Blog
How long does an AI provider keep what you send it?
Sam Carr
Ask an AI supplier how long they keep what you send them and you will get a link. The link is usually to the wrong document, because "retention" is two questions wearing one word: how long your inputs sit in the product, and how long they sit in a safety log.
Checked on 27 August 2026, against each company's own documentation rather than a summary of it, here is where the answers actually live.
The consumer page tells you it is the wrong page
Anthropic's retention article opens by saying which products it covers:
This article is about our consumer products such as Claude Free, Pro, Max and when accounts from those plans use Claude Code. For our commercial products such as Claude for Work and the Anthropic API, see here.
That sentence does a lot of work. It is the page a search for "how long does Anthropic keep my data" tends to surface, and it is not the page that applies to a tool built on the API. The figures on it are real and they are about a different product to the one your supplier is probably using.
The habit worth forming is to read the first paragraph of a policy page before you read the numbers in it.
The API answer is thirty days, by default
The commercial article gives the figure plainly:
For Anthropic API users, we automatically delete inputs and outputs on our backend within 30 days of receipt or generation
Two words there carry the weight. Automatically, so it is not a setting somebody has to remember to switch on. And default, because the same page lists what moves it: a usage policy violation extends retention to two years, feedback you submit is kept for five, and it can be shortened "when you and we have agreed otherwise (e.g. zero data retention agreement)".
So thirty days is a true answer and an incomplete one. The useful follow-up is which of those exceptions your actual usage could trip.
OpenAI answers a slightly different question
OpenAI's data controls documentation also says thirty days, and it is a different thirty days:
By default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days
That is the safety log, not a conversation store. The same page lists retention per endpoint, and the endpoints do not agree with one another: /v1/chat/completions and /v1/responses show thirty days for abuse monitoring and are marked eligible for Zero Data Retention, while /v1/conversations retains until deleted and is not eligible.
The practical consequence is that "we use OpenAI" tells you nothing about retention on its own. Which endpoint the tool calls changes the answer.
Where each answer lives
| Question | Anthropic | OpenAI |
|---|---|---|
| Which document | Separate consumer and commercial retention articles | One data controls guide, with a per-endpoint table |
| Default on the API | Inputs and outputs deleted within 30 days | Abuse monitoring logs kept up to 30 days |
| What extends it | Usage policy violation, to 2 years. Feedback, to 5 years | Endpoints that store until deleted, such as /v1/conversations |
| What shortens it | A zero data retention agreement | Zero Data Retention, on eligible endpoints only |
| Checked | 27 August 2026 | 27 August 2026 |
Two things are worth noticing about that table. The rows are not the same question, which is the whole point. And every figure in it carries a date, because a quote with no date against it is not evidence of anything a year later.
What to ask before you sign
Whoever is building the tool should be able to answer all of these without going away to look:
- Which document covers us, and can I have the link? If it is the consumer policy, it is the wrong document.
- Is retention answered in the contract, or in a help page? Only one of those is a promise.
- Which endpoints does the tool actually call? On OpenAI this changes the answer by itself.
- Do we have a zero data retention agreement, or are we on the default?
- What happens to the data if we stop working with you?
None of these need a lawyer to ask. They need somebody who has opened the documents, and the answers belong written down beside the scope and the price rather than in an email thread. How a build gets scoped and agreed is the right place for them.
The short version
The providers have written down reasonable defaults. What they have also done is answer two different questions under one word, in more than one document, and leave the consumer one easier to find.
So the habit is not to distrust the answer. It is to check which question it answered, which document it came from, and to write the date on it. If you want to talk through a specific provider, get in touch.
Drafted by our blog writer. Read, checked and published by Sam.