Zero data retention

Zero data retention (ZDR) is the default for every workspace, every model, every request. It's not an opt-in flag — it's how the schema is shaped.

At a glance


Prompts logged	No — schema has no column for them
Completions logged	No — schema has no column for them
Metadata logged	Yes — tokens, latency, status, cost in cents
Default retention	90 days for metadata, 365 days for auth events
Opt-in replay	Per-workspace, requires signed DPA addendum

What flows through the gateway

flowchart LR
  Client[Your app] -->|prompt| Gateway
  Gateway -->|prompt| Provider[EU provider]
  Provider -->|completion| Gateway
  Gateway -->|completion| Client
  Gateway -. metadata only<br/>tokens, latency, status .-> DB[(requests table)]

The requests table has columns for apiKeyId, model, provider, status, latencyMs, inputTokens, outputTokens, costCents and createdAt. There are no prompt or completion columns. There never will be — that's enforced by the architecture review process on every PR.

Stream chunks

Streaming SSE chunks flow through the gateway's memory and out to the client without being persisted. The metadata row is written after the stream ends, using usage from the final chunk.

What's stored

Element	Stored?	Retention
Request metadata	yes	90 days (logging-only)
Authentication events	yes	365 days (audit)
Prompts / messages / tools	no	0 — never persisted
Completions / tool-calls	no	0 — never persisted
Stream chunks	no	0 — passed through

Provider-side ZDR flags are passed automatically:

X-Disable-Data-Retention: true (OpenAI / Azure)
anthropic-no-retention: true (Anthropic via Bedrock)
ZDR-by-default (Mistral, Scaleway, Tensorix)

Opt-in replay (for evaluations)

Replay is off by default

Caching / replay (e.g. for evaluation pipelines) is per-workspace, requires a signed DPA addendum, and is encrypted with AES-256 in your own KMS key. Default is RETENTION_POLICY=0.

You'd opt in if:

You're running a Mastra evals workflow that needs deterministic inputs over a 72h window.
Your compliance team has approved a specific, documented use case with explicit data-subject notification.

You almost certainly do not want this on by default.

Auditing the no-retention claim

Two facts you can verify yourself:

Schema inspection. \d+ requests against the gateway's database shows no prompt / completion / messages / content column.
Source review. apps/gateway/src/lib/requestLog.ts is ~80 lines and only references the metadata columns. Any PR that adds a content column gets blocked by Claude PR-review against ARCHITECTURE.md invariant #2.

GDPR & DPA — DPA, sub-processors, DPO.
EU AI Act — readiness posture.
Pricing — what metadata billing relies on.