seo.pages.zero-data-retention.title

Zero Data Retention Policy

Last Updated: June 2026

Your data is never stored. We process it. We return the result. We discard everything.

This Zero Data Retention Policy ("Policy") describes how Atlas Cloud AI Inc. ("Atlas") handles data submitted to its AI services. This Policy applies to all Atlas services regardless of the underlying model or infrastructure used to deliver them.

This Policy should be read together with the Atlas Privacy Policy, Data Deletion and Account Termination Policy, and, where applicable, the Atlas Data Processing Addendum and Zero Data Retention Addendum.

1. What Zero Data Retention Means

Atlas operates all services under a Zero Data Retention ("ZDR") standard. This means:

No Storage

Customer Content is processed in transient, in-memory environments and discarded immediately after each API response. It is never written to disk.

No Training

Your prompts and outputs are never used to train, fine-tune, evaluate, or benchmark any AI model — by Atlas or any service provider.

No Logging

Prompt text, completion text, and embeddings are never written to logs, analytics systems, data warehouses, or any other persistent store.

This commitment applies uniformly across all Atlas services. No distinction is made between Atlas's own infrastructure and infrastructure operated by service providers engaged to deliver the services. The ZDR standard holds regardless of which model processes your request.

2. What We Do Retain

To operate the platform, process billing, and maintain security, Atlas retains a minimal set of operational metadata. This metadata does not contain any fragment, derivative, or representation of your prompts or AI-generated outputs.

2.1 Operational Metadata (Retained)

The following metadata is retained solely for billing accuracy, security monitoring, and service reliability:

Request timestamp (UTC)
API endpoint identifier
Token counts (input and output)
Account identifier (pseudonymised)
HTTP status code and latency metrics

2.2 Account and Billing Information (Retained)

Atlas retains account information (name, email, credentials) and billing records (transaction history, invoices, tax data) for as long as your account is active and as required by applicable law thereafter. This information is subject to your deletion rights under the Atlas Data Deletion and Account Termination Policy.

2.3 Security Identifiers (Retained)

To prevent fraud and platform abuse, Atlas may retain cryptographically hashed versions of certain identifiers (such as hashed email addresses) for security blocklist purposes only. These hashed identifiers cannot be used to reconstruct personal information.

2.4 Backup Systems

Deleted account data may persist in Atlas's encrypted offline backup systems for up to sixty (60) days until the next scheduled overwrite cycle. During this period, such data is placed beyond use and is not processed for any commercial or operational purpose.

Because Customer Content is never written to any persistent storage medium, it is not captured by Atlas's backup systems and is therefore not subject to any backup retention period. The sixty (60) day backup window applies solely to account data, billing records, and other operational data that Atlas retains in connection with account management.

Data Type	How Long We Keep It	Notes
Prompts & AI outputs	Never stored — discarded after API response	Not subject to deletion requests — already discarded
Operational metadata	Minimum period for billing & security	No prompt or output content included
Account & contact info	While account is active	Deleted / anonymised within 30 days of request
Billing & tax records	As required by law	Legal obligation — not deletable on request
Security identifiers	As needed for security	Hashed only — cannot reconstruct personal data
Backup copies	Up to 60 days	Beyond use — overwritten at next cycle

3. How We Verify This

3.1 Technical Architecture

Atlas enforces ZDR through architectural controls, not just policy:

API inference workloads run in stateless, ephemeral compute containers with no persistent volume mounts;
network segmentation prevents inference nodes from writing to external databases or object storage;
all inter-service communication is encrypted in transit;
access to operational metadata logs is restricted to authorised personnel via role-based access control and multi-factor authentication.

3.2 Annual Audits

Atlas conducts, at minimum on an annual basis:

internal technical audits to verify that no Customer Content is written to persistent storage;
third-party penetration testing of API infrastructure with specific focus on data exfiltration vectors;
review of service provider arrangements to confirm alignment with ZDR requirements.

3.3 Certifications

SOC 2 Type II

Annual third-party audit. Report available on request (NDA required). 2026 audit currently in progress.

HIPAA Compliant

Business Associate Agreement (BAA) available for healthcare customers submitting Protected Health Information.

Annual Attestation

Enterprise customers may request a written ZDR compliance attestation once per calendar year.

4. Enterprise Customers

Enterprise customers may execute additional agreements with Atlas that govern data handling in more detail:

Data Processing Addendum (DPA)Governs Atlas's role as a data Processor under GDPR, UK GDPR, and equivalent laws.
Zero Data Retention AddendumProvides contractually binding ZDR commitments, audit rights, and incident response obligations. Takes precedence over this Policy.

To request any of the above agreements, please contact: [email protected]

5. Sensitive Data

Atlas does not process sensitive categories of personal data (such as health data, biometric data, or financial account data) by default.

If you intend to submit such data to the Services:

you must ensure you have a valid legal basis to do so under applicable law;
payment card data (PCI DSS) must not be submitted to the Services;
enterprise customers with specific sensitive data requirements should contact us to discuss additional safeguards.

6. Incidents

In the event of a confirmed or suspected incident involving unintended retention or exposure of Customer Content, Atlas will:

isolate affected systems within one (1) hour of confirmed detection;
notify affected enterprise customers within forty-eight (48) hours;
deliver a written root cause analysis within fourteen (14) business days;
implement remedial technical controls before resuming affected services.

Incident response for enterprise customers is further governed by the applicable DPA and ZDR Addendum.

7. Updates to This Policy

Atlas may update this Policy from time to time to reflect changes in applicable law, services, or data handling practices. Material changes will be communicated via email or through a notice on the Atlas platform prior to taking effect. The effective date of the current version is shown at the top of this page.

8. Contact

For questions about this Policy, data handling practices, or to request enterprise agreements:

Privacy enquiries: [email protected]
Enterprise agreements (DPA / ZDR Addendum): [email protected]

Uma API para toda a IA de mídia.

Join our Discord community