Vercel AI Gateway

The gateway deletes content after each request, but upstream retention and non-enterprise protections depend on route controls and provider terms.

Plan Scope

Vercel AI Gateway; provider-side retention and training depend on routing controls, provider agreements, plan, and BYOK configuration.

Prompt Retention

Vercel states the gateway layer deletes prompts, outputs, and sensitive data after a request completes. Provider-side retention is separate unless zero-data-retention routing is enabled.

Response Retention

Same gateway-layer deletion policy as prompts; final providers may apply separate retention.

Ordinary Logging

Usage, spend, request volume, model, provider, project, token counts, and performance metadata are available for observability; prompt-content logging is not described as part of ordinary gateway telemetry.

Model Training

A no-prompt-training routing control is available on all plans. Enterprise terms separately warrant that AI Gateway Customer Content is not used to train or improve Vercel AI products; other plans must enforce provider controls.

Product Improvement

Enterprise AI Gateway content receives an express no-training and no-improvement commitment. Non-enterprise handling depends on AI Product Terms and configured provider-routing controls.

Human Or Operator Access

The gateway claims immediate content deletion after request completion; the selected provider still processes content under its own terms.

Subprocessors And Routing

Requests go to selected third-party AI providers. Team or request-level ZDR routes only to providers covered by negotiated ZDR agreements; BYOK agreements remain the customer's responsibility.

Deletion Controls

Gateway content is described as deleted after completion. Provider-side ZDR is available per request on Pro and Enterprise or team-wide as a paid control; no-training filtering is available on all plans.

Caveat

Enabling ZDR or no-training is not the same as the default behavior of every provider route. BYOK credentials are skipped under ZDR unless the customer marks its own contract compliant.