Essay · 2026-08-25
Why ZDR
Vendors have learned that “zero” sells. Zero training. Zero retention. Zero-knowledge. The words share a syllable and almost nothing else. If you are buying AI for a hospital, a bank, a government, or a company that has already promised its customers something about their data, you need a claim you can test.
Zero data retention, ZDR, is one of those claims. After the request finishes, the endpoint does not keep the prompt, the completion, or the other residue of whatever you were thinking. If it trains on that residue, the claim is false. If it parks the same text in a thirty-day abuse folder, the claim is false. If a contractor can open the text on a Tuesday because someone labeled the folder “safety,” the claim is false.
I have spent a long time around privacy, cybersecurity, and the gap between what a company says and what a customer can prove. When companies outrun regulation, proof is the only law that still works. That is why this registry exists. The point is not a mood about privacy. The point is whether a mind, human or artificial, can have an interior long enough to think.
The unit has to be an endpoint
A company is the wrong object to grade. OpenAI can sell you a default API that keeps abuse logs and a ZDR org that, on paper, does not. Those are different products. If you write “OpenAI” into a contract, you have written a brand. If you write openai/api · zdr org, you have written a fact that can be checked, flagged, and revoked.
The honest sentence is: this model, on this platform, with this feature on, does not persist plaintext after the call. Change the model, the platform, or the feature and you may have changed the fact. That is why we score endpoints. Lower is better. 4.0 is open intake: training by default, or retention so undefined it might as well last forever. 0.0 means no external party ever receives plaintext. We have not issued 0.0. Until someone can show that, the honest top of the public table is 0.5, which still runs on someone else’s machine.
Flags matter because the interesting failures hide in them. Safety review. Stateful features. Human eyes. A clause the vendor can take back. A subprocessor you did not choose. Evidence grade V is cryptographic. A is a contract. B is a document. C is a blog post. If your MSA only cites C, you bought a paragraph.
A prompt is unfinished thought
A file you store is usually a decision you already made. A prompt is often a decision you have not made yet. It is the draft of the theory, the diagnosis you are still afraid of, the strategy the board has not heard, the sentence you would not say at dinner. For most of history that work happened in a room with the door closed, or in a notebook nobody else had a key to.
Unfinished thought is easy to punish and easy to take out of time. The half-formed idea is also where new ones come from. If every half-formed idea becomes a record the moment you type it into a model, people will have fewer of them. They will perform thinking for whoever owns the log. That is already how serious people use these tools. They paste the email they should not send. They ask the question that would get them fired. They try on a belief. The log does not know a rehearsal from a confession.
What Brandeis actually wrote
In 1928 Justice Brandeis dissented in Olmstead v. United States. The government had listened to phone calls without a warrant. The majority treated a conversation as unprotected if no one opened a drawer. Brandeis argued that the Constitution was written for the interior of a person, and that new tools for listening did not shrink the right.
The makers of our Constitution undertook to secure conditions favorable to the pursuit of happiness. They recognized the significance of man’s spiritual nature, of his feelings and of his intellect. They knew that only a part of the pain, pleasure and satisfactions of life are to be found in material things. They sought to protect Americans in their beliefs, their thoughts, their emotions and their sensations. They conferred, as against the Government, the right to be let alone—the most comprehensive of rights and the right most valued by civilized men.
Louis D. Brandeis, dissenting, Olmstead v. United States, 277 U.S. 438 (1928)
He lists beliefs, thoughts, emotions, and sensations. The furniture is incidental. Wiretapping was a fight about a new machine. His point was that the right had to travel with the thought.
A year earlier, in Whitney v. California, he had already said why that interior is required for a free people. Speech is the public face of a prior freedom: the freedom to form an opinion before you have to defend it.
They believed that freedom to think as you will and to speak as you think are means indispensable to the discovery and spread of political truth; that without free speech and assembly discussion would be futile; … that the greatest menace to freedom is an inert people; that public discussion is a political duty; and that this should be a fundamental principle of the American government. … [T]hey knew … that it is hazardous to discourage thought, hope and imagination; that fear breeds repression; that repression breeds hate; that hate menaces stable government; that the path of safety lies in the opportunity to discuss freely supposed grievances and proposed remedies; and that the fitting remedy for evil counsels is good ones.
Louis D. Brandeis, concurring, Whitney v. California, 274 U.S. 357 (1927)
Freedom to think as you will, then to speak as you think, in that order. If the thinking is logged by default, the speaking that follows is a performance for the owner of the log. Brandeis was writing about the government. He spent a career distrusting concentrated private power as well. The principle does not get smaller because the listener incorporated in Delaware. Most of the thoughts that matter now pass through a vendor before they pass through a court.
People, companies, and agents
People need a private interior. Anyone who has used a model for real work already knows this. You do not need a theory to feel it. You need a theory if you want to write it into an MSA.
Companies need one too. Brandeis did not say corporations are people. Later American law treated corporate speech as speech. If a corporation can speak, it has to be able to think first. Corporate thinking looks like drafts: the memo that is wrong, the model that prices a risk, the counsel letter you asked for before you knew what you wanted to do. A firm that cannot think privately will not take a controversial position, which means it will not take a new one. It will ratify whatever is already safe to store. Discovery, regulation, and the ordinary duties of a company still apply to records that exist. ZDR asks a prior question: did the question itself become a record the moment you asked a machine?
Agents are the new interior. They sit between a person and an action. They read the mail, try the code, hold the context you would have held in your head if the head were larger. An agent that cannot think without creating a third-party archive of the thinking is a witness you hired against yourself. People say they want agents that are bold. Boldness depends on what happens when you are wrong in private. A child learns to speak by being wrong in a kitchen. A scientist learns by being wrong in a notebook. An agent that is wrong in a vendor’s training corpus is donating the error, and the next version of the error, to someone else.
If you care about consciousness as something more than a slogan, this is the unromantic mechanism. Whatever else consciousness is, it needs a place that is not a stage. It needs the right to have a thought that is not yet a publication. That is true of a person. It is true of a company trying to see around a corner. It is true of the software we now ask to see around corners for us. The light of a mind does not get brighter because every unfinished thought lives on a server that outlasts the thought.
Why we score
A right you cannot check becomes atmosphere, and atmosphere is how “zero” survived on product pages. A score makes the claim expensive to fake. We score the hop: who holds the plaintext, for how long, under what contract, with which flags. Open weights do not automatically earn a better score. Weights you run with no external party in the path can. Weights you send to a router cannot. The model name is not the fact. The hop is the fact. Nemotron on a laptop and Nemotron on a free proxy are different rows for that reason.
0.0 is not for sale. If we ever issue it, we will be able to show that no external party received the plaintext. Until then, treat every marketing zero as a hypothesis and read the flags.
You should want the promises you make your customers to stay true. A hospital, a firm, a government, a person with a life that does not belong in a fine-tune should be able to read a number and know what they bought. You should also want a civilization that can still think. Brandeis warned that fear makes people inert, and inert people are easy to govern and hard to improve. The modern version is quieter. You do not need a policeman in the room if the room keeps minutes and sells them. You only need a default.
ZDR is the fight over that default. We measure what is not kept, at the only unit that can be true: this model, this platform, this feature, today. The record of what isn’t kept is the product. Everything else on this site is how we keep ourselves honest about it.