What is Zero Data Retention and why does it matter for AI teams?
Boris Toledano
COO & Co-founder
Zero Data Retention means your queries and results are never stored once a request completes. Delivering that guarantee is less a matter of policy than of infrastructure: a provider can only promise that nothing is retained if it controls every system the query touches.
What Zero Data Retention actually means
Zero Data Retention (ZDR) means the provider keeps no record of your request after it returns a response. No query strings, no retrieved content, no user identifiers passed in the call. Nothing is written to disk, nothing is logged for analytics, nothing is retained for training.
The definition is narrower than it sounds, and the boundaries matter. Encryption does not solve retention: encrypted-at-rest data is still retained data. A deletion policy does not either, because a 30-day deletion window means 30 days of exposure. Anonymization falls short for the same reason — anonymized logs are still logs, and they still exist somewhere you cannot audit.
When a search query contains a customer name, an internal document reference, or a regulated identifier, the only fully safe posture is that the provider never held it at all.
Why AI teams ask about retention
For a team shipping AI to enterprise, retention maps directly onto obligations the team already carries. The queries an agent sends to a web search API can contain personal data, material non-public information, or protected health information, depending on the domain. Three pressures make this concrete.
The first is GDPR's data minimisation principle. Article 5 requires processing to be limited to what is necessary for the stated purpose, and a search sub-processor logging queries indefinitely is processing you did not authorize and cannot fully account for. The second is vendor risk assessment. Procurement teams at banks and consultancies ask early whether a sub-processor retains their data, and the answer determines how long the review takes — sometimes whether the deal survives it. The third is training reuse. If queries can be used to improve a provider's model or index, your prompt strategy and your customers' questions leave your control.
A top MENA bank with $75B+ in assets does not adopt an API that logs its analysts' research queries. Retention behavior decides whether a provider even enters the evaluation.
Why ZDR depends on owning the infrastructure
Most web search APIs do not run their own index. They relay each query to an upstream engine, collect the results, and return them. That architecture makes a true retention guarantee difficult: the moment a query payload leaves the provider's infrastructure, its fate is governed by someone else's systems and someone else's terms. The provider can commit to deleting its own logs. It cannot commit on behalf of the engine actually executing the search.
Linkup can offer ZDR because it operates its own search index and processing stack. Query handling stays within Linkup infrastructure end to end — there is no handoff of query payloads to third-party search providers for retrieval.
When ZDR is enabled, requests are processed in temporary computing environments where data is held only in memory during processing. Nothing is written to persistent storage. Once results are returned, the temporary data is destroyed and cannot be recovered. There is no log to delete, because none was created.
How ZDR works on Linkup
ZDR is available on demand for teams that need it. When enabled, two guarantees apply: search queries are not logged or stored on Linkup systems, and results are not retained after delivery to the client.
Because the entire retrieval pipeline runs on Linkup's own infrastructure, enabling ZDR is a configuration of that pipeline rather than a renegotiation with upstream vendors — which is what makes the guarantee auditable rather than aspirational.
ZDR and data residency are separate questions
Retention governs whether data persists. Residency governs where the live request is processed. Compliance teams usually need both answered, and conflating them causes confusion in reviews.
Linkup operates infrastructure in the US, EU, Canada, and APAC. By default, queries may be processed across these regions based on load allocation, and local processing is not guaranteed. Under enterprise agreements, Linkup can configure guaranteed local query processing in a specified geography, or multi-routing so that queries from different regions are processed locally according to regional requirements.
For an EU team with strict residency obligations, the combination is what matters: ZDR answers what persists after the request (nothing), while guaranteed EU processing answers where the request runs.
ZDR without trading accuracy or latency
ZDR is sometimes framed as a tradeoff — lock down the data and accept a weaker or slower service. In practice, retention policy and search quality are independent variables. ZDR changes where and how long data lives during a request. It does not change the retrieval pipeline producing the results.
Linkup scores 92% F-score on Verified SimpleQA, the highest among sub-second web search APIs, and its /research endpoint scores 61% on SealQA-0. The eval harness is open source at github.com/LinkupPlatform/eval-simpleQA, so the numbers can be reproduced independently — with or without ZDR in the picture.
How to verify a provider's ZDR claim
Before you put a web search API into production under a ZDR requirement, four questions separate a claim from a guarantee.
Ask who executes the search. If the provider relays queries to an upstream engine, its ZDR commitment ends at its own perimeter, whatever the marketing page says. Ask how the guarantee is implemented technically: in-memory processing with no persistent writes is something an architecture review can verify, while a promise to delete logs afterwards is a policy you have to take on faith. Ask for a signed DPA that names the retention terms explicitly, since verbal assurance is not auditable. And ask for the SOC 2 Type II report along with the full sub-processor list — Type II covers controls over time rather than a single snapshot, and the sub-processor list confirms no logging intermediary sits in the chain.
Linkup is SOC 2 Type II certified and GDPR compliant, and provides its DPA and SOC 2 report to teams under review.
When to request ZDR
ZDR is typically requested by organizations in regulated industries — finance, healthcare, legal — or by teams handling sensitive competitive intelligence, where even temporary storage raises compliance or confidentiality concerns.
If you are evaluating a Tavily alternative for compliance reasons, the useful comparison is architectural rather than promotional: who handles the query end to end, what the DPA commits to in writing, and whether the provider can prove the guarantee in an audit.
To request ZDR, book a call or contact contact@linkup.so for a DPA and SOC 2 report.
FAQ
What is Zero Data Retention in a web search API?
Zero Data Retention means the provider stores no record of your queries, retrieved content, or request metadata after returning a response. Nothing is logged, retained for training, or written to disk.
How do I enable Zero Data Retention on Linkup?
ZDR is available on demand. Once enabled, search queries are not logged or stored on Linkup systems, and results are not retained after delivery to the client. Contact contact@linkup.so or book a call to set it up.
Does Zero Data Retention reduce search accuracy?
No. Linkup processes ZDR requests through the same pipeline as standard requests.
Is Zero Data Retention required for GDPR compliance?
ZDR supports GDPR's data minimisation principle by ensuring a search sub-processor processes nothing beyond the live request. It shortens vendor risk assessments and removes a common point of failure in procurement.
Why can't every web search API offer true ZDR?
Providers that relay queries to third-party search engines only control retention on their own systems; the upstream engine's logging is outside their commitment. Linkup operates its own index and processing stack, so query payloads never leave its infrastructure — the condition that makes an end-to-end retention guarantee possible.
What is the difference between ZDR and data residency?
ZDR controls whether your data is stored after a request. Data residency controls where it is processed geographically. Linkup supports both independently.
