Your Data, Your Alpha: Retention and Routing for Generative AI on ServiceNow

sachinbhasin11 · an hour ago

Sovereignty is your alpha

Your organization's edge lives in its data: the incidents you have resolved, the changes you have approved, the way your teams actually get work done. Generative AI can turn that history into faster, smarter workflows. It can also quietly move that knowledge outside your walls.

Many teams assume these decisions are made for them by whichever AI vendor they picked. They are not. You have real choices about where your data goes, how long it stays there, and who can learn from it.

This is the first post in a three-part series on keeping control of your data as you scale AI on ServiceNow. It answers two questions: what happens to a prompt after you send it, and which workloads should send one at all.

What zero data retention actually means

Zero data retention (ZDR) means your prompts, outputs and related telemetry are processed in memory and then discarded. Nothing is kept beyond what is needed to answer the request. In practice, ZDR gives you three guarantees:

Your data is not written to disk.
Your data is not used to train models.
No human at the provider can look at your data.

Most enterprise AI contracts already promise the second and third points. ZDR adds the first, and that is the one that matters most. Data that was never stored cannot be misused later.

Why a contract alone is not enough

A promise not to misuse stored data is only as strong as its wording, and wording changes. Usage policies get revised. Terms get reinterpreted. Data collected under one policy can sit on disk long enough to fall under the next one.

Litigation is the clearest example. Standard data-deletion clauses often carve out an exception for data a provider is legally required to keep. If your prompts are stored, they can be swept into discovery in a lawsuit you are not even part of. If they were never stored, there is nothing to discover.

That is the difference between contractual assurance and structural assurance. One asks you to trust a promise. The other removes the thing that needs protecting.

The gaps ZDR can leave open

ZDR is necessary, but it is not sufficient. How it is defined matters, and three gaps come up again and again:

Derived metadata. Some ZDR terms cover your content but not data derived from it, such as safety classifier scores or usage logs. That metadata can persist long after the prompt is gone.
Monitoring and abuse logs. Providers may keep logs for trust-and-safety purposes. Check whether those logs contain content, how long they are kept, and whether humans can read them as a matter of routine.
Personal accounts. ZDR covers only the traffic that goes through your negotiated channel. An employee pasting a ticket into a consumer chatbot is outside every agreement you have signed.

ZDR is also negotiated provider by provider. Each new model you add means a new agreement to check, which creates a pull toward consolidating on one provider. Resist that pull. Your leverage depends on being able to walk away, which is the subject of post 2.

What this means on ServiceNow

ServiceNow publishes a user data usage policy for its generative AI features. In the Zurich release documentation, it answers several of the questions above directly. Use it as your starting point, and confirm the details for your own release and contract.

Question to ask	What ServiceNow's documentation says (Zurich)
Is my prompt stored after processing?	Workloads go over TLS 1.2 to centralized compute hubs. Input and output data is described as transient, not cached or stored, and deleted once the response is generated.
Is my data mixed with other customers' data?	No commingling, including for domain-separated instances.
Do third-party models see my data?	Third-party endpoints such as Azure OpenAI may be used, operated within ServiceNow's network boundary and under the same policies.
Is my data used to improve models?	Yes, through a data-sharing program, unless you opt out from the Now Assist Admin console.
Can I keep sensitive values out of prompts?	Yes, with the Now Assist for Data Privacy plugin, which masks sensitive data before it reaches the LLM, at some cost to accuracy.
Can AI see records a user cannot?	Retrieval features such as AI Search send only content the requesting user can access.

Two points deserve attention. First, the data-sharing opt-out is a decision, not a default. If your organization treats its operational history as a strategic asset, decide deliberately whether to stay in. Second, access-aware retrieval protects records, but people can still leak what they see. ServiceNow's own guidance warns that an agent with broad permissions who pastes an AI summary into work notes may expose data to others on that record.

Route each workload by sensitivity

Retention terms protect data once it reaches a model. The next question is whether it should reach one, and which one. A password-reset summary and an employee relations case should not travel the same path, even on the same platform. Before any AI use case goes live, ask three questions in order.

1. Does it need a model at all?

The safest prompt is the one you never send. Many requests labelled as AI are really rules: route by category, assign by group, fill a field from a lookup. A flow, business rule or decision table handles these predictably, cheaply, and with nothing leaving the instance. Use generative AI where the work genuinely needs language understanding, such as summarizing a long case or drafting a resolution note.

2. Is your governance layer ready?

Check the controls around the model before the model itself. You should be able to answer yes to each of these:

Can you switch the underlying model without rebuilding the use case?
Does the AI see only what the requesting user can see?
Is every AI action, and the data it touched, logged?
Is the knowledge the AI relies on held in your platform, not in the model?

A "no" does not block the use case. It limits it: keep a human in the loop, with AI suggesting rather than acting, until the gap is closed. The next two posts cover model switching and platform knowledge in depth.

3. How sensitive is the data?

Match each class of data to the weakest tier of assurance that still protects it adequately.

Tier	Assurance	What it looks like	Suited to
1. Isolated	Structural	Models run on infrastructure you control, with no outbound path	Classified data, core trade secrets
2. Verified	Structural	Rented compute that proves, through hardware attestation, the workload ran in a sealed enclave	Highly sensitive workflows
3. Zero retention	Contractual	A hosted model under ZDR terms that cover content and derived metadata	Day-to-day internal and regulated work
4. Standard	Contractual	Default API or consumer access; assume prompts may be retained	Public information only

For most ServiceNow customers, the practical choices sit in tiers 3 and 4. Tiers 1 and 2 matter mainly in regulated, sovereign or self-hosted environments, where some generative AI features may not be available at all. Knowing that early saves rework.

Putting it together

Here is how the three questions might route some common requests. Your own data classification will change the answers, so treat these as examples.

Use case	Needs a model?	Data class	Where it lands
Auto-assign incidents by category	No	Internal	A flow or assignment rule
Summarize a standard IT incident	Yes	Internal	Hosted model, zero retention, sensitive fields masked
Draft a knowledge article from resolved cases	Yes	Internal	Hosted model, human review before publishing
Summarize an employee relations case	Yes	Highly sensitive	Strongest tier available, human in the loop, or not at all
Answer questions from public product docs	Yes	Public	Any approved model

Run this triage as part of your AI intake process, and record the answers on the request so the decision can be audited later.

A quick checklist

Read the data usage policy for your current release, and the data handling KBs it links to.
Decide deliberately whether to stay in or opt out of the data-sharing program.
Enable Now Assist for Data Privacy for fields that should never reach a model.
For any external LLM, confirm in writing whether derived metadata and safety logs are retained.
Set a policy on personal AI accounts, and offer a sanctioned alternative.
Add the three routing questions to your AI intake process, and record the answers.

Zero retention and sensible routing are the foundation, not the finish line. In the next post, we look at why the ability to switch models is one of your strongest negotiating positions.