AI vendors and your data

Vendors146Answers427

146 vendors · 427 answers

Zero Data Retention changed OpenRouter, Oct 19, 2026

OpenRouter · Oct 19, 2026 · 7 added, 7 removed · seen by the weekly check

The pageAll OpenRouter terms
  1. Added: A private endpoint connects a catalog model to a deployment you operate in your own provider account, authenticated with your BYOK key. Only organizations granted private access can route to it. OpenRouter has no view into your agreement with that upstream, so the retention classification comes from a declaration you make when you create or edit the private endpoint.
  2. Removed: A private deployment is an endpoint that connects a catalog model to a deployment you operate in your own provider account, authenticated with your BYOK key. Only organizations granted private access can route to it. OpenRouter has no view into your agreement with that upstream, so the retention classification comes from a declaration you make when you create or edit the private deployment.
  3. Added: Treated as retaining. The private endpoint is not eligible.
  4. Removed: Treated as retaining. The private deployment is not eligible.
  5. Added: The private endpoint stays in your ZDR routing pool.
  6. Removed: The private deployment stays in your ZDR routing pool.
  7. Added: A private endpoint does not inherit the data policy of any public endpoint or provider, even when it connects to the same upstream service. A new private endpoint with no declaration uses the conservative unverified fallback described in How OpenRouter Manages Data Policies : OpenRouter treats it as retaining, so it is not eligible for any request that requires ZDR.
  8. Added: Declaring ZDR keeps the private endpoint in your organization's ZDR routing pool. Every other routing constraint still applies: the requesting organization must hold private access to the endpoint, the endpoint must be available for the requested model, and provider preferences, guardrails, and other data-policy settings are evaluated as usual. The declaration only changes the retention classification. It does not add the private endpoint to the ZDR routing pool of any organization without private access, and it does not affect the ZDR eligibility of the public endpoints for the same model.
  9. Removed: A private deployment does not inherit the data policy of any public endpoint or provider, even when it connects to the same upstream service. A new private deployment with no declaration uses the conservative unverified fallback described in How OpenRouter Manages Data Policies : OpenRouter treats it as retaining, so it is not eligible for any request that requires ZDR.
  10. Removed: Declaring ZDR keeps the private deployment in your organization's ZDR routing pool. Every other routing constraint still applies: the requesting organization must hold private access to the endpoint, the endpoint must be available for the requested model, and provider preferences, guardrails, and other data-policy settings are evaluated as usual. The declaration only changes the retention classification. It does not add the private deployment to the ZDR routing pool of any organization without private access, and it does not affect the ZDR eligibility of the public endpoints for the same model.
  11. Added: Existing private endpoints keep their current classification. Introducing this setting did not bulk-migrate them, so a private endpoint created before the setting existed behaves exactly as it did. Editing its declaration applies the rules above, subject to the override precedence below.
  12. Added: Overrides and attestations An explicit OpenRouter data-policy override set by our team remains authoritative over your declaration. If OpenRouter has assigned a specific data policy to your private endpoint, that policy decides eligibility regardless of what you declared. A declaration is your attestation about your agreement with the upstream. OpenRouter records it and routes on it. It is not independent verification by OpenRouter of the upstream's contractual behavior.
  13. Removed: Existing private deployments keep their current classification. Introducing this setting did not bulk-migrate them, so a private deployment created before the setting existed behaves exactly as it did. Editing its declaration applies the rules above, subject to the override precedence below.
  14. Removed: Overrides and attestations An explicit OpenRouter data-policy override set by our team remains authoritative over your declaration. If OpenRouter has assigned a specific data policy to your private deployment, that policy decides eligibility regardless of what you declared. A declaration is your attestation about your agreement with the upstream. OpenRouter records it and routes on it. It is not independent verification by OpenRouter of the upstream's contractual behavior.
About this change
Page
openrouter.ai/docs/features/zdr
Kind
Documentation
Text hash
9ee7413d3ead to 1047f7d4c7fa
Dated by
the weekly check that first read the new text