October 27 policy catch-up
OpenRouter says it will screen inference requests in flight for child sexual abuse material, including Zero Data Retention (ZDR) traffic. Suspected content may be retained for human review, reporting, and related preservation. A flag is not a determination that the material is CSAM. [1]
What the exception does and does not say
The notice limits this exception to that review and related duties; it does not authorize general unrelated retention. OpenRouter says its no-training commitment continues. Other model providers can apply different practices. [1]
The announcement uses prospective wording. The explainer, updated October 27, describes the exception in current documentation. Neither establishes the precise rollout hour or enforcement for a particular account. We did not test either. [1][2]
ZDR is one part of the data path
The explainer separates inference-provider retention from gateway logging, request metadata, application logs, tools, and other storage. No-training and no-retention are different controls. A setting for one layer does not establish that every copy elsewhere disappears. [2]
Our take
For a workplace workflow, map where a prompt travels before using real customer material: the application, gateway, selected endpoint, and any connected tools. Read the exception and decide which records your own software keeps. A short privacy label becomes useful when the people operating the workflow understand its boundary.
This is a report on the vendor’s public policy language. It is not a finding about a request, an inspection of a customer account, or a legal assessment.