RFC 9111, published in June 2022, defines HTTP caching. This October briefing explains an established standard, not a newly announced rule. Its everyday buying implication is simple: a hosting dashboard that says no-cache has not necessarily promised that responses will never be stored.

For the unqualified response directive, no-cache requires successful validation before a stored response is reused. By contrast, no-store instructs caches not to store the request or response. MDN makes the same distinction. Treat freshness and storage as separate requirements when discussing an account page or customer dashboard with a provider.

The unqualified private response directive excludes shared caches, but permits storage in a private cache under the applicable rules. It is not encryption or an access-control system. Ask the provider how browser and CDN policies differ, which routes contain personalized data and how changes to those policies are verified.

For procurement, request a demonstration using representative public and authenticated pages rather than a single cache toggle. RFC 9111 explicitly warns that no-store alone is not sufficient to ensure privacy. This article is not an audit or a universal header prescription; assess authentication, transport security and application behavior separately.