Zero data retention means a speech provider processes audio and returns a transcript without keeping the audio, or any other customer content, once the request is complete. It is the most direct way to meet GDPR's storage limitation and data minimisation principles for voice data. The term has no legal definition, so what it covers varies by vendor: audio only, or audio and transcripts, and whether logs, backups and sub-processors are included.
Key takeaways
- "Zero retention" is a vendor commitment, not a regulated term. Read the contract to see whether it covers audio, transcripts, logs and backups.
- Content can persist in places nobody thinks of as storage: disk buffers, error traces, debugging samples, job queues and sub-processor systems.
- Retention and training are separate questions. A vendor can delete audio after 30 days and still have used it for training in the meantime.
- Some metadata is always kept for billing and security. That is compatible with zero retention of content.
- The trade-off is operational: the vendor cannot replay your audio to debug an error, so you must keep your own copy if you need one.
What zero retention means#
Under a zero-retention model, customer content exists on the provider's systems only while it is being processed. For streaming recognition, audio frames arrive over a WebSocket, sit in memory while the model decodes them, and are released as soon as the corresponding text has been emitted. Nothing is written to persistent storage. For batch transcription the picture is more complicated, because a job has to exist somewhere between upload and completion.
Retention of content is the question. Retention of metadata is normal and necessary: a request ID, the account, start and end times, audio duration and the credits consumed. None of that contains what was said.
The GDPR basis#
GDPR does not mention zero retention, but three provisions point towards it:
- Data minimisation, Article 5(1)(c). Personal data must be adequate, relevant and limited to what is necessary for the purpose.
- Storage limitation, Article 5(1)(e). Data must be kept in identifiable form no longer than necessary for the purposes for which it is processed.
- Data protection by design and by default, Article 25. Controllers must build these principles into processing, and by default only process the personal data necessary for each purpose.
For a transcription service, the purpose is to produce a transcript. Once the transcript has been delivered, the processor has no need for the audio. Keeping it creates a store of recordings that can be breached, subpoenaed or repurposed, and which the controller must account for in its records and its answers to access requests. A processor must also delete or return personal data at the end of the service under Article 28(3)(g); zero retention satisfies that by construction. See GDPR and voice data for why recordings are personal data in the first place.
Where content can persist#
A provider can honestly say it does not store audio in its database while content still survives elsewhere. These are the places to check.
| Location | What can end up there | What to ask |
|---|---|---|
| Batch job storage | Uploaded files, results awaiting collection | How long do files and results live? Is deletion automatic? |
| Application logs | Transcript snippets, request bodies | Are payloads ever logged, including at debug level? |
| Error reporting | Stack traces containing request data | Is content scrubbed before errors are sent to tooling? |
| Quality sampling | Audio kept for human review or evaluation | Is any content sampled, and is that opt-in? |
| Model training | Audio and transcripts used as training data | Is customer data ever used to train or tune models? |
| Backups and replicas | Copies of anything above | Are backups in scope of the deletion commitment? |
| Sub-processors | Content passed to hosting or analytics providers | Do sub-processors have the same retention terms? |
Retention and training are different questions#
A short retention window does not prevent training. Data kept for 30 days can be copied into a training set on day one. Conversely, a vendor could discard raw audio immediately but keep derived features or transcripts for model improvement. Ask the two questions separately: how long is content kept, and is it ever used to train, tune or evaluate models?
Trade-offs#
Zero retention has real operational costs, mostly borne by the customer.
- No replay for debugging. When a transcript contains an error, the vendor cannot retrieve the audio to investigate. You need to keep a copy and send it through a support channel you control.
- No reprocessing. If a better model ships, the vendor cannot re-run your archive. You resubmit it yourself.
- Batch clients must collect promptly. Results held for a short time must be fetched or delivered by webhook before they expire.
- Your own retention becomes the issue. Many organisations keep call recordings for legal or regulatory reasons. Zero retention at the vendor does not remove that obligation, and your own storage needs the same scrutiny.
Verifying a zero-retention claim#
You cannot inspect a vendor's memory, so verification rests on documents and audits:
- The commitment should appear in the data processing agreement or main contract, with its scope stated: audio, transcripts, or both.
- The sub-processor list should show which parties touch content, and the DPA should flow the same terms down to them.
- An independent certification such as ISO 27001 shows that controls exist and are audited, though it does not certify a specific retention period.
- For the highest assurance, on-premise or VPC deployment means content never reaches the vendor at all.
Pair retention with location. Audio held for zero seconds on a GPU outside the EEA has still been transferred; see EU data residency.
How Reson8 approaches this#
Reson8 does not retain customer audio, and customer data is not used to train its models. Processing runs on EU GPUs under a GDPR Article 28 data processing agreement, which is the place to check the exact scope of the commitment. Customers who need content to stay entirely within their own perimeter can use on-premise or VPC deployment on enterprise plans.
Common questions#
Does zero retention mean no logs at all?
No. Providers keep metadata such as request IDs, timestamps and usage for billing, abuse prevention and security monitoring. Zero retention means no audio or transcript content is kept, not that no record of the request exists.
Can I still get batch results later?
Usually for a short window, while results wait to be collected. Check how long that window is and whether results are deleted once fetched.
Is zero retention required by GDPR?
No. GDPR requires that data is kept no longer than necessary. Zero retention is one way to satisfy that for a processor whose only purpose is transcription.
If the vendor keeps nothing, do I need a DPA?
Yes. Processing audio for even a few seconds is processing personal data, and Article 28 requires a contract with the processor regardless of retention.
This article is general information, not legal advice.
References#
- Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 5, 25 and 28. EUR-Lex.
- European Data Protection Board. Guidelines 4/2019 on Article 25 Data Protection by Design and by Default (version 2.0, 2020). EDPB.
- ISO/IEC 27002:2022. Information security, cybersecurity and privacy protection: Information security controls. ISO.
- NIST Special Publication 800-88 Revision 1 (2014). Guidelines for Media Sanitization. NIST.