AI tool data privacy comes down to one test: trust the vendors that publish endpoint-level retention numbers with dates, and treat everyone else as unproven until they do. OpenAI documents that API data isn't used for training by default since 1 March 2023, then documents separately that abuse-monitoring logs holding your prompts stick around 30 days (OpenAI). Those are two separate controls. Anthropic deletes API inputs within 30 days, but keeps Usage Policy violation content for up to 2 years and classifier scores for 7 (Anthropic).
You'll get five questions, the documented answers from four vendors, and a four-tier model for sorting the other 18,948 tools in our directory.
The risk moved from your employees to your vendors
Auditing employee behavior is the cheap half of this problem, and it's the half every competing checklist covers. The expensive half is whether the vendor on the other end of the API keeps what you send, for how long, and who can compel it later.
Shadow AI is the default setting now
Shadow AI has also climbed to the third most common non-malicious insider action in DLP datasets, a 4x year-over-year increase. So a rule that says "don't use unapproved tools" is a rule most of your workforce breaks on a company laptop before lunch. The workable move is triage at the vendor level: decide which tools clear a documented bar, then make those the path of least resistance. That set is larger than most teams plan for. Our directory tracks 18,948 active listings, including the 13,157 AI apps in our directory, which means you need a filter you can apply in ten minutes rather than a 40-question security questionnaire.
What the breach numbers cost you
High levels of shadow AI added USD 670,000 to the average cost of a breach, measured against a global average of USD 4.44 million, down from USD 4.88 million, and a mean 241 days to identify and contain.
Two more figures from the same study point at the cause. 97% of breached organizations that suffered an AI-related security incident had no proper AI access controls, and 63% of the 600 organizations studied had no AI governance policy in place.
Governance in that sense is narrow and checkable. You need to know which vendor holds which data, under which written retention term, confirmed against a dated policy page you can open right now and quote back to your legal team.
Five questions that settle AI tool data privacy
Every one of these questions has a right kind of answer: a document you can save, date, and re-check next quarter. If the reply comes back as an adjective, the vendor has failed the question. "Enterprise-grade security" is not an answer. A URL with a last-updated date on it is.
1. Whether your data trains the model, and on which tier
The artifact is a policy page that names the tier. OpenAI's docs say that "As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in)" (OpenAI Developer Docs), and that default covers the API, not consumer ChatGPT. Anthropic drew the same line the other way for consumers: Free, Pro and Max users who allow training get 5-year retention, opt-outs get 30 days, and Claude for Work, Gov, Education and API access sit outside the whole thing (Anthropic).
Ask which SKU your team actually bought. The answer changes per tier, and staff on personal logins are on a different tier than your contract.
2. How long it's retained, and every exception
You want an endpoint-level table. OpenAI's 30-day abuse-monitoring default doesn't hold everywhere: Assistants API objects you don't delete are "retained indefinitely," Files persist "until deleted," and /v1/videos keeps data 48 hours for download plus 30 days for abuse monitoring (OpenAI). Anthropic deletes API inputs and outputs "within 30 days of receipt or generation," then lists carve-outs running to 2 years for Usage Policy violations, 7 years for trust-and-safety classification scores, and 5 years for feedback submissions (Anthropic Privacy Center). Demand that carve-out list in writing from every vendor quoting you a short number.
3. Who else touches it: subprocessors and model hosts
The artifact is a versioned subprocessor list with a change-notification clause. Most tools you'll evaluate are wrappers, so the real question is which foundation model sits underneath and on whose infrastructure. That matters most for AI agents that act on your data, which chain through tools and often route through more than one model host per task, and for platform-level AI vendors whose subprocessor list defines the perimeter.
4. Where it's processed, and whether residency is on by default
Get a screenshot of the setting, plus the date it was enabled. A yes on the sales call means nothing without the console showing the region pinned to your project, and the model behind a feature carries data terms of its own.
5. What happens under a legal hold
You want a written legal-process policy: who gets notified, when, and which tiers are excluded from preservation orders. On 5 January 2026 Judge Sidney Stein affirmed an order requiring OpenAI to hand over 20 million de-identified consumer ChatGPT conversations, finding the magistrate's rulings "neither clearly erroneous nor contrary to law" (Bloomberg Law). The earlier preservation order was lifted on 9 October 2025, but logs already captured under it stay accessible (ABA Journal). A court can outrank a deletion schedule.
Training opt-out and retention are two different controls
A vendor can tell you, truthfully, that it doesn't train on your data and still hold your prompts on disk for a month. Those are separate switches, governed by separate paragraphs in separate documents, and conflating them is the most common mistake in AI vendor review. Ask both questions and save both answers.
What OpenAI's API defaults say
The exact sentence, from OpenAI's own developer docs: "As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in)" (OpenAI Developer Docs). That default covers the API. It doesn't cover consumer ChatGPT tiers, so if your team is pasting client material into a personal Plus account, this promise isn't the one protecting you.
Retention runs on a different track. OpenAI keeps abuse-monitoring logs, which "may contain certain customer content, such as prompts and responses," for up to 30 days across all API feature usage, "unless longer retention is required by law, or is reasonably necessary to protect OpenAI's services or any third party from harm" (OpenAI Developer Docs). Opt out of training and that log still exists.
Why the 30-day number is not uniform across endpoints
Most checklists write down "30 days" and stop. The docs are more specific than that: Assistants API objects you don't explicitly delete are "retained indefinitely," Files persist "until deleted," and the /v1/videos API holds data for 48 hours for download plus 30 days for abuse monitoring (OpenAI Developer Docs).
So the answer to "how long do you keep my data" depends on which endpoint your engineers wired up. The company name on the invoice doesn't settle it. If you're comparing the AI models we track on retention, do it per endpoint, per product surface. One number per company is a fiction.
Anthropic's 30 days, and the exceptions that run to 7 years
Anthropic's commercial retention page, last updated 1 July 2026, says the company will "automatically delete inputs and outputs on our backend within 30 days of receipt or generation" for API customers (Anthropic Privacy Center). Read the carve-outs on the same page and the picture changes: content tied to Usage Policy violations is kept up to 2 years, trust-and-safety classification scores up to 7 years, and user feedback submissions for 5 (Anthropic Privacy Center).
Seven years is a second policy sitting on top of the 30-day one. Demand the carve-out list in writing from every vendor that advertises short retention, because the good ones publish it and the rest will send you a marketing page.
Zero data retention is something you apply for
ZDR is the strongest control on offer and the least self-serve. On OpenAI's side the enforcement is server-side, which is the right design: under ZDR the store parameter "will always be treated as false, even if the request attempts to set the value to true" (OpenAI Developer Docs). You apply for it per customer and get approved. There's no checkbox.
Anthropic's platform docs draw a sharper line. Conversation content "is not retained by default; the exception is Covered Models, which require 30-day retention," and Claude Fable 5.1, Mythos 5.1, Fable 5 and Mythos 5 "are not available under ZDR unless expressly authorized by Anthropic" (Claude Platform Docs). Send a non-compliant request and you get back a 400 invalid_request_error, which at least fails loudly. Your model picker is now a retention decision.
SOC 2 is an attestation written by a CPA firm
A SOC 2 report is an opinion a CPA firm writes about a system, produced under the AICPA's AT-C Section 205 attestation standard. There's no certifying body, no registry, and no pass/fail line (Vanta). An auditor who finds the controls broken issues an adverse opinion, and that document is still, accurately, a SOC 2 report.
Why 'SOC 2 certified' is a red flag on its own
Nobody gets certified in SOC 2, because the AICPA's guidance doesn't allow the word (Vanta). A vendor whose security page says "SOC 2 certified" either doesn't know what its own auditor produced or is counting on you not knowing. Either way you've learned something about how much of the rest of that page you can take at face value.
Ask for the report. If the answer is a logo, that's the whole answer.
What makes a SOC 2 claim checkable
Four things do, and a vendor that won't hand over all four under NDA is offering you a mood.
- The name of the CPA firm that signed the opinion, so you can confirm it's a licensed practice and not an internal team.
- Whether it's Type I or Type II, and the exact observation window. A Type II covering 1 January to 30 June 2026 tells you nothing about how the controls behaved in August.
- The exceptions section, verbatim, plus management's response to each one. This is the part that gets cropped out of the summary PDF, and it's where the real findings live.
- Which systems the report covers. A report scoped to the corporate SaaS product doesn't cover the inference endpoint you're sending customer records to.
ISO 42001 and the surveillance-audit problem
ISO/IEC 42001 is a real certification with a real accredited body behind it, which makes it stronger evidence than SOC 2 marketing copy. It still decays. Anthropic announced accredited ISO/IEC 42001:2023 certification on 13 January 2025, issued by Schellman Compliance through ANAB accreditation (Anthropic). That announcement is more than a year and a half old now. Certificates carry expiry dates and depend on periodic surveillance audits, so the press release proves a certificate existed once, not that one exists today.
Pull the live certificate off the vendor's trust center, check the validity dates and the scope statement on it, and save a dated copy.
EU data residency is a per-workload setting
Asking a vendor whether it supports EU data residency gets you a yes that may cover half your traffic. The useful version is per workload: which processing stays in region, under which default, and which model sits behind the feature you turned on.
Model exclusions cut across your cloud choice
Anthropic's Covered Models are barred from zero data retention on the Claude Console, Claude Enterprise, Amazon Bedrock, Google Cloud Agent Platform and Microsoft Foundry alike (Anthropic Privacy Center). Choosing the cloud doesn't settle the data terms. The model behind the feature carries terms of its own, and those change when a vendor swaps a backend.
Residency clauses govern where inference runs and where primary storage sits. Abuse-monitoring copies run on a separate schedule: OpenAI keeps those logs for up to 30 days by default, "unless longer retention is required by law, or is reasonably necessary to protect OpenAI's services or any third party from harm" (OpenAI Developer Docs).
Three things to pull out of the admin console before you sign anything:
- The name of the routing or residency toggle, its current state, and the date it was last changed.
- Which admin role can flip it, because a setting any workspace owner can disable is not a control.
- The versioned subprocessor list, saved as a file with a date on it, so next quarter's diff is a two-minute job.
Apply the same question to smaller vendors before any of them touch customer records, including the 2,917 AI mobile apps we track, where a published region setting is the first artifact to go missing.
What the AI Act penalties make this worth
The top tier of Article 99 runs up to €35,000,000 or 7% of total worldwide annual turnover, whichever is higher, with a middle tier at €15,000,000 or 3% and an information tier at €7,500,000 or 1% (EU AI Act). That ceiling sits above GDPR's €20M and 4%. An hour in four admin consoles is cheap against those numbers.
Any policy can be overridden by a court
A deletion schedule is a business commitment. It binds the vendor to you. It doesn't bind a federal judge, and when those two collide, the judge wins.
The 20-million-conversation production order
On 5 January 2026, US District Judge Sidney Stein affirmed a magistrate's order compelling OpenAI to hand over a sample of 20 million de-identified consumer ChatGPT conversations to the news plaintiffs in the consolidated copyright MDL, holding that "Judge Wang's rulings were neither clearly erroneous nor contrary to law" (Bloomberg Law). The privacy protections the court leaned on were de-identification, a protective order, and an attorneys'-eyes-only designation. Those are real safeguards. Most buyers read a 30-day retention policy as a guarantee their data never leaves the vendor, and this order shows the size of that gap.
Nobody who typed into ChatGPT in 2024 got a say in that.
Preservation orders come and go, captured logs stay
The earlier preservation order was lifted on 9 October 2025. OpenAI was released from preserving and segregating output log data going forward and, with limited exceptions, no longer had to keep logs past 26 September 2025. Logs already captured under the order stayed accessible (ABA Journal). A litigation hold is a ratchet. It can pause a deletion schedule at any moment, and lifting it doesn't un-capture what got frozen in the meantime.
Which tiers were carved out, and why that matters
API customers with Zero Data Retention, plus ChatGPT Enterprise and Edu, were excluded from the original preservation order (ABA Journal). That's the closest thing to a proof point anyone has for which contract tier holds up under legal pressure. Consumer tiers got swept in. The tiers with a signed enterprise agreement and server-enforced ZDR did not.
A tiered trust model you can apply to any tool
Sort every tool you use into one of four tiers, and let the tier decide what data it's allowed to touch. Artifacts you can save to a folder set the tier, and a sales engineer's assurances on a call don't move it. A dated policy URL from the vendor's own domain. A named CPA firm and a report period with a start and end date. A subprocessor list with a version or a changelog. A residency toggle you can screenshot in the admin console.
Tier 1, public-only: no verifiable artifacts
You couldn't find a retention page, the trust center is a contact form, or the subprocessor list is "available on request." Treat the tool as a public channel. Anything you'd be comfortable posting on your marketing site can go in, and nothing else. Most of the 13,157 tools in our AI Apps directory sit here by default, because a two-person wrapper on someone else's API usually has no artifacts at all.
Tier 2, internal: dated policy, named auditor, published subprocessors
Three artifacts on file, each with a date you wrote down. Internal documents are fine. Customer data isn't.
Tier 3, confidential: contractual ZDR, residency on, legal-process commitments
Zero data retention belongs in your signed agreement, and on the OpenAI side it's applied and approved per customer rather than toggled by you (OpenAI Developer Docs). You also want a written commitment on how the vendor handles subpoenas and preservation orders. Confidential business data, source code, and customer records go here.
Tier 4, regulated: only with a signed agreement and a re-check every quarter
Health data, financial records, anything under a DPA with real teeth. Signed contract, named subprocessors, residency verified per workload, and a calendar entry for the next review. If you can't get all four, the workload stays off the tool or moves to one of the self-hostable open-source alternatives where you own the disk.
The staleness rule: any assessment older than a quarter is expired
On 9 June 2026 Anthropic designated four Covered Models and removed the ZDR option for them across Claude Console, Claude Enterprise, Amazon Bedrock, Google Cloud Agent Platform and Microsoft Foundry (Anthropic Privacy Center). Customers who had signed ZDR terms didn't do anything wrong. The commitment narrowed under them. That's the argument for re-pulling every artifact each quarter and diffing it, and it applies hardest to the foundation-model vendors whose terms move fastest.
Running the assessment in twenty minutes
Open a folder named after the vendor. If you can't fill it in twenty minutes from public pages plus one email, the tool stays in Tier 1 and never touches customer data. That default does more work than any scoring rubric.
The five artifacts to collect before the call
All five are usually public. Save PDFs or dated screenshots, because pages change under you.
- The retention page with its own last-updated date on it. Anthropic's says 1 July 2026 and gives you 30 days for API inputs and outputs (Anthropic Privacy Center). OpenAI's data controls guide gives you the March 1, 2023 API training default (OpenAI).
- The per-endpoint retention table, not the headline number. Assistants API objects you don't delete are "retained indefinitely" (OpenAI).
- The exceptions list. Anthropic publishes 2 years for Usage Policy violations, 7 years for trust-and-safety scores, 5 years for feedback (Anthropic). Most vendors won't publish theirs, which is itself an answer.
- The versioned subprocessor list with a change-notification window.
- The SOC 2 report cover page, or the NDA request that gets you one.
Four questions vendors reliably dodge
Send these verbatim. Ask for replies in writing, in the same thread, so you have something to attach to the folder.
Name the CPA firm that signed your most recent SOC 2 report and the exact report period. Anthropic named Schellman Compliance for its ISO 42001 certificate (Anthropic), so the bar is public and clearable. List every exception to your stated retention period. Confirm whether EU residency can be enabled on a project we already created or only on a new one. State your notification policy when you receive a subpoena or preservation order covering our data.
What to do when the answer is a marketing page
Treat a link to a trust center landing page as a non-answer and re-send the question with the specific sentence you want confirmed. Silence past one follow-up sets the tier for you: Tier 1, public and synthetic data only. You can run this on any listing in our directory in the same twenty minutes, and the small vendors fail faster than the large ones, which saves you the call.
Frequently asked questions
Is it safe to use AI tools with company data?
It depends entirely on which tier and contract you're on, and the consumer tier is where most of the risk sits. OpenAI's developer docs say that as of 1 March 2023, data sent to the OpenAI API is not used to train or improve OpenAI models unless you explicitly opt in, and that default covers the API only, not consumer ChatGPT plans. The practical danger is unmanaged use: 45% of employees are now regular AI users on corporate devices, up from 15% a year earlier, and 67% of them use non-corporate accounts, while 97% of breached organizations that suffered an AI-related security incident lacked proper AI access controls. Get people onto business agreements with named retention terms, because high levels of shadow AI added about USD 670,000 to the average breach cost.
Does opting out of AI training mean my data isn't stored?
No. Training opt-out and retention are two separate controls, and vendors document them separately. OpenAI keeps abuse-monitoring logs that "may contain certain customer content, such as prompts and responses" for up to 30 days by default on all API feature usage, and the 30-day figure isn't uniform: Assistants API objects you don't delete are "retained indefinitely," Files persist "until deleted," and the /v1/videos API holds data 48 hours for download plus 30 days for abuse monitoring. Anthropic's commercial policy says it will "automatically delete inputs and outputs on our backend within 30 days of receipt or generation", with carve-outs that run much longer: content tied to Usage Policy violations for up to 2 years, trust-and-safety classification scores for up to 7 years, and feedback submissions for 5 years. Ask every vendor for that exceptions list in writing.
What does 'SOC 2 certified' mean for an AI vendor?
It means the vendor is using language the AICPA's own guidance disallows. SOC 2 is an attestation performed by a licensed CPA firm under AT-C Section 205, with no certifying body and no pass/fail outcome, so even an adverse opinion still produces a "SOC 2 report". Ask for the report itself, the name of the CPA firm, the report period, and the opinion, since a badge on a marketing page tells you none of that. ISO/IEC 42001 is a real certification by comparison, and Anthropic announced accredited ISO 42001 certification on 13 January 2025 through Schellman Compliance, an ANAB-accredited body, though certificates need periodic surveillance audits, so check the live certificate rather than the announcement.
Can a vendor's zero data retention promise be changed after I sign?
Yes, and there's a documented 2026 example. Anthropic's Covered Model retention rule, introduced on 9 June 2026, removed the ZDR option for those models across the Claude Console, Claude Enterprise, Amazon Bedrock, Google Cloud Agent Platform and Microsoft Foundry. Its platform docs now state that conversation content "is not retained by default; the exception is Covered Models, which require 30-day retention," naming Claude Fable 5.1, Mythos 5.1, Fable 5 and Mythos 5, which "are not available under ZDR unless expressly authorized by Anthropic", with non-compliant requests returning a 400 invalid_request_error. ZDR is also not a toggle at OpenAI: it's approved per customer, and once granted the store parameter "will always be treated as false, even if the request attempts to set the value to true".
Does EU data residency mean my prompts never leave Europe?
No, and treating residency as a yes/no checkbox is how buyers get caught out. Residency clauses typically govern where inference runs and where primary storage sits, while abuse-monitoring copies live under a separate schedule: OpenAI retains those logs for up to 30 days by default, "unless longer retention is required by law, or is reasonably necessary to protect OpenAI's services or any third party from harm". Model-level exclusions cut across cloud boundaries too, since Anthropic's Covered Models are barred from ZDR on Amazon Bedrock, Google Cloud Agent Platform and Microsoft Foundry alike. Read the subprocessor list and the opt-out defaults, then price the downside: EU AI Act penalties top out at €35,000,000 or 7% of worldwide annual turnover, whichever is higher.
How often should I re-check an AI tool's privacy posture?
Every quarter, and immediately before any new workload touches regulated data. Recent history shows why an annual review is too slow: Anthropic's consumer terms update published 28 August 2025 set 5-year retention for Free/Pro/Max users who allow training and gave a decision deadline of 8 October 2025, and the ZDR carve-out for Covered Models landed on 9 June 2026. Court orders move faster than policy pages as well: the ChatGPT log preservation order was lifted on 9 October 2025, though logs already captured under it stay accessible, and on 5 January 2026 Judge Sidney Stein affirmed the order requiring OpenAI to produce 20 million de-identified consumer ChatGPT conversations. Any assessment with a dated primary-source URL older than a quarter should be treated as stale.
