Skip to content
Puccha Puccha KM

Anthropic — Zero Data Retention addendum

  • Counterparty: Anthropic, PBC
  • Scope: Zero Data Retention addendum on the existing Enterprise agreement, covering all API calls (text + vision) made via the API key bound to our AI Gateway. Anthropic does not retain input prompts, attached images, or model outputs beyond the inference round-trip; the default 30-day abuse-monitoring retention window does not apply.
  • Signed: 2026-05-09
  • Expiry: Annual auto-renew with parent Enterprise agreement (review window: 30 days before renewal)
  • Executed PDF location: legal-document store (not this repo) — file ID recorded with counsel.

What this unblocks

Section titled “What this unblocks”
  • ADR-0043 phase 1 vision pass-through for non-sensitive uploads. Without ZDR, image bytes could sit on Anthropic’s side for up to 30 days under the default abuse-monitoring policy. With ZDR, the residual on DPIA risk R1 (“ID card bytes leak via Anthropic-side retention”) drops from “Medium without ZDR” to Low.
  • Default retention claims in the DPA template §6 and DPIA §1.5 for the Anthropic row. Both have been updated to cite the signed addendum.

What this does NOT change

Section titled “What this does NOT change”
  • Sensitive-data classifier (ADR-0043 PR-4) still routes ID-card / face / payment-card images agent-only, bypassing vision entirely. Defence in depth — ZDR removes one risk layer, the classifier removes another.
  • Anthropic’s safety filters and abuse-detection systems still run on inference-time inputs. ZDR concerns retention, not transient processing.
  • Tenant-side opt-out for AI vision (widget_config.attachments.aiVision = false, future flag) remains the right tool for tenants in regulated industries who want to keep the inference path cold entirely.

Renewal action

Section titled “Renewal action”

The org admin owns the renewal cycle. 30 days before annual renewal:

  1. Confirm Anthropic has not modified the ZDR clause in the Enterprise master agreement.
  2. Re-sign the addendum if requested by Anthropic legal.
  3. Update the Signed date in this file.
  4. Update DPA §6, DPIA §1.5, and ADR-0043 §"Sub-processors" if any clause text changed.

If the addendum lapses without renewal, the engineering action is immediate disable of vision pass-through (set widget_config.attachments.aiVision = false per tenant or globally) until ZDR is restored. See docs/security/runbooks/attachment-breach.md for the broader incident response path.