AI Tools
How to Read an AI Provider's Data Terms in 15 Minutes
A practical companion to our piece on why the "data leak" fear is a category error. That one makes the argument. This one hands you the method.
Most teams evaluate AI privacy on vibes. They read a headline, feel uneasy, and quietly shelve the project. You don't have to. A provider's data terms are public, and you can read the parts that matter in about fifteen minutes — if you know which questions to ask and where the answers live.
Here's the method we use with clients.
Step 0: Establish the Tier Before Anything Else
Before you read a single policy, answer one question: which tier are you evaluating — consumer/free, or enterprise/API? This is the distinction that decides almost everything, and it's the one most people skip.
Consumer products (ChatGPT Free/Plus, Claude Free/Pro/Max, the Gemini app, consumer Meta AI) generally use your interactions to improve models by default, and come with no Data Processing Agreement. Enterprise and API products (the OpenAI API, Azure OpenAI, the Anthropic API and Claude for Work, Google Vertex AI, Amazon Bedrock) flip that default. If you read a consumer privacy policy and conclude "AI trains on your data," you've answered a question you weren't asking. Read the terms for the tier you'd actually deploy.
One trap here: app-layer and agent tools (think coding assistants or desktop agents) usually don't have their own data terms. They inherit the terms of the plan they run under. The same tool can sit on either side of the line depending on whether it's on a consumer plan or on the API/Enterprise plan. Always trace it back to the account it runs on.
The Five Questions
For the enterprise/API tier of any provider, get answers to these five. Each maps to a specific place in the provider's documentation.
1. Does It Train on Your Data by Default?
Look in the enterprise privacy page or the service-specific terms. You want an explicit statement that customer inputs and outputs are not used to train foundation models by default. Across the major providers today, the answer is no — OpenAI (since 2023), Anthropic (commercial terms), Google (Service Specific Terms §17), Microsoft Azure, AWS Bedrock, and Meta's Llama models (run via a cloud host) all state this for their enterprise/API offerings.
2. How Long Is Data Retained — and Can It Be Zero?
Find the retention window and whether Zero Data Retention (ZDR) is available. The common default is up to ~30 days for abuse monitoring, then deletion. Several providers offer ZDR for eligible endpoints (note the exceptions — Anthropic excludes certain "Covered Models"). Shorter is better; zero is best where your use case allows it.
3. Where Is Your Data Processed and Stored?
Check the data-residency documentation. If you have GDPR or jurisdictional requirements, confirm the provider offers in-region storage and processing — most now do across US and EU, some far more broadly. Anthropic is a useful edge case: its API runs on US infrastructure by default, with guaranteed EU residency available via AWS Bedrock EU or Google Vertex EU.
4. What's Contractual?
Look for a Data Processing Agreement (DPA) and, if you handle health data, a HIPAA Business Associate Agreement (BAA). "No training by default" is only as strong as the contract behind it. Every major enterprise provider offers a DPA; most offer a BAA.
5. What's Independently Audited?
Find the trust center and note the third-party attestations: SOC 2 Type 2 at minimum, often ISO 27001, and FedRAMP for public-sector work. These are the difference between a marketing claim and a verified control.
What a Quick Pass Looks Like
Run those five questions across the major enterprise/API tiers today and the picture is consistent: no training by default, ~30-day-or-less retention with ZDR options, DPAs and BAAs available, and SOC 2 (plus more) on the trust center. The differences are at the margins — how broad the residency options are, which endpoints support ZDR, whether there's a consumer tier at all (Bedrock has none). None of the major providers fails the basic bar.
Here's that pass laid out across the major providers and their tiers. Read down the "trains by default" column and the tier line does the arguing for you — every enterprise/API row says no; the fear lives on the consumer rows.
Consumer / Free Tier
| Provider | Product | Trains on your data by default? | Retention | Data residency | Compliance / contracts |
|---|---|---|---|---|---|
| OpenAI | ChatGPT Free / Plus | Yes — used to improve models by default unless the user opts out (Settings → Data Controls) | Deleted chats removed within 30 days; otherwise retained per consumer policy | Not offered | Consumer Privacy Policy; no DPA/BAA |
| Anthropic | Claude Free / Pro / Max (incl. Claude Code & Cowork on these plans) | Yes — under the 2025 consumer terms, chats/coding sessions used for training unless the user opts out | If training allowed: up to 5 yrs; if opted out: 30 days | US infrastructure by default | Consumer terms; no DPA by default |
| Gemini app (gemini.google.com) | Yes — human-reviewed samples may be used to improve models | Retained per Gemini Apps Activity (on by default); opt out to reduce retention/review | Not offered | Consumer Privacy Policy; controls via Gemini Apps Activity | |
| Meta | Meta AI (Facebook / Instagram / WhatsApp) | Yes — interactions and adult public posts used to train Meta's models (opt-out only; EU rollout began 2025-05-27) | Retained per consumer policy | Not offered | Consumer terms |
Enterprise / API Tier
| Provider | Product | Trains on your data by default? | Retention | Data residency | Compliance / contracts |
|---|---|---|---|---|---|
| OpenAI | OpenAI API Platform | No — API data not used for training by default (since 2023-03-01); fine-tuned models stay private to you | Up to 30 days for abuse monitoring, then deleted; ZDR for eligible endpoints; fine-tune files kept until you delete them | Regional residency across US, Europe (EEA+CH), UK, Canada, Japan, S. Korea, Singapore, India, Australia, UAE; in-region GPU inference US/EU | SOC 2 Type 2; HIPAA BAA; GDPR DPA; AES-256 at rest, TLS 1.2+ |
| OpenAI | ChatGPT Enterprise / Edu / Healthcare | No — not trained on by default | Admin-controlled; deleted conversations removed within 30 days | Data + inference residency (in-region storage; in-region inference US/EU) | SOC 2 Type 2; GDPR DPA; BAA (Healthcare), Student Data Privacy Agreement (Edu) |
| OpenAI | ChatGPT Business | No — not trained on by default | Admin-controlled; deleted/unsaved conversations removed within 30 days | Covered by OpenAI regional residency where eligible | SOC 2 Type 2; GDPR DPA |
| Anthropic | Anthropic API (Claude API) | No — commercial inputs/outputs not used for training by default | Up to 30 days default; ZDR available (not for "Covered Models," which require 30-day retention); submitted feedback kept up to 5 yrs | US infrastructure by default; guaranteed EU residency only via AWS Bedrock EU or Google Vertex EU | SOC 2, HIPAA, GDPR via Trust Center; DPA + ZDR agreements |
| Anthropic | Claude for Work (Team & Enterprise) | No — commercial terms; not trained on by default | Thumbs-up/down feedback kept up to 5 yrs; owners can disable feedback | US infrastructure by default | SOC 2, HIPAA, GDPR; DPA available |
| Vertex AI / Gemini API (Google Cloud) | No — customer data not used to train/fine-tune foundation models without permission (Service Specific Terms §17) | ZDR available for Gemini on Vertex; otherwise per configuration | At-rest + ML-processing residency in US and EU via regional/jurisdictional endpoints; global endpoint may process anywhere | SOC 2 Type II, SOC 3, ISO 27001/27017/27018/27701/42001, HIPAA BAA, FedRAMP High; Google Cloud DPA (GDPR) | |
| Microsoft | Azure OpenAI / Foundry Models | No — prompts, completions, embeddings and training data not used to train Microsoft/OpenAI/third-party models, nor shared with providers | Abuse-monitoring store up to 30 days; "modified abuse monitoring" / ZDR on approval; models are stateless | Processing in customer-designated Azure geography; DataZone (US or EU) and Global options; stored data stays in-geography | Microsoft Products & Services DPA; SOC, ISO, HIPAA/BAA, GDPR, FedRAMP High; AES-256 at rest, optional CMK |
| AWS | Amazon Bedrock | No — prompts/completions not used to train base FMs and never shared with providers (no consumer tier) | Encrypted and stored at rest in your chosen AWS Region; customer-deletable; not retained for training | Content stored/processed in the AWS Region you select; EU regions available (Frankfurt, Ireland, Paris) | GDPR, HIPAA eligible, SOC, ISO, FedRAMP High/Moderate; AWS KMS, private VPC via PrivateLink |
| Meta | Llama models — via cloud host or self-host (first-party Llama API retired 2026-07-06) | No — open-weight models; running them doesn't send data to Meta. Handling follows where you run them: Bedrock/Vertex no-training terms, or fully in your own environment if self-hosted | Self-hosted: you control (none by default). Via cloud host: per that host (Bedrock stores in-region, not retained for training; Vertex ZDR available) | Self-hosted: wherever you deploy. Via cloud host: that host's region selection (EU regions available) | Inherits the host's certifications (Bedrock/Vertex: SOC 2, ISO, HIPAA, FedRAMP, GDPR DPA); self-hosted: your own controls |
Meta update: Meta retired its first-party hosted Llama API (public preview) on 2026-07-06 and has shifted focus to a new proprietary, cloud-only model line. Existing Llama models remain open-weight (incremental maintenance only) and are best run for enterprise use via a cloud host (AWS Bedrock, Google Vertex) or self-hosted — where data terms follow the host or stay in your own environment.
App-layer products: Coding/agent tools like Claude Code and the Cowork desktop app inherit the terms of the plan they run under (consumer on Claude Free/Pro/Max; commercial on the API, Team, or Enterprise). Gemini for Google Workspace and Microsoft 365 Copilot follow their respective enterprise agreements — confirm those separately.
The Benchmark That Puts It in Perspective
When the answers still feel abstract, compare them to a tool you already trust. Google Search logs your queries against your account and uses them to improve services and personalize ads; for accounts created after June 2020, Web & App Activity auto-deletes on an 18-month default, and older accounts retain indefinitely unless you turn auto-delete on. That's a tool most companies use hundreds of times a day without a risk review.
Measured on training use, retention, and contractual protection, a well-configured enterprise AI API is typically more protective than the everyday search, email, and SaaS you already run. If your search bar clears your bar for risk, enterprise AI clears it too.
The 15-Minute Checklist
- Confirm the tier (and trace app-layer tools to their plan).
- Training by default? — want an explicit "no."
- Retention + ZDR — shorter is better; zero where you can.
- Residency — in-region if you need it.
- DPA / BAA — get them signed.
- SOC 2 / ISO / FedRAMP — confirm what compliance needs.
- Re-verify at contract time — policies change; date every claim.
Do this once and the fear stops being a vibe and becomes a set of checkable facts. That's the whole point: you don't need to trust the marketing, and you don't need to avoid AI. You need to read six pages and sign one agreement.
If you'd rather work through the tier line and controls for your own stack with someone who's done it, that's a conversation we're happy to have — pando.codes.
Sources (primary/authoritative, current as of 2026-08-11): OpenAI "Enterprise privacy at OpenAI" (2026-01-08) and API data-residency Help Center; Anthropic "Is my data used for model training?" (privacy.claude.com, 2026-03-16) and servers-location; Google "How Gemini for Google Cloud uses your data," Vertex AI data-residency and compliance docs; Microsoft "Data, privacy, and security for Foundry Models sold by Azure" (2026-05-19); AWS Bedrock security/privacy and FAQs; Meta Llama API data commitments (first-party hosted API retired 2026-07-06); Google Account Help — Web & App Activity. Provider policies change frequently; treat each statement as current-as-of, not permanent.