemini API)

Google runs two different offerings with different terms, and mixing them up is a common mistake.

Vertex AI (Google Cloud; its documentation now uses the name Gemini Enterprise Agent Platform): as of October 2026, Google states it will not use your data to train or fine-tune any AI/ML models without prior permission or instruction. Inputs and outputs are cached in memory, isolated per project, with a 24-hour TTL; caching can be disabled at the project level. Google may log prompts to detect abuse; you can request an exception. The page does not state a retention period for those abuse logs. Grounding with Google Search stores data for up to three days and cannot be disabled; Grounding with Google Maps stores data for thirty days (Agent Platform and zero data retention). For residency, the EU and US multi-region endpoints keep ML processing within that geography (the EU endpoint excludes the UK and Switzerland); global endpoints carry no residency guarantee (Agent Platform data residency).

Gemini API / Google AI Studio: under the Gemini API terms, for unpaid services Google uses submitted content and responses to provide, improve and develop its products, and human reviewers may read API input and output. For paid services Google does not use prompts or responses to improve its products and logs them for a limited period solely to detect policy violations; no number of days is given. If you make API clients available to users in the EEA, Switzerland or the UK, you may use only paid services; and if you are in the EEA, Switzerland or the UK, the paid-service data terms apply to all services, including free usage. The terms also say paid-service data may be stored transiently or cached in any country where Google or its agents have facilities (Gemini API Additional Terms, effective March 23, 2026).

Microsoft (Azure OpenAI and other models sold by Azure)

As of October 2026, Microsoft's documentation for models sold directly by Azure in Microsoft Foundry, including Azure OpenAI, states that prompts, completions, embeddings and training data are not available to OpenAI or other model providers, are not used by them to improve their models, and are not used to train generative AI foundation models without your permission. Processing is governed by the Microsoft Products and Services DPA (Microsoft, Data, privacy and security).

Location depends on deployment type. Standard deployments process within the customer-specified geography. "DataZone" deployments may process anywhere in the data zone (for an EU resource, any EU member state). "Global" deployments may process in any geography where the model is deployed. Data at rest, including the abuse-monitoring store, stays in the customer's geography in all cases.

Abuse monitoring samples flagged prompts and completions for review, by automated means including LLMs by default and by authorized Microsoft employees where needed; for resources in the EEA, those employees are in the EEA. Customers meeting Limited Access eligibility criteria can apply for modified abuse monitoring, which turns off storage and human review, though automated review may continue (Microsoft, Abuse monitoring). You can verify the setting: a ContentLogging capability set to false appears on the resource when storage for abuse monitoring is off. The pages we reviewed do not state a retention period for the abuse-monitoring store. Stateful features (Responses API, Assistants threads, stored completions, files, vector stores) store data in your resource, in your geography, until you delete it.

AWS (Amazon Bedrock)

As of October 2026, AWS states that Bedrock inputs and outputs are not used to train Amazon or third-party models and are not shared with model providers (Bedrock FAQs). Models run in AWS-operated model deployment accounts that the model providers cannot access, so providers do not see Bedrock logs or customer prompts (Bedrock data protection).

By default Bedrock does not store model inputs or outputs, but some recent frontier models require retention for abuse detection: the abuse-detection page lists specific models whose traffic, or classifier-flagged traffic, is retained for up to 30 days, in some cases with potential human review by AWS (Bedrock abuse detection). Retention is configured per region through a data retention mode (none, default, aws_review), and models that require review are unavailable unless you opt in; an SCP can enforce none across an organization (Bedrock data retention). For Claude models, AWS notes that ZDR eligibility is managed by Anthropic.

On residency, geographic cross-region inference profiles (for example EU) route requests only within that geography; global profiles route worldwide at a discount AWS gives as roughly 10%. Retained inputs and outputs are stored in the region where the request was processed (Bedrock cross-region inference).

Mistral AI

Mistral's DPA (effective July 27, 2026) is worth reading closely because it is explicit about controller purposes. Section 2.3 lists automated moderation, including abuse monitoring on the APIs, as a purpose for which Mistral acts as controller, except when zero data retention is activated, and permits training on customer data unless the customer is or has opted out. Feedback submitted via thumbs up or down may be used with the associated input and output to train models. The DPA points to a sub-processor list on Mistral's trust center and gives ten days to object after notice. It does not itself state an API retention period or a hosting location.

As of October 2026, ZDR is available on paid plans for supported stateless endpoints (chat and FIM completions, embeddings, moderations, classifications, OCR, speech and transcription), by request through support and at Mistral's discretion. It does not cover Agents, batch files, Conversations, Libraries or the files endpoint. Mistral's documentation stresses that ZDR and training opt-out are separate controls (Mistral, Zero data retention). Check the training setting for your plan in the admin console rather than assuming a default.

Side-by-side

Cells are filled only where the provider's own documentation, as reviewed in October 2026, states the point. "Not stated" means we did not find it in the pages linked above, not that it does not exist; ask the vendor.

What this means for your contracts and records

• Record the provider's controller purposes. If a provider processes for abuse monitoring as a controller, or reserves training rights unless you opt out, list it in your ROPA and privacy notice as a recipient for that purpose, not only as a processor.
• Turn settings into evidence. Screenshot or export the training opt-out, ZDR approval, retention mode or ContentLogging status, and keep it with the vendor file. Re-check after every plan change.
• Map features to retention. Your ZDR agreement probably does not cover the features your team adopted last quarter. Keep a list of which provider endpoints you use and check it against the eligibility table.
• Pick regions deliberately. Global routing is often cheaper or more available. If your transfer assessment depends on EU processing, enforce the region in code and, where possible, by policy (workspace defaults, SCPs, organizational policies on global endpoints).
• Subscribe to sub-processor changes. Objection windows of ten to thirty days pass quickly. Route notices to someone who will read them.
• Block consumer accounts for work data. A business API contract does not cover an employee pasting customer data into a personal chat account. Provide an approved tool and say so in your acceptable-use policy.

Provider terms are one layer. The prompts still carry whatever your app put in them, and traces on your side usually hold more than the provider ever sees. The prompts and traces article covers that half, and the self-hosting article covers what changes if you run models yourself.