{"api":"v1","id":"vendors","release":{"id":"2026-10-26","date":"2026-10-26","checked":"2026-10-26","sha256":"8dd500303df4f448812b0bac2583a77458a9bd110132b0f002c1dcd2b0323123"},"csv":"https://jesseahawkins.com/data/releases/vendors/2026-10-26.csv","fields":[{"name":"vendor","type":"string"},{"name":"product","type":"string"},{"name":"field","type":"string"},{"name":"label","type":"string"},{"name":"value","type":"string"},{"name":"quote","type":"string"},{"name":"context","type":"string"},{"name":"document","type":"string"},{"name":"source_url","type":"string"},{"name":"kept_on","type":"string"},{"name":"snapshot_sha256","type":"string"},{"name":"license","type":"string"},{"name":"page","type":"string"},{"name":"notice","type":"string"}],"rowCount":101,"rows":[{"vendor":"OpenAI","product":"OpenAI API","field":"trains_on_customer_data","label":"Training on business and API data","value":"Not by default","quote":"As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us).","context":null,"document":"Data controls in the OpenAI platform","source_url":"https://developers.openai.com/api/docs/guides/your-data","kept_on":"2026-10-24","snapshot_sha256":"d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/openai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"OpenAI","product":"OpenAI API","field":"customer_data_retention_period","label":"How long API data is kept","value":"Up to 30 days in abuse monitoring logs, with listed exceptions","quote":"By default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days, unless longer retention is required by law, or is reasonably necessary to protect our services or any third party from harm.","context":"Under “Data retention controls for abuse monitoring”. Application state is kept separately; for /v1/responses the page says “response data will be stored for at least 30 days.”","document":"Data controls in the OpenAI platform","source_url":"https://developers.openai.com/api/docs/guides/your-data","kept_on":"2026-10-24","snapshot_sha256":"d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/openai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"OpenAI","product":"OpenAI API","field":"zero_data_retention","label":"Option to keep no data","value":"Zero Data Retention, on approval","quote":"Eligible customers may have their customer content excluded from these abuse monitoring logs, subject to the limitations below, by getting approved for the Zero Data Retention or Modified Abuse Monitoring controls.","context":null,"document":"Data controls in the OpenAI platform","source_url":"https://developers.openai.com/api/docs/guides/your-data","kept_on":"2026-10-24","snapshot_sha256":"d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/openai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"OpenAI","product":"OpenAI API","field":"data_residency","label":"Where data is processed and stored","value":"Data residency controls, for eligible customers","quote":"Data residency controls are a project configuration option that allow you to configure the location of infrastructure OpenAI uses to provide services.","context":"The next line reads: “Contact our sales team to see if you’re eligible for using data residency controls.”","document":"Data controls in the OpenAI platform","source_url":"https://developers.openai.com/api/docs/guides/your-data","kept_on":"2026-10-24","snapshot_sha256":"d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/openai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"OpenAI","product":"OpenAI API","field":"ai_subprocessors","label":"Sub-processors","value":"Uses sub-processors; names Cloudflare for the US and EU endpoints","quote":"OpenAI uses sub-processors to provide its services. For requests sent to us.api.openai.com or eu.api.openai.com, OpenAI uses Cloudflare Regional Services so that TLS termination and HTTPS decryption occur within the selected processing region.","context":null,"document":"Data controls in the OpenAI platform","source_url":"https://developers.openai.com/api/docs/guides/your-data","kept_on":"2026-10-24","snapshot_sha256":"d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/openai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"OpenAI","product":"OpenAI API","field":"certifications","label":"Certifications and audits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/openai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Anthropic","product":"Anthropic API and Claude commercial products","field":"trains_on_customer_data","label":"Training on business and API data","value":"Not by default","quote":"By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models.","context":null,"document":"Is my data used for model training?","source_url":"https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training","kept_on":"2026-10-24","snapshot_sha256":"54617b76403faa9ba4db2ad4b7ba43a5c8d98fb8d9a2efbdbe18caac95e8a450","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/anthropic/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Anthropic","product":"Anthropic API and Claude commercial products","field":"customer_data_retention_period","label":"How long API data is kept","value":"Anthropic API: deleted within 30 days, with listed exceptions","quote":"For Anthropic API users, we automatically delete inputs and outputs on our backend within 30 days of receipt or generation","context":"Under “Standard Retention Timeframe”. The sentence continues with exceptions: longer-retention services such as the Files API, a zero data retention or other agreement, Usage Policy enforcement, and law. For other commercial products the page says: “we retain your chats and coding sessions in the product to provide you with a consistent product experience.”","document":"How long do you store my organization's data?","source_url":"https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data","kept_on":"2026-10-24","snapshot_sha256":"31c58317fd20d708fdb599ee7a29d7d8bd7875152c2cdad9fcc4a427c15149c0","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/anthropic/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Anthropic","product":"Anthropic API and Claude commercial products","field":"zero_data_retention","label":"Option to keep no data","value":"Zero data retention, by agreement","quote":"When you and we have agreed otherwise (e.g. zero data retention agreement)","context":"Under “Standard Retention Timeframe”, one of the listed exceptions to the rule that Anthropic API inputs and outputs are deleted within 30 days.","document":"How long do you store my organization's data?","source_url":"https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data","kept_on":"2026-10-24","snapshot_sha256":"31c58317fd20d708fdb599ee7a29d7d8bd7875152c2cdad9fcc4a427c15149c0","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/anthropic/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Anthropic","product":"Anthropic API and Claude commercial products","field":"data_residency","label":"Where data is processed and stored","value":"API inference: global by default (any geography) or US-only via inference_geo on Claude 4.6 and later, on the first-party API (except the OpenAI SDK compatibility endpoint) and some partner platforms; workspace data at rest: US only","quote":"Data residency controls let you manage where your data is processed and stored.","context":"The page says “Inference may run in any available geography for optimal performance and availability” for the default, “global”. Also: “The inference_geo parameter is supported on Claude 4.6 and later models.” Workspace geo: “Currently, \"us\" is the only available workspace geo.”","document":"Data residency","source_url":"https://platform.claude.com/docs/en/manage-claude/data-residency","kept_on":"2026-10-26","snapshot_sha256":"0171e6e8e8a1d63a6e24483d2d437d75b8ef141e26b197787c969208bb2345a7","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/anthropic/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Anthropic","product":"Anthropic API and Claude commercial products","field":"ai_subprocessors","label":"Sub-processors","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/anthropic/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Anthropic","product":"Anthropic API and Claude commercial products","field":"certifications","label":"Certifications and audits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/anthropic/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Google","product":"Gemini API and Gemini models on Google Cloud","field":"trains_on_customer_data","label":"Training on business and API data","value":"Not used to improve products, on paid use","quote":"When you use Paid Services, including, for example, the paid quota of the Gemini API, Google doesn't use your prompts (including associated system instructions, cached content, and files such as images, videos, or documents) or responses to improve our products","context":null,"document":"Gemini API Additional Terms of Service","source_url":"https://ai.google.dev/gemini-api/terms?hl=en","kept_on":"2026-10-24","snapshot_sha256":"0424aabe6c15afb2fd95ffdb4d70aadc44796c9d2f43592acfb015c56559734e","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/google/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Google","product":"Gemini API and Gemini models on Google Cloud","field":"trains_on_free_use","label":"Training on free and consumer use","value":"Used to improve products, on unpaid use outside the EEA, Switzerland and the UK","quote":"When you use Unpaid Services, including, for example, Google AI Studio and the unpaid quota on Gemini API, Google uses the content you submit to the Services and any generated responses to provide, improve, and develop Google products and services and machine learning technologies","context":"Under “Unpaid Services”, “How Google Uses Your Data”. The same section says: “If you're in the European Economic Area, Switzerland, or the United Kingdom, the terms under \"How Google uses Your Data\" in \"Paid Services\" apply to all Services, including Google AI Studio and unpaid quota in the Gemini API, even though they are offered free of charge.”","document":"Gemini API Additional Terms of Service","source_url":"https://ai.google.dev/gemini-api/terms?hl=en","kept_on":"2026-10-24","snapshot_sha256":"0424aabe6c15afb2fd95ffdb4d70aadc44796c9d2f43592acfb015c56559734e","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/google/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Google","product":"Gemini API and Gemini models on Google Cloud","field":"customer_data_retention_period","label":"How long API data is kept","value":"A limited period, for abuse detection and legal disclosures, on paid use","quote":"For Paid Services, Google logs prompts and responses for a limited period of time, solely for detecting and preventing violations of the Prohibited Use Policy to maintain the safety and security of the Services, and any required legal or regulatory disclosures.","context":"Under “Paid Services”, “How Google Uses Your Data”. The page does not state the length of the period. Some features have their own terms; for Grounding with Google Search the page says Google will store prompts, contextual information that you may provide, and output for thirty (30) days.","document":"Gemini API Additional Terms of Service","source_url":"https://ai.google.dev/gemini-api/terms?hl=en","kept_on":"2026-10-24","snapshot_sha256":"0424aabe6c15afb2fd95ffdb4d70aadc44796c9d2f43592acfb015c56559734e","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/google/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Google","product":"Gemini API and Gemini models on Google Cloud","field":"zero_data_retention","label":"Option to keep no data","value":"Zero data retention on Google Cloud, with customer actions; not possible with some features","quote":"To achieve zero data retention, customers must take specific actions within each of these areas:","context":"Under “Customer data retention and achieving zero data retention”. The same page says: “Zero data retention may not be possible when using some Advanced AI features.” and, for Grounding with Google Search and Google Maps, “There is no way to disable the storage of this information”.","document":"Gemini Enterprise Agent Platform and zero data retention","source_url":"https://docs.cloud.google.com/gemini-enterprise-agent-platform/resources/zero-data-retention","kept_on":"2026-10-24","snapshot_sha256":"dca5cdf5c2adfdd633ad5d1a6f3cabc94ce13e9cff0daacccd29d591ee853056","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/google/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Google","product":"Gemini API and Gemini models on Google Cloud","field":"data_residency","label":"Where data is processed and stored","value":"On Google Cloud: at rest in the chosen location; global endpoints carry no guarantee","quote":"Data stored at rest in the customer selected location remains at rest in that location, independent of the Gemini Enterprise Agent Platform endpoint called by that customer's request.","context":"The page adds: “Requests submitted to a global endpoint may be processed in any Google Cloud location around the world, and therefore don't provide any data residency guarantees.”","document":"Data residency","source_url":"https://docs.cloud.google.com/gemini-enterprise-agent-platform/resources/data-residency","kept_on":"2026-10-26","snapshot_sha256":"dbd4fd892d3f15210d9d553cb2e6920be55a339c3fe9ec124cc6501551d0040b","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/google/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Google","product":"Gemini API and Gemini models on Google Cloud","field":"ai_subprocessors","label":"Sub-processors","value":"A published list for Google Cloud, AI services included","quote":"Google and its affiliates engage the third-party entities in the table below to perform limited activities in connection with the Google Cloud Platform Services.","context":"Several rows name the service “All AI Solutions, Pre-Trained APIs, AI Platform/Gemini platform (formerly Vertex AI), Generative AI Services and Agentic AI Services”.","document":"Google Cloud Platform Subprocessors","source_url":"https://cloud.google.com/terms/subprocessors","kept_on":"2026-10-26","snapshot_sha256":"a6ed1984ff40698b2be48013e848b0eea59c98994ce442ecc48211e699a547d6","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/google/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Google","product":"Gemini API and Gemini models on Google Cloud","field":"certifications","label":"Certifications and audits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/google/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft","product":"Azure OpenAI and other models sold by Azure in Microsoft Foundry","field":"trains_on_customer_data","label":"Training on business and API data","value":"Not without permission","quote":"Your prompts (inputs) and completions (outputs), your embeddings, and your training data: are NOT available to other customers. are NOT available to OpenAI or other providers of Models sold by Azure. are NOT used by providers of Models sold by Azure to improve their models or services. are NOT used to train any generative AI foundation models without your permission or instruction.","context":null,"document":"Data, privacy, and security for Foundry Models sold by Azure","source_url":"https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy","kept_on":"2026-10-24","snapshot_sha256":"cb7f0b5243c1a1e30e5074c37119277a1f985a202df84c4f208cc881f9f23a54","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft","product":"Azure OpenAI and other models sold by Azure in Microsoft Foundry","field":"customer_data_retention_period","label":"How long API data is kept","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft","product":"Azure OpenAI and other models sold by Azure in Microsoft Foundry","field":"zero_data_retention","label":"Option to keep no data","value":"Modified abuse monitoring, by application","quote":"Microsoft allows customers who meet additional Limited Access eligibility criteria to apply to modify abuse monitoring by completing this form.","context":null,"document":"Abuse monitoring","source_url":"https://learn.microsoft.com/en-us/azure/foundry/openai/concepts/abuse-monitoring","kept_on":"2026-10-24","snapshot_sha256":"8ccd372f07b1ff5025f76ee926a327ed635d65e8bc318ac3d3a498f194d57f6f","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft","product":"Azure OpenAI and other models sold by Azure in Microsoft Foundry","field":"data_residency","label":"Where data is processed and stored","value":"In the customer’s chosen geography, except Global and DataZone deployments","quote":"Prompts and responses are processed within the customer-specified geography (unless you are using a Global or DataZone deployment type), but may be processed between regions within the geography for operational purposes (including performance and capacity management).","context":null,"document":"Data, privacy, and security for Foundry Models sold by Azure","source_url":"https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy","kept_on":"2026-10-24","snapshot_sha256":"cb7f0b5243c1a1e30e5074c37119277a1f985a202df84c4f208cc881f9f23a54","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft","product":"Azure OpenAI and other models sold by Azure in Microsoft Foundry","field":"ai_subprocessors","label":"Sub-processors","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft","product":"Azure OpenAI and other models sold by Azure in Microsoft Foundry","field":"certifications","label":"Certifications and audits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"AWS","product":"Amazon Bedrock","field":"trains_on_customer_data","label":"Training on business and API data","value":"No, for Amazon Nova, Amazon Titan and third-party models","quote":"No, AWS and the third-party model providers will not use any inputs to or outputs from Amazon Bedrock to train Amazon Nova, Amazon Titan, or any third-party models.","context":"Answer to the FAQ “Will AWS and third-party model providers use customer inputs to or outputs from Amazon Bedrock to train Amazon Nova, Amazon Titan or any third-party models?”","document":"Amazon Bedrock FAQs","source_url":"https://aws.amazon.com/bedrock/faqs/","kept_on":"2026-10-24","snapshot_sha256":"b48072e9d7367e42810904e0a76cd855f3583e22f714aa924bdf453312e751ce","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/aws/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"AWS","product":"Amazon Bedrock","field":"customer_data_retention_period","label":"How long API data is kept","value":"Set by the model and the account's retention mode","quote":"Default means the data retention policy of the model applies. There is no change to previous model retention behavior; if ZDR applied previously, then ZDR still applies. Actual retention depends on the model — consult the model's terms for specifics.","context":null,"document":"Data retention","source_url":"https://docs.aws.amazon.com/bedrock/latest/userguide/data-retention.html","kept_on":"2026-10-24","snapshot_sha256":"a7a8c4c5f2f7d3fbcd9a722db22b01822e09ddbfc7ee27aae794c3e3a757d163","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/aws/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"AWS","product":"Amazon Bedrock","field":"zero_data_retention","label":"Option to keep no data","value":"Zero data retention mode, for models that allow it; other models by per-account approval","quote":"Zero data retention. No request or response data is written to durable storage by AWS or shared with the model provider.","context":"In the “Data retention modes” table, the behavior of mode “none”. Under “Zero data retention (ZDR) access” the page says: “Some models require data retention for safety and abuse-prevention purposes.” and “ZDR access is evaluated on a per-account, per-model basis in coordination with the model provider.”","document":"Data retention","source_url":"https://docs.aws.amazon.com/bedrock/latest/userguide/data-retention.html","kept_on":"2026-10-24","snapshot_sha256":"a7a8c4c5f2f7d3fbcd9a722db22b01822e09ddbfc7ee27aae794c3e3a757d163","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/aws/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"AWS","product":"Amazon Bedrock","field":"data_residency","label":"Where data is processed and stored","value":"Stored at rest in the AWS Region in use","quote":"Any customer content processed by Amazon Bedrock is encrypted and stored at rest in the AWS Region where you are using Amazon Bedrock.","context":null,"document":"Amazon Bedrock FAQs","source_url":"https://aws.amazon.com/bedrock/faqs/","kept_on":"2026-10-24","snapshot_sha256":"b48072e9d7367e42810904e0a76cd855f3583e22f714aa924bdf453312e751ce","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/aws/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"AWS","product":"Amazon Bedrock","field":"ai_subprocessors","label":"Sub-processors","value":"A published list, by Region and service","quote":"Sub-processors relevant to an individual customer will depend on the AWS Region the customer selects and the particular AWS services that the customer uses.","context":null,"document":"AWS Sub-processors","source_url":"https://aws.amazon.com/compliance/sub-processors/","kept_on":"2026-10-26","snapshot_sha256":"f2060d7e438446b0ed1f7c951c195c9268e686dff08f34a64b33336d68bf2295","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/aws/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"AWS","product":"Amazon Bedrock","field":"certifications","label":"Certifications and audits","value":"In scope for FedRAMP Moderate, SOC, ISO and HIPAA eligibility","quote":"Amazon Bedrock is in scope for common compliance standards such as Fedramp Moderate, Service and Organization Control (SOC), International Organization for Standardization (ISO), Health Insurance Portability and Accountability Act (HIPAA) eligibility, and customers can use Bedrock in compliance with the General Data Protection Regulation (GDPR).","context":"The same answer lists “ISO 9001, ISO 27001, ISO 27017, ISO 27018, ISO 27701, ISO 22301, and ISO 20000”.","document":"Amazon Bedrock FAQs","source_url":"https://aws.amazon.com/bedrock/faqs/","kept_on":"2026-10-24","snapshot_sha256":"b48072e9d7367e42810904e0a76cd855f3583e22f714aa924bdf453312e751ce","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/aws/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Mistral AI","product":"Mistral Studio and Vibe","field":"trains_on_customer_data","label":"Training on business and API data","value":"Opt-out offered on Mistral Studio pay-as-you-go; Vibe Enterprise is opted out by default","quote":"Customers retain full control over this processing and have the right to opt out at any time.","context":"Under “Pay-as-you-go”, in “Controls on Mistral Studio”. Under “Vibe (Enterprise)” the page says: “Enterprise customers are opted out of training by default.”","document":"Do you use my user data to train your Artificial Intelligence models?","source_url":"https://help.mistral.ai/en/articles/347617-do-you-use-my-user-data-to-train-your-artificial-intelligence-models","kept_on":"2026-10-24","snapshot_sha256":"d89b5b5e734d152d8688519b0a5e89ead5f72b8361021febf216a7dfae1c4bdf","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/mistral/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Mistral AI","product":"Mistral Studio and Vibe","field":"trains_on_free_use","label":"Training on free and consumer use","value":"Yes by default on Vibe, with an opt-out","quote":"Input and output data are used by default to train our artificial intelligence models, unless you opt out of training at any time.","context":"Under “Vibe”, in “Controls on Vibe”.","document":"Do you use my user data to train your Artificial Intelligence models?","source_url":"https://help.mistral.ai/en/articles/347617-do-you-use-my-user-data-to-train-your-artificial-intelligence-models","kept_on":"2026-10-24","snapshot_sha256":"d89b5b5e734d152d8688519b0a5e89ead5f72b8361021febf216a7dfae1c4bdf","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/mistral/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Mistral AI","product":"Mistral Studio and Vibe","field":"customer_data_retention_period","label":"How long API data is kept","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/mistral/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Mistral AI","product":"Mistral Studio and Vibe","field":"zero_data_retention","label":"Option to keep no data","value":"Zero Data Retention, pay-as-you-go stateless API calls, on approved request","quote":"Zero Data Retention (ZDR) is available only with pay-as-you-go and only for stateless API calls.","context":"Under “How to request ZDR” the same page says: “We will review your request and, at our discretion, approve or deny it.”","document":"Can I activate Zero Data Retention (ZDR)?","source_url":"https://help.mistral.ai/en/articles/347612-can-i-activate-zero-data-retention-zdr","kept_on":"2026-10-24","snapshot_sha256":"c96aadfeac722f65391666944a3e15859341f48d6418bf79e34919e2cd8b2d49","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/mistral/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Mistral AI","product":"Mistral Studio and Vibe","field":"data_residency","label":"Where data is processed and stored","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/mistral/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Mistral AI","product":"Mistral Studio and Vibe","field":"ai_subprocessors","label":"Sub-processors","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/mistral/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Mistral AI","product":"Mistral Studio and Vibe","field":"certifications","label":"Certifications and audits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/mistral/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cohere","product":"Cohere SaaS platform","field":"trains_on_customer_data","label":"Training on business and API data","value":"Opt-out offered","quote":"Enterprise customers can access opt out toggle in the Cohere dashboard settings. If you are opted out, prompts and generations will not be used to train Cohere models.","context":null,"document":"Enterprise data commitments","source_url":"https://cohere.com/enterprise-data-commitments","kept_on":"2026-10-24","snapshot_sha256":"efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cohere/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cohere","product":"Cohere SaaS platform","field":"customer_data_retention_period","label":"How long API data is kept","value":"Deleted after 30 days, with listed exceptions","quote":"For the SaaS Platform, we automatically delete logged prompts and generations after 30 days, unless we need to retain them to comply with a legal requirement or a customer contract, or unless your usage is flagged as potentially violating our terms, including our Usage Policy (e.g. abuse or misuse of our services).","context":"Under the FAQ “How long does Cohere retain enterprise data?”. The same answer says: “Prompts and generations that you allow Cohere to use for training purposes may be retained separately.”","document":"Enterprise data commitments","source_url":"https://cohere.com/enterprise-data-commitments","kept_on":"2026-10-24","snapshot_sha256":"efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cohere/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cohere","product":"Cohere SaaS platform","field":"zero_data_retention","label":"Option to keep no data","value":"Zero data retention, on request, for enterprise customers who make additional usage commitments","quote":"we only allow ZDR for enterprise customers who can make additional commitments about their usage of the Cohere Services","context":"Under the FAQ “What is zero data retention and how do I request it?”. The same answer says: “ZDR does not affect usage data, which Cohere still receives.”","document":"Enterprise data commitments","source_url":"https://cohere.com/enterprise-data-commitments","kept_on":"2026-10-24","snapshot_sha256":"efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cohere/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cohere","product":"Cohere SaaS platform","field":"data_residency","label":"Where data is processed and stored","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cohere/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cohere","product":"Cohere SaaS platform","field":"ai_subprocessors","label":"Sub-processors","value":"Listed on its Trust Center","quote":"You can view a list of sub-processors by visiting Cohere’s Trust Center.","context":null,"document":"Enterprise data commitments","source_url":"https://cohere.com/enterprise-data-commitments","kept_on":"2026-10-24","snapshot_sha256":"efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cohere/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cohere","product":"Cohere SaaS platform","field":"certifications","label":"Certifications and audits","value":"ISO 27001, ISO 42001 and a SOC 2 Type II report, on request","quote":"Seamlessly complete your privacy and security compliance reviews by visiting Cohere’s Trust Center where you can request a copy of our certifications (including ISO 27001 and ISO 42001) or of our SOC 2 Type II Report or review our other compliance resources.","context":null,"document":"Enterprise data commitments","source_url":"https://cohere.com/enterprise-data-commitments","kept_on":"2026-10-24","snapshot_sha256":"efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cohere/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"DeepSeek","product":"DeepSeek services and Open Platform","field":"trains_on_customer_data","label":"Training on business and API data","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/deepseek/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"DeepSeek","product":"DeepSeek services and Open Platform","field":"trains_on_free_use","label":"Training on free and consumer use","value":"Listed as a use of personal data","quote":"To improve and develop the Services and to train and improve our technology, such as our machine learning models and algorithms.","context":null,"document":"DeepSeek Privacy Policy","source_url":"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html","kept_on":"2026-10-24","snapshot_sha256":"339984e36a795843ee2b5b917797072ec249f3c0e9ff7cbbfe754c01caa4f069","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/deepseek/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"DeepSeek","product":"DeepSeek services and Open Platform","field":"customer_data_retention_period","label":"How long API data is kept","value":"As long as necessary; inputs are kept for as long as you have an account","quote":"we keep this Personal Data for as long as you have an account. This Personal Data includes your account Personal Data, input and payment Personal Data.","context":"Under “How Long Do We Keep Your Personal Data”, given as an example of the general rule: “We retain Personal Data for as long as necessary to provide our Services and for the other purposes set out in this Privacy Policy.” The Privacy Policy does not cover end users of apps built on the Open Platform.","document":"DeepSeek Privacy Policy","source_url":"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html","kept_on":"2026-10-24","snapshot_sha256":"339984e36a795843ee2b5b917797072ec249f3c0e9ff7cbbfe754c01caa4f069","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/deepseek/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"DeepSeek","product":"DeepSeek services and Open Platform","field":"zero_data_retention","label":"Option to keep no data","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/deepseek/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"DeepSeek","product":"DeepSeek services and Open Platform","field":"data_residency","label":"Where data is processed and stored","value":"Personal data collected, processed and stored in the People’s Republic of China","quote":"To provide you with our services, we directly collect, process and store your Personal Data in People's Republic of China.","context":null,"document":"DeepSeek Privacy Policy","source_url":"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html","kept_on":"2026-10-24","snapshot_sha256":"339984e36a795843ee2b5b917797072ec249f3c0e9ff7cbbfe754c01caa4f069","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/deepseek/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"DeepSeek","product":"DeepSeek services and Open Platform","field":"ai_subprocessors","label":"Sub-processors","value":"Service providers by category; no list in the kept pages","quote":"We engage service providers that help us provide, support, and develop the Services and understand how they are used.","context":null,"document":"DeepSeek Privacy Policy","source_url":"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html","kept_on":"2026-10-24","snapshot_sha256":"339984e36a795843ee2b5b917797072ec249f3c0e9ff7cbbfe754c01caa4f069","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/deepseek/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"DeepSeek","product":"DeepSeek services and Open Platform","field":"certifications","label":"Certifications and audits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/deepseek/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"xAI","product":"xAI API","field":"trains_on_customer_data","label":"Training on business and API data","value":"Not without permission","quote":"SpaceXSI never trains on your API inputs or outputs without your explicit permission.","context":null,"document":"FAQ: API security","source_url":"https://docs.x.ai/developers/faq/security","kept_on":"2026-10-24","snapshot_sha256":"30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"xAI","product":"xAI API","field":"trains_on_free_use","label":"Training on free and consumer use","value":"Listed as a use of personal information","quote":"To develop and improve our Service and to conduct research: For example to develop new product features, to train our models","context":null,"document":"Privacy Policy","source_url":"https://x.ai/legal/privacy-policy","kept_on":"2026-10-24","snapshot_sha256":"17d51a8463735c94cddbabee411c750b5ae36e9b761d5c6a806aed870c48dd04","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"xAI","product":"xAI API","field":"customer_data_retention_period","label":"How long API data is kept","value":"30 days","quote":"By default, all API requests and responses are stored on our servers (encrypted at rest) for 30 days","context":null,"document":"FAQ: API security","source_url":"https://docs.x.ai/developers/faq/security","kept_on":"2026-10-24","snapshot_sha256":"30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"xAI","product":"xAI API","field":"zero_data_retention","label":"Option to keep no data","value":"Zero Data Retention, a team setting where self-serve is available","quote":"Where available, a team admin can turn it on or off directly from the xAI Console.","context":"Under “What is Zero Data Retention (ZDR)?”, item “Self-serve”. Under “How to enable ZDR” the page says “self-serve ZDR may not be enabled for your environment yet”; teams on a negotiated Enterprise Customer Agreement are told to contact sales.","document":"FAQ: API security","source_url":"https://docs.x.ai/developers/faq/security","kept_on":"2026-10-24","snapshot_sha256":"30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"xAI","product":"xAI API","field":"data_residency","label":"Where data is processed and stored","value":"US only on the US regional endpoint, for two models, with listed exclusions","quote":"To keep API request handling, model inference, moderation, and retained request data in the United States, use the US regional endpoint, https://us.api.x.ai/v1.","context":"The same answer begins: “The default endpoint, https://api.x.ai, does not guarantee a processing region.” It adds: “Files, Collections, server-side tools, and the network path from your systems to the endpoint are outside the guarantee.”","document":"FAQ: API security","source_url":"https://docs.x.ai/developers/faq/security","kept_on":"2026-10-24","snapshot_sha256":"30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"xAI","product":"xAI API","field":"ai_subprocessors","label":"Sub-processors","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"xAI","product":"xAI API","field":"certifications","label":"Certifications and audits","value":"SOC 2 Type 2","quote":"We are SOC 2 Type 2 compliant. Customers with a signed NDA can refer to our Trust Center for up-to-date information on our certifications and data governance.","context":null,"document":"FAQ: API security","source_url":"https://docs.x.ai/developers/faq/security","kept_on":"2026-10-24","snapshot_sha256":"30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Alibaba Cloud","product":"Alibaba Cloud Model Studio, international site","field":"trains_on_customer_data","label":"Training on business and API data","value":"No","quote":"Alibaba Cloud strictly protects your data privacy and will never use your data for model training.","context":"The data retention policy says it will not use business data to train, fine-tune or improve a foundation model without “separate consent”.","document":"Security certifications and privacy","source_url":"https://www.alibabacloud.com/help/en/model-studio/privacy-notice","kept_on":"2026-10-26","snapshot_sha256":"60573ba1ba19bb4030c3193263005b8b7a2b9f4b34fd1809558a72657f02a2c0","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/alibaba/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Alibaba Cloud","product":"Alibaba Cloud Model Studio, international site","field":"customer_data_retention_period","label":"How long API data is kept","value":"Up to 30 days, with listed exceptions","quote":"By default, user’s prompts and responses from model inference calls are retained for no longer than 30 days, unless longer retention is required by applicable laws or is reasonably necessary to ensure the security of Alibaba Cloud Model Studio services.","context":"The same paragraph adds: “Stateful features (conversation storage, files) are retained until deleted by users.”","document":"Alibaba Cloud Model Studio Data Retention Policy","source_url":"https://www.alibabacloud.com/help/en/model-studio/data-retention-policy","kept_on":"2026-10-26","snapshot_sha256":"8e88f476d5c7da5daea273aec57b4e8ae7093540d8d4f75800fcb07a12feb28b","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/alibaba/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Alibaba Cloud","product":"Alibaba Cloud Model Studio, international site","field":"zero_data_retention","label":"Option to keep no data","value":"Zero Data Retention, for enterprise customers on assessment","quote":"ZDR is available to enterprise customers with an Alibaba Cloud account manager, subject to a needs assessment.","context":"For the international site, in regions outside mainland China, on listed models only. Content flagged by safety filters is kept for up to two years.","document":"Alibaba Cloud Model Studio Data Retention Policy","source_url":"https://www.alibabacloud.com/help/en/model-studio/data-retention-policy","kept_on":"2026-10-26","snapshot_sha256":"8e88f476d5c7da5daea273aec57b4e8ae7093540d8d4f75800fcb07a12feb28b","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/alibaba/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Alibaba Cloud","product":"Alibaba Cloud Model Studio, international site","field":"data_residency","label":"Where data is processed and stored","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/alibaba/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Alibaba Cloud","product":"Alibaba Cloud Model Studio, international site","field":"ai_subprocessors","label":"Sub-processors","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/alibaba/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Alibaba Cloud","product":"Alibaba Cloud Model Studio, international site","field":"certifications","label":"Certifications and audits","value":"SOC 2","quote":"Alibaba Cloud Model Studio has achieved SOC 2 compliance with an unqualified opinion, validating our rigorous controls for Security, Availability, and Confidentiality.","context":null,"document":"Security certifications and privacy","source_url":"https://www.alibabacloud.com/help/en/model-studio/privacy-notice","kept_on":"2026-10-26","snapshot_sha256":"60573ba1ba19bb4030c3193263005b8b7a2b9f4b34fd1809558a72657f02a2c0","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/alibaba/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Z.ai","product":"Z.ai API Services (GLM models)","field":"trains_on_customer_data","label":"Training on business and API data","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/zai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Z.ai","product":"Z.ai API Services (GLM models)","field":"customer_data_retention_period","label":"How long API data is kept","value":"API content not stored; other customer data kept until the terms end, with listed exceptions","quote":"This information is processed in real-time to provide the Customer and End Users with the API Service and is not saved on our servers.","context":"In the Data Processing Addendum for API Services, section 4. Section 4(c): “For Customer Data other than those provided under Section 4(b), Company will temporarily store such data for the purposes of providing the API Services or in compliance with applicable laws.”","document":"Privacy Policy, with the Data Processing Addendum for API Services","source_url":"https://docs.z.ai/legal-agreement/privacy-policy","kept_on":"2026-10-26","snapshot_sha256":"a4b5f6921825cd54ce7bcedec9f7847ea4bbf6d72e14fe3ab8d0295ff4a268b0","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/zai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Z.ai","product":"Z.ai API Services (GLM models)","field":"zero_data_retention","label":"Option to keep no data","value":"API content is not stored, the addendum says","quote":"The Company do not store any of the content the Customer or its End Users provide or generate while using our Services.","context":"Data Processing Addendum for API Services, section 4(b).","document":"Privacy Policy, with the Data Processing Addendum for API Services","source_url":"https://docs.z.ai/legal-agreement/privacy-policy","kept_on":"2026-10-26","snapshot_sha256":"a4b5f6921825cd54ce7bcedec9f7847ea4bbf6d72e14fe3ab8d0295ff4a268b0","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/zai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Z.ai","product":"Z.ai API Services (GLM models)","field":"data_residency","label":"Where data is processed and stored","value":"Generally processed in Singapore","quote":"Company generally provide the Services from Singapore, and our group companies and their designated service providers are typically located in Singapore. As a result, Customer Data is generally processed in Singapore.","context":null,"document":"Privacy Policy, with the Data Processing Addendum for API Services","source_url":"https://docs.z.ai/legal-agreement/privacy-policy","kept_on":"2026-10-26","snapshot_sha256":"a4b5f6921825cd54ce7bcedec9f7847ea4bbf6d72e14fe3ab8d0295ff4a268b0","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/zai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Z.ai","product":"Z.ai API Services (GLM models)","field":"ai_subprocessors","label":"Sub-processors","value":"Group companies and service providers, typically in Singapore; no list","quote":"Company generally provide the Services from Singapore, and our group companies and their designated service providers are typically located in Singapore.","context":null,"document":"Privacy Policy, with the Data Processing Addendum for API Services","source_url":"https://docs.z.ai/legal-agreement/privacy-policy","kept_on":"2026-10-26","snapshot_sha256":"a4b5f6921825cd54ce7bcedec9f7847ea4bbf6d72e14fe3ab8d0295ff4a268b0","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/zai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Z.ai","product":"Z.ai API Services (GLM models)","field":"certifications","label":"Certifications and audits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/zai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Moonshot AI","product":"Kimi OpenPlatform API","field":"trains_on_customer_data","label":"Training on business and API data","value":"Yes, unless agreed otherwise in writing","quote":"Customer who requires restrictions on the use of Customer Content for training or improving Moonshot AI models may contact Moonshot AI to discuss available enterprise arrangements or separate written agreements. Unless otherwise expressly agreed in writing, Customer Content may be used for the foregoing purposes.","context":"The sentence before lists the purposes: “We may use Content to provide, maintain, develop, support, and improve the Services, comply with applicable law, enforce our terms and policies, and keep the Services safe and secure.”","document":"Terms of Service for Kimi OpenPlatform","source_url":"https://platform.kimi.ai/docs/agreement/modeluse","kept_on":"2026-10-26","snapshot_sha256":"2f2977a5126855fd50e4eca35a341fafc3e7876677239d7a6b1a3625873373fe","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/moonshot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Moonshot AI","product":"Kimi OpenPlatform API","field":"customer_data_retention_period","label":"How long API data is kept","value":"While the account is active, with listed exceptions","quote":"Retention periods vary based on factors such as information type, sensitivity, and legal requirements. For example, account, input, and payment information are retained while your account is active. Violation-related information is retained until the violation is resolved. Also, in some cases, the length of time we retain data depends on your settings.","context":null,"document":"Kimi OpenPlatform Privacy Policy","source_url":"https://platform.kimi.ai/docs/agreement/userprivacy","kept_on":"2026-10-26","snapshot_sha256":"2128083a8111ef084b0fae1f330b8f941643b2ef818d35e68392e210e376029c","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/moonshot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Moonshot AI","product":"Kimi OpenPlatform API","field":"zero_data_retention","label":"Option to keep no data","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/moonshot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Moonshot AI","product":"Kimi OpenPlatform API","field":"data_residency","label":"Where data is processed and stored","value":"Stored in Singapore","quote":"We store the information we collect in secure servers located in Singapore.","context":null,"document":"Kimi OpenPlatform Privacy Policy","source_url":"https://platform.kimi.ai/docs/agreement/userprivacy","kept_on":"2026-10-26","snapshot_sha256":"2128083a8111ef084b0fae1f330b8f941643b2ef818d35e68392e210e376029c","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/moonshot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Moonshot AI","product":"Kimi OpenPlatform API","field":"ai_subprocessors","label":"Sub-processors","value":"Service providers by category; no list","quote":"These providers include hosting services, customer service vendors, cloud services, content delivery services, support and safety monitoring services, email communication software, web analytics services, payment and transaction processors, and other information technology providers.","context":null,"document":"Kimi OpenPlatform Privacy Policy","source_url":"https://platform.kimi.ai/docs/agreement/userprivacy","kept_on":"2026-10-26","snapshot_sha256":"2128083a8111ef084b0fae1f330b8f941643b2ef818d35e68392e210e376029c","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/moonshot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Moonshot AI","product":"Kimi OpenPlatform API","field":"certifications","label":"Certifications and audits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/moonshot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Perplexity","product":"Perplexity API Platform","field":"trains_on_customer_data","label":"Training on business and API data","value":"Not by default","quote":"No training by default: Under the API Terms of Service, Perplexity does not use Customer Content to train generative AI models. Certain APIs may be subject to product-specific terms.","context":null,"document":"API Privacy & Security","source_url":"https://docs.perplexity.ai/docs/resources/privacy-security","kept_on":"2026-10-26","snapshot_sha256":"9ee8051da300c4378c115cd4a057dc66bdc9b63855ad9c9fd8f1cc201228fea1","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/perplexity/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Perplexity","product":"Perplexity API Platform","field":"customer_data_retention_period","label":"How long API data is kept","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/perplexity/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Perplexity","product":"Perplexity API Platform","field":"zero_data_retention","label":"Option to keep no data","value":"Zero Data Retention, for eligible customers by written agreement","quote":"ZDR is available only to eligible customers through an account-level configuration under a written agreement with Perplexity.","context":"Not every model supports it: “Some providers require limited retention as a condition of offering their models.”","document":"API Privacy & Security","source_url":"https://docs.perplexity.ai/docs/resources/privacy-security","kept_on":"2026-10-26","snapshot_sha256":"9ee8051da300c4378c115cd4a057dc66bdc9b63855ad9c9fd8f1cc201228fea1","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/perplexity/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Perplexity","product":"Perplexity API Platform","field":"data_residency","label":"Where data is processed and stored","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/perplexity/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Perplexity","product":"Perplexity API Platform","field":"ai_subprocessors","label":"Sub-processors","value":"Listed on its Trust Center","quote":"Personal data: Perplexity processes personal data in accordance with its Data Processing Addendum, and information about subprocessors is available on Perplexity’s Trust Center.","context":null,"document":"API Privacy & Security","source_url":"https://docs.perplexity.ai/docs/resources/privacy-security","kept_on":"2026-10-26","snapshot_sha256":"9ee8051da300c4378c115cd4a057dc66bdc9b63855ad9c9fd8f1cc201228fea1","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/perplexity/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Perplexity","product":"Perplexity API Platform","field":"certifications","label":"Certifications and audits","value":"SOC 2 Type II","quote":"SOC 2 Type II Report - Comprehensive security controls audit covering security, availability, processing integrity, confidentiality, and privacy","context":"The same list names a “2025 HIPAA Gap Assessment” and “CAIQlite”.","document":"API Privacy & Security","source_url":"https://docs.perplexity.ai/docs/resources/privacy-security","kept_on":"2026-10-26","snapshot_sha256":"9ee8051da300c4378c115cd4a057dc66bdc9b63855ad9c9fd8f1cc201228fea1","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/perplexity/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft Copilot","product":"Microsoft Copilot for work, formerly Microsoft 365 Copilot","field":"trains_on_customer_data","label":"Training on business and API data","value":"Not used to train foundation LLMs","quote":"Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot.","context":null,"document":"Data, Privacy, and Security for Microsoft Copilot","source_url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","kept_on":"2026-10-26","snapshot_sha256":"d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft Copilot","product":"Microsoft Copilot for work, formerly Microsoft 365 Copilot","field":"customer_data_retention_period","label":"How long API data is kept","value":"Stored with the organization’s Microsoft 365 content; admins set retention","quote":"When you enter prompts using Microsoft Copilot, the information contained within your prompts, the data they retrieve, and the generated responses are processed and stored in alignment with contractual commitments with your organization's other content in Microsoft 365.","context":"The page adds: “Admins can also use Microsoft Purview to set retention policies for the data related to chat interactions with Copilot.”","document":"Data, Privacy, and Security for Microsoft Copilot","source_url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","kept_on":"2026-10-26","snapshot_sha256":"d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft Copilot","product":"Microsoft Copilot for work, formerly Microsoft 365 Copilot","field":"zero_data_retention","label":"Option to keep no data","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft Copilot","product":"Microsoft Copilot for work, formerly Microsoft 365 Copilot","field":"data_residency","label":"Where data is processed and stored","value":"EU traffic stays in the EU Data Boundary, except on Anthropic models","quote":"EU traffic stays within the EU Data Boundary while worldwide traffic can be sent to the EU and other countries or regions for LLM processing.","context":"The next line reads: “Models provided by Anthropic as a subprocessor are currently excluded from the EU Data Boundary.”","document":"Data, Privacy, and Security for Microsoft Copilot","source_url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","kept_on":"2026-10-26","snapshot_sha256":"d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft Copilot","product":"Microsoft Copilot for work, formerly Microsoft 365 Copilot","field":"ai_subprocessors","label":"Sub-processors","value":"Names Anthropic and OpenAI as subprocessors for their models","quote":"For information about models provided by Anthropic as a subprocessor within Microsoft Copilot experiences, see Anthropic models in Microsoft Online Services. For information about models provided by OpenAI as a subprocessor within Microsoft Copilot experiences, see OpenAI as a subprocessor in Microsoft Online Services.","context":null,"document":"Data, Privacy, and Security for Microsoft Copilot","source_url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","kept_on":"2026-10-26","snapshot_sha256":"d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft Copilot","product":"Microsoft Copilot for work, formerly Microsoft 365 Copilot","field":"certifications","label":"Certifications and audits","value":"GDPR, ISO 27001, HIPAA and ISO 42001, as listed","quote":"Microsoft Copilot provides broad compliance offerings and certifications, including GDPR, ISO 27001, HIPAA, and the ISO 42001 standard for AI management systems.","context":null,"document":"Data, Privacy, and Security for Microsoft Copilot","source_url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","kept_on":"2026-10-26","snapshot_sha256":"d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"GitHub Copilot","product":"GitHub Copilot Business and Enterprise","field":"trains_on_customer_data","label":"Training on business and API data","value":"No","quote":"No. GitHub does not use either Copilot Business or Enterprise data to train its models.","context":"Answer to “Does GitHub use Copilot Business or Enterprise data to train GitHub’s model?”","document":"GitHub Copilot, frequently asked questions","source_url":"https://github.com/features/copilot","kept_on":"2026-10-26","snapshot_sha256":"30826739dddc8befe67f24935ff304a2a9924bccdae74cb429ccfe8f73d2b423","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/github-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"GitHub Copilot","product":"GitHub Copilot Business and Enterprise","field":"trains_on_free_use","label":"Training on free and consumer use","value":"Yes on Free, Pro and Pro+, unless the user opts out","quote":"Starting on April 24, GitHub may also use interactions from users with a Copilot Free, Copilot Pro, and Copilot Pro+ subscription - including inputs, outputs, code snippets, and associated context - to train and improve our AI models unless they have opted out.","context":null,"document":"GitHub Copilot, frequently asked questions","source_url":"https://github.com/features/copilot","kept_on":"2026-10-26","snapshot_sha256":"30826739dddc8befe67f24935ff304a2a9924bccdae74cb429ccfe8f73d2b423","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/github-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"GitHub Copilot","product":"GitHub Copilot Business and Enterprise","field":"customer_data_retention_period","label":"How long API data is kept","value":"Not kept in the IDE; 28 days for other use, with listed exceptions","quote":"Access through IDE for Chat and Code Completions: Prompts and Suggestions: Not retained User Engagement Data: Kept for two years. Feedback Data: Stored for as long as needed for its intended purpose. All other GitHub Copilot access and use: Prompts and Suggestions: Retained for 28 days.","context":"These are the default settings for Copilot Business and Enterprise customers.","document":"GitHub Copilot, frequently asked questions","source_url":"https://github.com/features/copilot","kept_on":"2026-10-26","snapshot_sha256":"30826739dddc8befe67f24935ff304a2a9924bccdae74cb429ccfe8f73d2b423","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/github-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"GitHub Copilot","product":"GitHub Copilot Business and Enterprise","field":"zero_data_retention","label":"Option to keep no data","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/github-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"GitHub Copilot","product":"GitHub Copilot Business and Enterprise","field":"data_residency","label":"Where data is processed and stored","value":"Listed for each sub-processor; AI inference in the US and other countries","quote":"Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore","context":"Each row of the list gives a “Location of Processing”. Fireworks AI lists “United States, Germany, Iceland”.","document":"GitHub Subprocessors","source_url":"https://docs.github.com/en/site-policy/privacy-policies/github-subprocessors","kept_on":"2026-10-26","snapshot_sha256":"fafcdb7003b578650b127a8fab76f9970f860fb04ea0e0cc28f50c4ff0f81407","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/github-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"GitHub Copilot","product":"GitHub Copilot Business and Enterprise","field":"ai_subprocessors","label":"Sub-processors","value":"A published list; new names 30 days in advance","quote":"GitHub publishes the names of any new subprocessors for its online services at least 30 days in advance of the subprocessor’s authorization to perform services that may involve access to customer data or personal data.","context":null,"document":"GitHub Subprocessors","source_url":"https://docs.github.com/en/site-policy/privacy-policies/github-subprocessors","kept_on":"2026-10-26","snapshot_sha256":"fafcdb7003b578650b127a8fab76f9970f860fb04ea0e0cc28f50c4ff0f81407","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/github-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"GitHub Copilot","product":"GitHub Copilot Business and Enterprise","field":"certifications","label":"Certifications and audits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/github-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cursor","product":"Cursor, by Anysphere","field":"trains_on_customer_data","label":"Training on business and API data","value":"Not with Privacy Mode on","quote":"If you choose to turn off “Privacy Mode”: we may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models.","context":"With Privacy Mode on: “Customer Data will not be used for training by Cursor.” The page does not say which setting is the default.","document":"Data Use & Privacy Overview","source_url":"https://cursor.com/data-use","kept_on":"2026-10-26","snapshot_sha256":"3c9ff56d3aa0af39ff66c7ff75e6f005efe1a0a42ed42b9e4c0ab869d9e17c7e","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cursor/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cursor","product":"Cursor, by Anysphere","field":"customer_data_retention_period","label":"How long API data is kept","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cursor/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cursor","product":"Cursor, by Anysphere","field":"zero_data_retention","label":"Option to keep no data","value":"With Privacy Mode on, ZDR agreements with all providers; non-ZDR models are marked or need an admin; flagged data may be kept for investigation","quote":"Cursor maintains zero data retention (ZDR) agreements with all providers, and AI model providers will not store or train on your data.","context":"The same paragraph: “Non-ZDR models will be designated as such or require an admin to opt-in to enable the model for your workspace.” Abuse detectors can keep data for investigation.","document":"Data Use & Privacy Overview","source_url":"https://cursor.com/data-use","kept_on":"2026-10-26","snapshot_sha256":"3c9ff56d3aa0af39ff66c7ff75e6f005efe1a0a42ed42b9e4c0ab869d9e17c7e","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cursor/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cursor","product":"Cursor, by Anysphere","field":"data_residency","label":"Where data is processed and stored","value":"No infrastructure in China","quote":"Cursor does not use or maintain any infrastructure in China.","context":null,"document":"Security","source_url":"https://cursor.com/security","kept_on":"2026-10-26","snapshot_sha256":"66d02e9bb248ee28dcc5021959006a025143b33828873662622d1124aa7d4134","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cursor/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cursor","product":"Cursor, by Anysphere","field":"ai_subprocessors","label":"Sub-processors","value":"Listed on its trust portal; none headquartered in China","quote":"Our list of subprocessors is published on our trust portal.","context":"The same section adds: “We do not use any companies headquartered in China as subprocessors, and to our knowledge none of our subprocessors do either.”","document":"Security","source_url":"https://cursor.com/security","kept_on":"2026-10-26","snapshot_sha256":"66d02e9bb248ee28dcc5021959006a025143b33828873662622d1124aa7d4134","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cursor/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cursor","product":"Cursor, by Anysphere","field":"certifications","label":"Certifications and audits","value":"SOC 2 Type II; ISO 27001, ISO 42001 and AIUC-1","quote":"Cursor holds AIUC-1, ISO/IEC 27001:2022, and ISO/IEC 42001:2023 certifications, along with a SOC 2 Type II attestation.","context":null,"document":"Security","source_url":"https://cursor.com/security","kept_on":"2026-10-26","snapshot_sha256":"66d02e9bb248ee28dcc5021959006a025143b33828873662622d1124aa7d4134","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cursor/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."}]}