AI data retention

What actually happens to prompts, outputs, and intermediates sent to AI providers — the gap between retention mode and retention reality. Born 2026-10-18 from two captures: the AWS Bedrock contradiction and the two-types-of-AI-companies sign.

The Bedrock contradiction: mode “none” vs “flagged content” (2026-10-18)

apparentorder (3-tweet, 156❤/34.4k views, captured with links): AWS Bedrock’s data-retention mode “none” per its own docs — “Zero data retention. No request or response data is written to durable storage by AWS” (data-retention docs) — versus AWS’s own July 2026 security blog: “We may store and review flagged content … even when mode is none.” “Only one of these can be correct.” Third tweet: per the abuse-detection docs, Amazon “may also file a report with the National Center for Missing and Exploited Children (NCMEC) or a relevant authority” for flagged input or output.

The reconciliation nobody writes down: ZDR is a data-lifecycle promise about ordinary traffic, not a never-touches-disk guarantee — abuse-detection systems inspect content before the retention mode applies, flagged content exits the pipeline into human review (and possibly law enforcement), and “zero retention” coexists with “we store and review flagged content.” Both AWS statements are technically true at once; the contradiction is in the reader’s model of where ZDR sits. Ops consequences:

• ZDR ≠ confidentiality: a third party (abuse review) can read flagged content even in mode none; compliance docs promising “AWS never stores prompts” are wrong in the corner cases.
• The flag surface is opaque: what triggers flagging isn’t documented in the retention path — you can’t audit your own risk of entering the review queue.
• Policy scope includes outputs: a flagged output (something the model produced) triggers the same path — your liability isn’t limited to what you type.
• SCP-level enforcement of ZDR (the blog’s actual topic: Bedrock Projects + Service Control Policies) is the right control — but it enforces the mode, not the abuse-detection carve-out.

The sign: two types of AI companies (2026-10-18)

pjktech tapping the sign (@QuinnyPig lane; image vision-transcribed): “There are two types of AI companies: 1. those that tell you they are using your content 2. those that declare they are not, but are lying.” The cynical twin of the Bedrock finding: disclosure is the best case, and the floor is non-disclosure — there is no auditable third category. The trust question is never “do they retain” but “what can I verify, and what did the fine print carve out” — retention modes, training-use toggles, and abuse-review carve-outs all live in documents the vendor controls.

Doctrine (working)

1. Read the abuse/privacy policy as part of the retention mode — the mode is a component, not the system; the carve-outs (abuse detection, legal, safety) are where data actually leaks out of the promise.
2. Trust gradients: self-hosted (data plane entirely yours — Local LLM inference doctrine “local for everything you can”) > contractual ZDR with carve-outs (Bedrock class) > default retention + training-use (consumer tiers). Move workloads left as sensitivity rises.
3. For the sensitive middle tier, the mitigations that survive the carve-out: redact before send (PII redaction), classify content client-side, and keep the truly-unsendable local — the abuse-detection queue is unauditable, so don’t enter it.
4. Vendor sign vs architecture: the sign says every cloud AI reads your content; the only architectural answer is choosing which content reaches which provider at all.

Growing

• Do other providers document their abuse-review retention? (OpenAI/Anthropic/Google equivalents — same carve-out hunt.)
• Is there an audited/certified ZDR tier anywhere (e.g. government/health partitions) — or is it carve-outs all the way down?

Kin

• PII redaction — the client-side mitigation lane
• Local LLM inference — the “move left” lane; the doctrine line “local for everything you can, frontier where it still wins” gains a data-sovereignty reason on top of cost
• Uncensored models — the local-autonomy framing (“the refusal is someone else’s policy baked into your hardware”); retention is the same argument for data instead of behavior