Which LLM APIs don't train on your prompts, and which keep them?
Most paid LLM APIs don't train on your prompts by default, including OpenAI, Anthropic, Gemini's paid tier, Azure OpenAI, Amazon Bedrock and OpenRouter. Gemini's unpaid tier, Claude's consumer plans, Copilot's individual plans and Cursor without Privacy Mode can train unless you opt out. Many keep prompts for 30 to 55 days unless you get zero data retention.
Training and retention, API by API
| API or tool | Trains on your prompts? | Keeps prompts | Zero-retention option | Region choice | Sources |
|---|---|---|---|---|---|
| Standard Compute (us) | No | Not stored or logged | Required at the provider on keys with a Compliance rule | Europe, US or both, per key, team or company | Data and privacy · Regions docs |
| OpenAI API | No. Opt-in only | Up to 30 days | On approval | US, Europe and more, per project. Non-US needs approval | Your data · Data residency |
| Anthropic API | No | Up to 30 days | Through sales. Not for Fable or Mythos | US or global | Data retention · Inference geo |
| Claude Free, Pro and Max | Yes, unless you turn the setting off | Up to 5 years with training on, else 30 days | Not offered | Not published | Consumer terms update · Consumer terms |
| Google Gemini API | Paid: no. Unpaid: yes, except in the EEA, Switzerland and UK | Up to 55 days | Not offered. Google points to Vertex AI | Not offered | Terms · Retention · Zero retention |
| Mistral API | Free: yes, unless you opt out. Paid: opt-out toggle, default not stated | Up to 30 days | On approval, pay-as-you-go only | EU, or US if you choose it | Training · Commercial terms · Zero retention · Hosting |
| DeepSeek API | Allowed by its privacy policy. Opt out by email | No fixed period | Not offered | Not offered. Stored in China | Privacy policy · API terms |
| xAI API | No | Up to 30 days | Self-serve setting | US endpoint, some models, 10% more | Security FAQ · Regions |
| OpenRouter | No. A setting excludes providers that train | Not by default | Self-serve setting, or per request | EU or US on Business and Enterprise | Privacy policy · Zero retention · Provider policies |
| Together AI | No | Yes, until you delete it. No period published | Self-serve setting, off by default | Dedicated endpoints only | Privacy · Zero retention |
| Fireworks AI | No | Not by default. Open models | Default for open models | US-only at 1.5x price. EU through sales | Data handling · US-only serverless |
| Groq | No | Not by default. Debug logs up to 30 days | Self-serve setting | Enterprise only | Your data · Services agreement |
| Cerebras | No | Not by default | Default | Enterprise only | Privacy policy · Terms |
| Azure OpenAI | No | Flagged prompts. No period published | On approval | Your region, or EU or US Data Zone | Data privacy · Abuse monitoring |
| Amazon Bedrock | No | Per retention mode. Up to 30 days for some models | Self-serve setting | Your AWS Region, or US, EU or APAC | FAQ · Retention modes · Exceptions |
| GitHub Copilot | Individual plans: yes, unless you opt out. Business: no | Business: 28 days outside the IDE. Individual: not published | Not offered | Data residency for Business and Enterprise | Training setting · Plans · Data residency |
| Cursor | Yes, unless Privacy Mode is on | Privacy Mode: none at providers, some models excepted | Privacy Mode. Default for Enterprise | US-only for Enterprise | Data use · Privacy Mode · Regions |
Read on each vendor's own page on October 14, 2026. "Not published" means we could not find it on the vendor's pages. Linked names open the full record in our provider directory. Claude's consumer row covers Claude Code on those logins. ChatGPT is left out because OpenAI's consumer pages could not be read for this check. Spot an error? Write to contact@standardcompute.com.
What to check before you send code to an API
- Which terms cover you. Claude Code on a Pro or Max login follows Claude's consumer terms; on an API key, the commercial terms.
- The training default. Find the switch: an account setting, an email to the vendor, or Privacy Mode.
- The retention period. Check whether zero retention is a setting, an approval or an enterprise contract.
- Every hop. A gateway's no-training promise doesn't cover the provider it sends your request to.
- The inference region, if a contract or client NDA names one.
- What the agent sends. Keep .env files and keys out of its context with the agent's ignore file.
The catch
Zero data retention is narrower than it sounds. Providers' zero-retention terms can still allow short-lived prompt caches. Stateful features such as stored responses, files and batch jobs usually fall outside them. Some frontier models, including Claude Fable on Anthropic and Bedrock, require 30-day retention. If your contract rules out retention, check the exact model and endpoint you call.
Where Standard Compute fits
Standard Compute is built to make coding agents cost less: each request goes to the most efficient model that can do it, under one monthly plan from $19 (USD) with a fixed compute budget. For company code, an opt-in Compliance rule keeps a key, a team or the whole company on provider endpoints in Europe, the United States or both, with zero data retention and no training required at the provider. We don't train on your prompts or store them.
FAQ
Does the OpenAI API train on my data?
No, not by default. Since March 1, 2023, OpenAI only trains on API data you choose to share. It keeps API traffic in abuse monitoring logs for up to 30 days. Zero data retention needs OpenAI's approval, covers eligible endpoints only and excludes stateful features such as Assistants.
Does Claude Code train on my code?
It depends on how you sign in. With a Claude Free, Pro or Max login, Anthropic's consumer terms apply: it trains on your sessions when the model-training setting is on, and keeps that data for up to five years, or 30 days with the setting off. With an Anthropic API key, the commercial terms apply: no training, and deletion within 30 days.
Does GitHub Copilot use my code to train its models?
On Copilot Free, Pro, Pro+ and Max, GitHub may use your inputs, outputs and code snippets for training since April 24, 2026, unless you set "Allow GitHub to use my data for AI model training" to Disabled. GitHub does not train on Copilot Business or Enterprise data.
Is Cursor's Privacy Mode on by default?
It is on by default for Enterprise teams, and admins can enforce it. With Privacy Mode on, Cursor says it doesn't train on your data and has zero-retention agreements with its model providers; with it off, it may store and train on prompts and code. Zero retention doesn't apply when you use your own API keys.
Does the DeepSeek API use my prompts for training?
It isn't ruled out. DeepSeek's API terms have no training clause and send personal data to its privacy policy, which allows using prompts to train models, with opt-out by emailing privacy@deepseek.com. Data is stored in China, with no zero-retention option and no fixed retention period published.
What is zero data retention, and how do I get it?
Zero data retention (ZDR) means the provider doesn't store prompts or responses after answering. Cerebras and Fireworks (for open models) work that way by default, Groq and xAI have a self-serve setting, Bedrock a retention mode, and OpenAI, Anthropic, Mistral and Azure grant it on approval. On OpenRouter you can turn on ZDR for the account or per request.
Does Standard Compute train on my prompts or store them?
No. We don't train on prompts or responses, and they pass through our gateway in memory without being stored or logged. Keys under a Compliance rule only reach provider endpoints with zero data retention and no training; without a rule, each provider's own terms apply. One exception for routed requests on keys without a rule: the router's short note on its choice, up to 120 characters, is kept in routing logs and can quote the prompt.
Which LLM API should a company use for proprietary code?
One whose terms rule out training and that offers zero retention you can actually turn on: Bedrock's none mode, Groq's toggle, or an approved ZDR agreement with OpenAI or Anthropic. Through a gateway, check that it forces the same at the provider. On Standard Compute that is a Compliance rule on the company, which also keeps inference in Europe or the United States.