Adopting a decision model is easier to defend than adopting a generative one, because the architecture removes a whole category of data risk along with the output tokens. It does not remove all of it. Here is what the legal pages and the API reference establish, and where the remaining work is yours.
What the decision-only shape buys you
A generative model streams text, and that text is generated from your context with no schema. A Jev answer is a probability per option you defined. The model still sees your state, so this is not a privacy claim by itself — but there is no second channel through which your data can be reconstituted, no free-form output to leak, and no embedding of your content into a generated sentence. The attack surface for exfiltration is smaller because there is nothing to exfiltrate into.
Zero data retention is a documented, per-surface fact
The zero-data-retention entry is the relevant commitment, and it is worth verifying per surface rather than assuming. The Cloudflare Workers AI card for the third-party typesafe/jev model lists zero data retention explicitly. If you route through a gateway, the gateway's own retention terms apply in addition, so read both.
The legal set
TypeSafe publishes the expected set under /legal: terms, a master agreement, a privacy policy, an acceptable-use policy, and a data processing addendum. For a regulated deployment, the DPA is the document to start with, because it is the one that answers the questions your counsel will actually ask.
Residency and self-hosting
Whether you need data to stay in a jurisdiction decides the architecture more than any feature. Two paths avoid sending state to a hosted API at all:
- The local decision servers answer the same request shape on your own hardware, so the state never leaves your network. The serving locally article lists what still works when the base URL points at a local model.
- The open reimplementations let you run a decision model you downloaded, which changes the question from "the vendor's retention" to "your own."
Both trade hosted latency and calibration for control. The selection guide is the place to weigh that trade.
The part that is still on you
- Minimize the state. The best data-protection control is not sending the data. Send the fields a question judges, not the whole record — the same discipline the cost article recommends pays off here twice.
- Keep PII out of instructions. User text belongs in
state; the prompt-injection article explains why this is also a security boundary. - Log for audit, not for keeps. Store the state hash, the questions, the answers, and the model version so a decision can be reconstructed without storing raw content indefinitely.
- Pin the model version. A versioned model makes a decision reproducible; a floating alias does not.
What the decision-only advantage is not
It is not encryption, it is not on-prem by default, and it is not a substitute for a DPA. It is a smaller attack surface and a documented retention posture. Treat it as one control among several rather than the whole compliance story.
Verify retention per surface, use the DPA, minimize the state, and pin the version. The architecture helps; the checklist is still yours to run.