{"title":"The AI vendor record: what each vendor’s own pages say on training and retention, quoted","page":"https://jesseahawkins.com/vendors/","csv":"https://jesseahawkins.com/vendors.csv","terms":["quoted for comment"],"checked":"2026-11-04","nextCheckBy":"2026-12-04","fields":[{"name":"vendor","type":"string"},{"name":"product","type":"string"},{"name":"field","type":"string"},{"name":"label","type":"string"},{"name":"value","type":"string"},{"name":"quote","type":"string"},{"name":"context","type":"string"},{"name":"document","type":"string"},{"name":"source_url","type":"string"},{"name":"kept_on","type":"string"},{"name":"snapshot_sha256","type":"string"},{"name":"license","type":"string"},{"name":"page","type":"string"},{"name":"notice","type":"string"}],"rowCount":174,"rows":[{"vendor":"OpenAI","product":"OpenAI API","field":"trains_on_customer_data","label":"Training on business and API data","value":"Not by default","quote":"As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us).","context":null,"document":"Data controls in the OpenAI platform","source_url":"https://developers.openai.com/api/docs/guides/your-data","kept_on":"2026-10-24","snapshot_sha256":"d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/openai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"OpenAI","product":"OpenAI API","field":"customer_data_retention_period","label":"How long API data is kept","value":"Up to 30 days in abuse monitoring logs, with listed exceptions","quote":"By default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days, unless longer retention is required by law, or is reasonably necessary to protect our services or any third party from harm.","context":"Under “Data retention controls for abuse monitoring”. Application state is kept separately; for /v1/responses the page says “response data will be stored for at least 30 days.”","document":"Data controls in the OpenAI platform","source_url":"https://developers.openai.com/api/docs/guides/your-data","kept_on":"2026-10-24","snapshot_sha256":"d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/openai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"OpenAI","product":"OpenAI API","field":"zero_data_retention","label":"Option to keep no data","value":"Zero Data Retention, on approval","quote":"Eligible customers may have their customer content excluded from these abuse monitoring logs, subject to the limitations below, by getting approved for the Zero Data Retention or Modified Abuse Monitoring controls.","context":null,"document":"Data controls in the OpenAI platform","source_url":"https://developers.openai.com/api/docs/guides/your-data","kept_on":"2026-10-24","snapshot_sha256":"d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/openai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"OpenAI","product":"OpenAI API","field":"data_residency","label":"Where data is processed and stored","value":"Data residency controls, for eligible customers","quote":"Data residency controls are a project configuration option that allow you to configure the location of infrastructure OpenAI uses to provide services.","context":"The next line reads: “Contact our sales team to see if you’re eligible for using data residency controls.”","document":"Data controls in the OpenAI platform","source_url":"https://developers.openai.com/api/docs/guides/your-data","kept_on":"2026-10-24","snapshot_sha256":"d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/openai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"OpenAI","product":"OpenAI API","field":"ai_subprocessors","label":"Sub-processors","value":"Uses sub-processors; names Cloudflare for the US and EU endpoints","quote":"OpenAI uses sub-processors to provide its services. For requests sent to us.api.openai.com or eu.api.openai.com, OpenAI uses Cloudflare Regional Services so that TLS termination and HTTPS decryption occur within the selected processing region.","context":null,"document":"Data controls in the OpenAI platform","source_url":"https://developers.openai.com/api/docs/guides/your-data","kept_on":"2026-10-24","snapshot_sha256":"d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/openai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"OpenAI","product":"OpenAI API","field":"certifications","label":"Certifications and audits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/openai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"OpenAI","product":"OpenAI API","field":"dpa","label":"Data processing agreement","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/openai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"OpenAI","product":"OpenAI API","field":"usage_limits","label":"Published usage limits","value":"Rate limits by model, organization and project; usage tiers rise with credit purchases","quote":"The three paid usage tiers are Build, Launch, and Grow. Your organization’s usage tier upgrades automatically as its total credit purchases reach each threshold.","context":"The page also says: “Rate limits are defined at the organization level and at the project level, not user level.” and “OpenAI sets an approved monthly usage limit for each organization.”","document":"Rate limits","source_url":"https://developers.openai.com/api/docs/guides/rate-limits","kept_on":"2026-11-03","snapshot_sha256":"850e5704abd712706740bd40223a26958bc4579dcb2fc0e361250d2b1a0ad81a","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/openai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Anthropic","product":"Anthropic API and Claude commercial products","field":"trains_on_customer_data","label":"Training on business and API data","value":"Not by default","quote":"By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models.","context":null,"document":"Is my data used for model training?","source_url":"https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training","kept_on":"2026-10-24","snapshot_sha256":"54617b76403faa9ba4db2ad4b7ba43a5c8d98fb8d9a2efbdbe18caac95e8a450","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/anthropic/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Anthropic","product":"Anthropic API and Claude commercial products","field":"customer_data_retention_period","label":"How long API data is kept","value":"Anthropic API: deleted within 30 days, with listed exceptions","quote":"For Anthropic API users, we automatically delete inputs and outputs on our backend within 30 days of receipt or generation","context":"Under “Standard Retention Timeframe”. The sentence continues with exceptions: longer-retention services such as the Files API, a zero data retention or other agreement, Usage Policy enforcement, and law. For other commercial products the page says: “we retain your chats and coding sessions in the product to provide you with a consistent product experience.”","document":"How long do you store my organization's data?","source_url":"https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data","kept_on":"2026-10-24","snapshot_sha256":"31c58317fd20d708fdb599ee7a29d7d8bd7875152c2cdad9fcc4a427c15149c0","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/anthropic/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Anthropic","product":"Anthropic API and Claude commercial products","field":"zero_data_retention","label":"Option to keep no data","value":"Zero data retention, by agreement","quote":"When you and we have agreed otherwise (e.g. zero data retention agreement)","context":"Under “Standard Retention Timeframe”, one of the listed exceptions to the rule that Anthropic API inputs and outputs are deleted within 30 days.","document":"How long do you store my organization's data?","source_url":"https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data","kept_on":"2026-10-24","snapshot_sha256":"31c58317fd20d708fdb599ee7a29d7d8bd7875152c2cdad9fcc4a427c15149c0","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/anthropic/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Anthropic","product":"Anthropic API and Claude commercial products","field":"data_residency","label":"Where data is processed and stored","value":"API inference: global by default (any geography) or US-only via inference_geo on Claude 4.6 and later, on the first-party API (except the OpenAI SDK compatibility endpoint) and some partner platforms; workspace data at rest: US only","quote":"Data residency controls let you manage where your data is processed and stored.","context":"The page says “Inference may run in any available geography for optimal performance and availability” for the default, “global”. Also: “The inference_geo parameter is supported on Claude 4.6 and later models.” Workspace geo: “Currently, \"us\" is the only available workspace geo.”","document":"Data residency","source_url":"https://platform.claude.com/docs/en/manage-claude/data-residency","kept_on":"2026-10-26","snapshot_sha256":"0171e6e8e8a1d63a6e24483d2d437d75b8ef141e26b197787c969208bb2345a7","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/anthropic/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Anthropic","product":"Anthropic API and Claude commercial products","field":"ai_subprocessors","label":"Sub-processors","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/anthropic/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Anthropic","product":"Anthropic API and Claude commercial products","field":"certifications","label":"Certifications and audits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/anthropic/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Anthropic","product":"Anthropic API and Claude commercial products","field":"dpa","label":"Data processing agreement","value":"Incorporated into the Commercial Terms by reference","quote":"Data submitted through the Services will be processed in accordance with the Anthropic Data Processing Addendum (“DPA”), which is incorporated into these Terms by reference.","context":null,"document":"Commercial Terms of Service","source_url":"https://www.anthropic.com/legal/commercial-terms","kept_on":"2026-10-24","snapshot_sha256":"97857ac41eabfc4bacacf57225c8385b826ffb63164398912db6e4219e4a8bb3","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/anthropic/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Anthropic","product":"Anthropic API and Claude commercial products","field":"usage_limits","label":"Published usage limits","value":"Spend and rate limits by usage tier, set from usage history and account standing","quote":"Limits are defined by usage tier. Organizations are placed on a tier automatically based on usage history and account standing and can move to a higher tier over time as they use the API.","context":"The page says: “All limits described here represent maximum allowed usage, not guaranteed minimums.” and “Organizations on the Custom tier have no monthly spend cap; limits are arranged with their account team.”","document":"Rate limits","source_url":"https://platform.claude.com/docs/en/api/rate-limits","kept_on":"2026-11-03","snapshot_sha256":"f865562bc3ba79d38ed8e5e7783e1ab30b0557fd518e6c1a7ed412f8caaba3c5","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/anthropic/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Google","product":"Gemini API and Gemini models on Google Cloud","field":"trains_on_customer_data","label":"Training on business and API data","value":"Not used to improve products, on paid use","quote":"When you use Paid Services, including, for example, the paid quota of the Gemini API, Google doesn't use your prompts (including associated system instructions, cached content, and files such as images, videos, or documents) or responses to improve our products","context":null,"document":"Gemini API Additional Terms of Service","source_url":"https://ai.google.dev/gemini-api/terms?hl=en","kept_on":"2026-10-24","snapshot_sha256":"0424aabe6c15afb2fd95ffdb4d70aadc44796c9d2f43592acfb015c56559734e","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/google/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Google","product":"Gemini API and Gemini models on Google Cloud","field":"trains_on_free_use","label":"Training on free and consumer use","value":"Used to improve products, on unpaid use outside the EEA, Switzerland and the UK","quote":"When you use Unpaid Services, including, for example, Google AI Studio and the unpaid quota on Gemini API, Google uses the content you submit to the Services and any generated responses to provide, improve, and develop Google products and services and machine learning technologies","context":"Under “Unpaid Services”, “How Google Uses Your Data”. The same section says: “If you're in the European Economic Area, Switzerland, or the United Kingdom, the terms under \"How Google uses Your Data\" in \"Paid Services\" apply to all Services, including Google AI Studio and unpaid quota in the Gemini API, even though they are offered free of charge.”","document":"Gemini API Additional Terms of Service","source_url":"https://ai.google.dev/gemini-api/terms?hl=en","kept_on":"2026-10-24","snapshot_sha256":"0424aabe6c15afb2fd95ffdb4d70aadc44796c9d2f43592acfb015c56559734e","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/google/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Google","product":"Gemini API and Gemini models on Google Cloud","field":"customer_data_retention_period","label":"How long API data is kept","value":"A limited period, for abuse detection and legal disclosures, on paid use","quote":"For Paid Services, Google logs prompts and responses for a limited period of time, solely for detecting and preventing violations of the Prohibited Use Policy to maintain the safety and security of the Services, and any required legal or regulatory disclosures.","context":"Under “Paid Services”, “How Google Uses Your Data”. The page does not state the length of the period. Some features have their own terms; for Grounding with Google Search the page says Google will store prompts, contextual information that you may provide, and output for thirty (30) days.","document":"Gemini API Additional Terms of Service","source_url":"https://ai.google.dev/gemini-api/terms?hl=en","kept_on":"2026-10-24","snapshot_sha256":"0424aabe6c15afb2fd95ffdb4d70aadc44796c9d2f43592acfb015c56559734e","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/google/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Google","product":"Gemini API and Gemini models on Google Cloud","field":"zero_data_retention","label":"Option to keep no data","value":"Zero data retention on Google Cloud, with customer actions; not possible with some features","quote":"To achieve zero data retention, customers must take specific actions within each of these areas:","context":"Under “Customer data retention and achieving zero data retention”. The same page says: “Zero data retention may not be possible when using some Advanced AI features.” and, for Grounding with Google Search and Google Maps, “There is no way to disable the storage of this information”.","document":"Gemini Enterprise Agent Platform and zero data retention","source_url":"https://docs.cloud.google.com/gemini-enterprise-agent-platform/resources/zero-data-retention","kept_on":"2026-10-24","snapshot_sha256":"dca5cdf5c2adfdd633ad5d1a6f3cabc94ce13e9cff0daacccd29d591ee853056","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/google/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Google","product":"Gemini API and Gemini models on Google Cloud","field":"data_residency","label":"Where data is processed and stored","value":"On Google Cloud: at rest in the chosen location; global endpoints carry no guarantee","quote":"Data stored at rest in the customer selected location remains at rest in that location, independent of the Gemini Enterprise Agent Platform endpoint called by that customer's request.","context":"The page adds: “Requests submitted to a global endpoint may be processed in any Google Cloud location around the world, and therefore don't provide any data residency guarantees.”","document":"Data residency","source_url":"https://docs.cloud.google.com/gemini-enterprise-agent-platform/resources/data-residency","kept_on":"2026-10-26","snapshot_sha256":"dbd4fd892d3f15210d9d553cb2e6920be55a339c3fe9ec124cc6501551d0040b","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/google/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Google","product":"Gemini API and Gemini models on Google Cloud","field":"ai_subprocessors","label":"Sub-processors","value":"A published list for Google Cloud, AI services included","quote":"Google and its affiliates engage the third-party entities in the table below to perform limited activities in connection with the Google Cloud Platform Services.","context":"Several rows name the service “All AI Solutions, Pre-Trained APIs, AI Platform/Gemini platform (formerly Vertex AI), Generative AI Services and Agentic AI Services”.","document":"Google Cloud Platform Subprocessors","source_url":"https://cloud.google.com/terms/subprocessors","kept_on":"2026-10-26","snapshot_sha256":"a6ed1984ff40698b2be48013e848b0eea59c98994ce442ecc48211e699a547d6","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/google/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Google","product":"Gemini API and Gemini models on Google Cloud","field":"certifications","label":"Certifications and audits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/google/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Google","product":"Gemini API and Gemini models on Google Cloud","field":"dpa","label":"Data processing agreement","value":"Prompts and responses on paid use processed under Google’s Data Processing Addendum","quote":"will process your prompts and responses in accordance with the Data Processing Addendum for Products Where Google is a Data Processor.","context":"Under “Paid Services”, “How Google Uses Your Data”. The terms say that in the European Economic Area, Switzerland and the United Kingdom the data-use terms under Paid Services (“How Google Uses Your Data”) apply to all Services, unpaid quota included. The same terms also name the “Google Controller-Controller Data Protection Terms”.","document":"Gemini API Additional Terms of Service","source_url":"https://ai.google.dev/gemini-api/terms?hl=en","kept_on":"2026-10-24","snapshot_sha256":"0424aabe6c15afb2fd95ffdb4d70aadc44796c9d2f43592acfb015c56559734e","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/google/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Google","product":"Gemini API and Gemini models on Google Cloud","field":"usage_limits","label":"Published usage limits","value":"Quotas by Google Cloud project, with default values that can typically be adjusted on request; fixed system limits","quote":"Quotas have default values, but you can typically request adjustments. System limits are fixed values that can't be changed.","context":"This page covers Gemini models on Google Cloud. The Gemini API rate-limit page draws its text with script, so the record does not keep it.","document":"Generative AI on Agent Platform quotas and system limits","source_url":"https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/quotas","kept_on":"2026-11-03","snapshot_sha256":"6185f73bdf51ac2bfd828e872aed6e5509eeaf398295c6b36b9b0960a04ffa2f","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/google/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft","product":"Azure OpenAI and other models sold by Azure in Microsoft Foundry","field":"trains_on_customer_data","label":"Training on business and API data","value":"Not without permission","quote":"Your prompts (inputs) and completions (outputs), your embeddings, and your training data: are NOT available to other customers. are NOT available to OpenAI or other providers of Models sold by Azure. are NOT used by providers of Models sold by Azure to improve their models or services. are NOT used to train any generative AI foundation models without your permission or instruction.","context":null,"document":"Data, privacy, and security for Foundry Models sold by Azure","source_url":"https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy","kept_on":"2026-10-24","snapshot_sha256":"cb7f0b5243c1a1e30e5074c37119277a1f985a202df84c4f208cc881f9f23a54","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft","product":"Azure OpenAI and other models sold by Azure in Microsoft Foundry","field":"customer_data_retention_period","label":"How long API data is kept","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft","product":"Azure OpenAI and other models sold by Azure in Microsoft Foundry","field":"zero_data_retention","label":"Option to keep no data","value":"Modified abuse monitoring, by application","quote":"Microsoft allows customers who meet additional Limited Access eligibility criteria to apply to modify abuse monitoring by completing this form.","context":null,"document":"Abuse monitoring","source_url":"https://learn.microsoft.com/en-us/azure/foundry/openai/concepts/abuse-monitoring","kept_on":"2026-10-24","snapshot_sha256":"8ccd372f07b1ff5025f76ee926a327ed635d65e8bc318ac3d3a498f194d57f6f","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft","product":"Azure OpenAI and other models sold by Azure in Microsoft Foundry","field":"data_residency","label":"Where data is processed and stored","value":"In the customer’s chosen geography, except Global and DataZone deployments","quote":"Prompts and responses are processed within the customer-specified geography (unless you are using a Global or DataZone deployment type), but may be processed between regions within the geography for operational purposes (including performance and capacity management).","context":null,"document":"Data, privacy, and security for Foundry Models sold by Azure","source_url":"https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy","kept_on":"2026-10-24","snapshot_sha256":"cb7f0b5243c1a1e30e5074c37119277a1f985a202df84c4f208cc881f9f23a54","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft","product":"Azure OpenAI and other models sold by Azure in Microsoft Foundry","field":"ai_subprocessors","label":"Sub-processors","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft","product":"Azure OpenAI and other models sold by Azure in Microsoft Foundry","field":"certifications","label":"Certifications and audits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft","product":"Azure OpenAI and other models sold by Azure in Microsoft Foundry","field":"dpa","label":"Data processing agreement","value":"The Microsoft data protection addendum, part of the Product Terms","quote":"When you subscribe to a Product under the terms of the Product Terms site, the data processing and security terms are defined in Microsoft Online Services Data Protection Addendum (DPA). The DPA is an addendum to the Product Terms site (and formerly OST).","context":null,"document":"Microsoft Products and Services Data Protection Addendum","source_url":"https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA","kept_on":"2026-11-03","snapshot_sha256":"7bf9a5c835832217c1460f4d1a6b908d5d5b887304dd7744d7152f07f61f1b92","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft","product":"Azure OpenAI and other models sold by Azure in Microsoft Foundry","field":"usage_limits","label":"Published usage limits","value":"Quotas by Azure subscription and quota tier; tiers rise with usage unless the customer opts out","quote":"Quotas now increase automatically with usage, helping avoid rate limit errors while also creating a fairer environment for all users.","context":"The page says: “Seven tiers are available: Free Tier and Tiers 1 through 6 - with Tier 6 offering the highest quotas.” Tier eligibility “can depend on usage, payment history, and the subscription’s Azure offer.”","document":"Azure OpenAI in Microsoft Foundry Models quotas and limits","source_url":"https://learn.microsoft.com/en-us/azure/foundry/openai/quotas-limits","kept_on":"2026-11-03","snapshot_sha256":"0765f2922a09a1576510fa1111377199c0945476b2066bb55bedad78cb91deaa","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"AWS","product":"Amazon Bedrock","field":"trains_on_customer_data","label":"Training on business and API data","value":"No, for Amazon Nova, Amazon Titan and third-party models","quote":"No, AWS and the third-party model providers will not use any inputs to or outputs from Amazon Bedrock to train Amazon Nova, Amazon Titan, or any third-party models.","context":"Answer to the FAQ “Will AWS and third-party model providers use customer inputs to or outputs from Amazon Bedrock to train Amazon Nova, Amazon Titan or any third-party models?”","document":"Amazon Bedrock FAQs","source_url":"https://aws.amazon.com/bedrock/faqs/","kept_on":"2026-10-24","snapshot_sha256":"b48072e9d7367e42810904e0a76cd855f3583e22f714aa924bdf453312e751ce","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/aws/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"AWS","product":"Amazon Bedrock","field":"customer_data_retention_period","label":"How long API data is kept","value":"Set by the model and the account's retention mode","quote":"Default means the data retention policy of the model applies. There is no change to previous model retention behavior; if ZDR applied previously, then ZDR still applies. Actual retention depends on the model — consult the model's terms for specifics.","context":null,"document":"Data retention","source_url":"https://docs.aws.amazon.com/bedrock/latest/userguide/data-retention.html","kept_on":"2026-10-24","snapshot_sha256":"a7a8c4c5f2f7d3fbcd9a722db22b01822e09ddbfc7ee27aae794c3e3a757d163","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/aws/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"AWS","product":"Amazon Bedrock","field":"zero_data_retention","label":"Option to keep no data","value":"Zero data retention mode, for models that allow it; for other models, eligibility is evaluated per account and model","quote":"Zero data retention. No request or response data is written to durable storage by AWS or shared with the model provider.","context":"In the “Data retention modes” table, the behavior of mode “none”. Under “Zero data retention (ZDR) access” the page says: “Some models require data retention for safety and abuse-prevention purposes.” and “ZDR access is evaluated on a per-account, per-model basis in coordination with the model provider.”","document":"Data retention","source_url":"https://docs.aws.amazon.com/bedrock/latest/userguide/data-retention.html","kept_on":"2026-10-24","snapshot_sha256":"a7a8c4c5f2f7d3fbcd9a722db22b01822e09ddbfc7ee27aae794c3e3a757d163","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/aws/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"AWS","product":"Amazon Bedrock","field":"data_residency","label":"Where data is processed and stored","value":"Stored at rest in the AWS Region in use","quote":"Any customer content processed by Amazon Bedrock is encrypted and stored at rest in the AWS Region where you are using Amazon Bedrock.","context":null,"document":"Amazon Bedrock FAQs","source_url":"https://aws.amazon.com/bedrock/faqs/","kept_on":"2026-10-24","snapshot_sha256":"b48072e9d7367e42810904e0a76cd855f3583e22f714aa924bdf453312e751ce","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/aws/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"AWS","product":"Amazon Bedrock","field":"ai_subprocessors","label":"Sub-processors","value":"A published list, by Region and service","quote":"Sub-processors relevant to an individual customer will depend on the AWS Region the customer selects and the particular AWS services that the customer uses.","context":null,"document":"AWS Sub-processors","source_url":"https://aws.amazon.com/compliance/sub-processors/","kept_on":"2026-10-26","snapshot_sha256":"f2060d7e438446b0ed1f7c951c195c9268e686dff08f34a64b33336d68bf2295","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/aws/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"AWS","product":"Amazon Bedrock","field":"certifications","label":"Certifications and audits","value":"In scope for FedRAMP Moderate, SOC, ISO and HIPAA eligibility","quote":"Amazon Bedrock is in scope for common compliance standards such as Fedramp Moderate, Service and Organization Control (SOC), International Organization for Standardization (ISO), Health Insurance Portability and Accountability Act (HIPAA) eligibility, and customers can use Bedrock in compliance with the General Data Protection Regulation (GDPR).","context":"The same answer lists “ISO 9001, ISO 27001, ISO 27017, ISO 27018, ISO 27701, ISO 22301, and ISO 20000”.","document":"Amazon Bedrock FAQs","source_url":"https://aws.amazon.com/bedrock/faqs/","kept_on":"2026-10-24","snapshot_sha256":"b48072e9d7367e42810904e0a76cd855f3583e22f714aa924bdf453312e751ce","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/aws/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"AWS","product":"Amazon Bedrock","field":"dpa","label":"Data processing agreement","value":"The AWS Data Processing Addendum, under which AWS engages sub-processors","quote":"This page provides information about the sub-processors that AWS has engaged in accordance with the AWS Data Processing Addendum (AWS DPA) to provide processing activities on Customer Data (as defined in the AWS DPA) on behalf of customers.","context":null,"document":"AWS Sub-processors","source_url":"https://aws.amazon.com/compliance/sub-processors/","kept_on":"2026-10-26","snapshot_sha256":"f2060d7e438446b0ed1f7c951c195c9268e686dff08f34a64b33336d68bf2295","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/aws/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"AWS","product":"Amazon Bedrock","field":"usage_limits","label":"Published usage limits","value":"Default quotas on token use, and on requests for embedding models; an account’s own quotas can be lower","quote":"Model inference in Amazon Bedrock is controlled by quotas on token usage.","context":"The page says the quotas that apply to an account “might be lower than the default values listed in the Amazon Bedrock service quotas.” It also says: “Quota increases aren't granted automatically.”","document":"Quotas for Amazon Bedrock","source_url":"https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html","kept_on":"2026-11-03","snapshot_sha256":"9fb23c7957aed30b8d8c5cc8144d8240c1808e0dff9c0ef7b6c9f6d4c75d06ad","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/aws/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Mistral AI","product":"Mistral Studio and Vibe","field":"trains_on_customer_data","label":"Training on business and API data","value":"Opt-out offered on Mistral Studio pay-as-you-go; Vibe Enterprise is opted out by default","quote":"Customers retain full control over this processing and have the right to opt out at any time.","context":"Under “Pay-as-you-go”, in “Controls on Mistral Studio”. Under “Vibe (Enterprise)” the page says: “Enterprise customers are opted out of training by default.”","document":"Do you use my user data to train your Artificial Intelligence models?","source_url":"https://help.mistral.ai/en/articles/347617-do-you-use-my-user-data-to-train-your-artificial-intelligence-models","kept_on":"2026-10-24","snapshot_sha256":"d89b5b5e734d152d8688519b0a5e89ead5f72b8361021febf216a7dfae1c4bdf","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/mistral/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Mistral AI","product":"Mistral Studio and Vibe","field":"trains_on_free_use","label":"Training on free and consumer use","value":"Yes by default on Vibe, with an opt-out","quote":"Input and output data are used by default to train our artificial intelligence models, unless you opt out of training at any time.","context":"Under “Vibe”, in “Controls on Vibe”.","document":"Do you use my user data to train your Artificial Intelligence models?","source_url":"https://help.mistral.ai/en/articles/347617-do-you-use-my-user-data-to-train-your-artificial-intelligence-models","kept_on":"2026-10-24","snapshot_sha256":"d89b5b5e734d152d8688519b0a5e89ead5f72b8361021febf216a7dfae1c4bdf","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/mistral/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Mistral AI","product":"Mistral Studio and Vibe","field":"customer_data_retention_period","label":"How long API data is kept","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/mistral/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Mistral AI","product":"Mistral Studio and Vibe","field":"zero_data_retention","label":"Option to keep no data","value":"Zero Data Retention, pay-as-you-go stateless API calls, on approved request","quote":"Zero Data Retention (ZDR) is available only with pay-as-you-go and only for stateless API calls.","context":"Under “How to request ZDR” the same page says: “We will review your request and, at our discretion, approve or deny it.”","document":"Can I activate Zero Data Retention (ZDR)?","source_url":"https://help.mistral.ai/en/articles/347612-can-i-activate-zero-data-retention-zdr","kept_on":"2026-10-24","snapshot_sha256":"c96aadfeac722f65391666944a3e15859341f48d6418bf79e34919e2cd8b2d49","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/mistral/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Mistral AI","product":"Mistral Studio and Vibe","field":"data_residency","label":"Where data is processed and stored","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/mistral/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Mistral AI","product":"Mistral Studio and Vibe","field":"ai_subprocessors","label":"Sub-processors","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/mistral/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Mistral AI","product":"Mistral Studio and Vibe","field":"certifications","label":"Certifications and audits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/mistral/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Mistral AI","product":"Mistral Studio and Vibe","field":"dpa","label":"Data processing agreement","value":"Published online; Mistral does not sign it offline","quote":"Our Data Processing Agreement (DPA) is available in our Data Processing Addendum and is regularly updated to reflect our processing, services, security measures, and applicable regulations. We cannot sign the DPA offline.","context":null,"document":"Can I activate Zero Data Retention (ZDR)?","source_url":"https://help.mistral.ai/en/articles/347612-can-i-activate-zero-data-retention-zdr","kept_on":"2026-10-24","snapshot_sha256":"c96aadfeac722f65391666944a3e15859341f48d6418bf79e34919e2cd8b2d49","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/mistral/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Mistral AI","product":"Mistral Studio and Vibe","field":"usage_limits","label":"Published usage limits","value":"Rate limits per model, set by the plan and shown in the Admin Panel, not on the page; spending limits by organization and workspace","quote":"API rate limits define how much traffic your Organization can send. They are shown in Admin Panel›API›Limits ↗.","context":"The page says: “Your Mistral plan defines the included monthly usage and limits available to your Organization.”","document":"Usage and limits","source_url":"https://docs.mistral.ai/admin/billing-usage/usage-limits","kept_on":"2026-11-03","snapshot_sha256":"4f6f0eeb88959160fbfc9f5b822009fd0bb400e6d9eaa82e473a46e58a95b6f6","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/mistral/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cohere","product":"Cohere SaaS platform","field":"trains_on_customer_data","label":"Training on business and API data","value":"Opt-out offered","quote":"Enterprise customers can access opt out toggle in the Cohere dashboard settings. If you are opted out, prompts and generations will not be used to train Cohere models.","context":null,"document":"Enterprise data commitments","source_url":"https://cohere.com/enterprise-data-commitments","kept_on":"2026-10-24","snapshot_sha256":"efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cohere/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cohere","product":"Cohere SaaS platform","field":"customer_data_retention_period","label":"How long API data is kept","value":"Deleted after 30 days, with listed exceptions","quote":"For the SaaS Platform, we automatically delete logged prompts and generations after 30 days, unless we need to retain them to comply with a legal requirement or a customer contract, or unless your usage is flagged as potentially violating our terms, including our Usage Policy (e.g. abuse or misuse of our services).","context":"Under the FAQ “How long does Cohere retain enterprise data?”. The same answer says: “Prompts and generations that you allow Cohere to use for training purposes may be retained separately.”","document":"Enterprise data commitments","source_url":"https://cohere.com/enterprise-data-commitments","kept_on":"2026-10-24","snapshot_sha256":"efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cohere/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cohere","product":"Cohere SaaS platform","field":"zero_data_retention","label":"Option to keep no data","value":"Zero data retention, on request, for enterprise customers who make additional usage commitments","quote":"we only allow ZDR for enterprise customers who can make additional commitments about their usage of the Cohere Services","context":"Under the FAQ “What is zero data retention and how do I request it?”. The same answer says: “ZDR does not affect usage data, which Cohere still receives.”","document":"Enterprise data commitments","source_url":"https://cohere.com/enterprise-data-commitments","kept_on":"2026-10-24","snapshot_sha256":"efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cohere/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cohere","product":"Cohere SaaS platform","field":"data_residency","label":"Where data is processed and stored","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cohere/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cohere","product":"Cohere SaaS platform","field":"ai_subprocessors","label":"Sub-processors","value":"Listed on its Trust Center","quote":"You can view a list of sub-processors by visiting Cohere’s Trust Center.","context":null,"document":"Enterprise data commitments","source_url":"https://cohere.com/enterprise-data-commitments","kept_on":"2026-10-24","snapshot_sha256":"efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cohere/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cohere","product":"Cohere SaaS platform","field":"certifications","label":"Certifications and audits","value":"ISO 27001, ISO 42001 and a SOC 2 Type II report, on request","quote":"Seamlessly complete your privacy and security compliance reviews by visiting Cohere’s Trust Center where you can request a copy of our certifications (including ISO 27001 and ISO 42001) or of our SOC 2 Type II Report or review our other compliance resources.","context":null,"document":"Enterprise data commitments","source_url":"https://cohere.com/enterprise-data-commitments","kept_on":"2026-10-24","snapshot_sha256":"efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cohere/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cohere","product":"Cohere SaaS platform","field":"dpa","label":"Data processing agreement","value":"On request, for SaaS Platform customers","quote":"Yes, we can provide our DPA to potential customers of the Cohere SaaS Platform for review.","context":"The page says: “No DPA is required for private deployments and deployments on third-party cloud AI/ML platforms as Cohere will not receive any customer prompts/generations.”","document":"Enterprise data commitments","source_url":"https://cohere.com/enterprise-data-commitments","kept_on":"2026-10-24","snapshot_sha256":"efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cohere/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cohere","product":"Cohere SaaS platform","field":"usage_limits","label":"Published usage limits","value":"Per-model rates for trial and production keys, some by contact with sales; 1,000 calls a month on trial keys and on production keys for newer Chat models","quote":"Trial keys (and prod keys on newer Chat model variants) are limited to 1,000 API calls a month.","context":null,"document":"Different Types of API Keys and Rate Limits","source_url":"https://docs.cohere.com/docs/rate-limits","kept_on":"2026-11-03","snapshot_sha256":"0aa2efdb3c0f298467bf5c8f028ee86a49feb09ae07a5065441a22fb63fb2f5a","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cohere/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"DeepSeek","product":"DeepSeek services and Open Platform","field":"trains_on_customer_data","label":"Training on business and API data","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/deepseek/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"DeepSeek","product":"DeepSeek services and Open Platform","field":"trains_on_free_use","label":"Training on free and consumer use","value":"Listed as a use of personal data","quote":"To improve and develop the Services and to train and improve our technology, such as our machine learning models and algorithms.","context":null,"document":"DeepSeek Privacy Policy","source_url":"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html","kept_on":"2026-10-24","snapshot_sha256":"339984e36a795843ee2b5b917797072ec249f3c0e9ff7cbbfe754c01caa4f069","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/deepseek/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"DeepSeek","product":"DeepSeek services and Open Platform","field":"customer_data_retention_period","label":"How long API data is kept","value":"As long as necessary; inputs are kept for as long as you have an account","quote":"we keep this Personal Data for as long as you have an account. This Personal Data includes your account Personal Data, input and payment Personal Data.","context":"Under “How Long Do We Keep Your Personal Data”, given as an example of the general rule: “We retain Personal Data for as long as necessary to provide our Services and for the other purposes set out in this Privacy Policy.” The Privacy Policy does not cover end users of apps built on the Open Platform.","document":"DeepSeek Privacy Policy","source_url":"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html","kept_on":"2026-10-24","snapshot_sha256":"339984e36a795843ee2b5b917797072ec249f3c0e9ff7cbbfe754c01caa4f069","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/deepseek/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"DeepSeek","product":"DeepSeek services and Open Platform","field":"zero_data_retention","label":"Option to keep no data","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/deepseek/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"DeepSeek","product":"DeepSeek services and Open Platform","field":"data_residency","label":"Where data is processed and stored","value":"Personal data collected, processed and stored in the People’s Republic of China","quote":"To provide you with our services, we directly collect, process and store your Personal Data in People's Republic of China.","context":null,"document":"DeepSeek Privacy Policy","source_url":"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html","kept_on":"2026-10-24","snapshot_sha256":"339984e36a795843ee2b5b917797072ec249f3c0e9ff7cbbfe754c01caa4f069","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/deepseek/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"DeepSeek","product":"DeepSeek services and Open Platform","field":"ai_subprocessors","label":"Sub-processors","value":"Service providers by category; no list in the kept pages","quote":"We engage service providers that help us provide, support, and develop the Services and understand how they are used.","context":null,"document":"DeepSeek Privacy Policy","source_url":"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html","kept_on":"2026-10-24","snapshot_sha256":"339984e36a795843ee2b5b917797072ec249f3c0e9ff7cbbfe754c01caa4f069","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/deepseek/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"DeepSeek","product":"DeepSeek services and Open Platform","field":"certifications","label":"Certifications and audits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/deepseek/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"DeepSeek","product":"DeepSeek services and Open Platform","field":"dpa","label":"Data processing agreement","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/deepseek/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"DeepSeek","product":"DeepSeek services and Open Platform","field":"usage_limits","label":"Published usage limits","value":"Concurrency limits per model, per account","quote":"For each account, the concurrency limits for different DeepSeek API models are shown in the table below.","context":"The page says: “If you need higher concurrency, you can submit a capacity expansion request.”","document":"Rate Limit & Isolation","source_url":"https://api-docs.deepseek.com/quick_start/rate_limit/","kept_on":"2026-11-03","snapshot_sha256":"f8fa23628232d781347701b85a5a486685a7fb481300971fbb467e82c0d480e2","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/deepseek/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"xAI","product":"xAI API","field":"trains_on_customer_data","label":"Training on business and API data","value":"Not without permission","quote":"SpaceXSI never trains on your API inputs or outputs without your explicit permission.","context":null,"document":"FAQ: API security","source_url":"https://docs.x.ai/developers/faq/security","kept_on":"2026-10-24","snapshot_sha256":"30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"xAI","product":"xAI API","field":"trains_on_free_use","label":"Training on free and consumer use","value":"Listed as a use of personal information","quote":"To develop and improve our Service and to conduct research: For example to develop new product features, to train our models","context":null,"document":"Privacy Policy","source_url":"https://x.ai/legal/privacy-policy","kept_on":"2026-10-24","snapshot_sha256":"17d51a8463735c94cddbabee411c750b5ae36e9b761d5c6a806aed870c48dd04","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"xAI","product":"xAI API","field":"customer_data_retention_period","label":"How long API data is kept","value":"30 days","quote":"By default, all API requests and responses are stored on our servers (encrypted at rest) for 30 days","context":null,"document":"FAQ: API security","source_url":"https://docs.x.ai/developers/faq/security","kept_on":"2026-10-24","snapshot_sha256":"30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"xAI","product":"xAI API","field":"zero_data_retention","label":"Option to keep no data","value":"Zero Data Retention, a team setting where self-serve is available","quote":"Where available, a team admin can turn it on or off directly from the xAI Console.","context":"Under “What is Zero Data Retention (ZDR)?”, item “Self-serve”. Under “How to enable ZDR” the page says “self-serve ZDR may not be enabled for your environment yet”; teams on a negotiated Enterprise Customer Agreement are told to contact sales.","document":"FAQ: API security","source_url":"https://docs.x.ai/developers/faq/security","kept_on":"2026-10-24","snapshot_sha256":"30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"xAI","product":"xAI API","field":"data_residency","label":"Where data is processed and stored","value":"US only on the US regional endpoint, for two models, with listed exclusions","quote":"To keep API request handling, model inference, moderation, and retained request data in the United States, use the US regional endpoint, https://us.api.x.ai/v1.","context":"The same answer begins: “The default endpoint, https://api.x.ai, does not guarantee a processing region.” It adds: “It currently serves only grok-4.7 and grok-4.6” and “Files, Collections, server-side tools, and the network path from your systems to the endpoint are outside the guarantee.”","document":"FAQ: API security","source_url":"https://docs.x.ai/developers/faq/security","kept_on":"2026-10-24","snapshot_sha256":"30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"xAI","product":"xAI API","field":"ai_subprocessors","label":"Sub-processors","value":"A published list; new names 15 days in advance","quote":"SpaceXSI will notify you if we add or replace Subprocessors at least fifteen (15) days before such changes take effect.","context":"The DPA says: “SpaceXSI's list of general Subprocessors is available at https://x.ai/legal/subprocessor-list”. The record does not keep that list.","document":"Data Processing Addendum","source_url":"https://x.ai/legal/data-processing-addendum","kept_on":"2026-11-03","snapshot_sha256":"d932580a20340627ba7ac1ac70ae6ec6f710a99ef5c060e3e2ba7b3ff5e1e429","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"xAI","product":"xAI API","field":"certifications","label":"Certifications and audits","value":"SOC 2 Type 2","quote":"We are SOC 2 Type 2 compliant. Customers with a signed NDA can refer to our Trust Center for up-to-date information on our certifications and data governance.","context":null,"document":"FAQ: API security","source_url":"https://docs.x.ai/developers/faq/security","kept_on":"2026-10-24","snapshot_sha256":"30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"xAI","product":"xAI API","field":"dpa","label":"Data processing agreement","value":"Incorporated into the enterprise terms; personal data only through the ZDR-Enabled API","quote":"This Data Processing Addendum, including its two Appendices (collectively, the \"DPA\"), is incorporated into and forms a part of the Terms of Service - Enterprise (“Agreement”) between Customer (a.k.a. “you”) and SpaceXSI.","context":"The DPA says: “Customer agrees that it will process Personal Data through the Services only using SpaceXSI’s ZDR-Enabled API (as such term is defined in the Agreement).”","document":"Data Processing Addendum","source_url":"https://x.ai/legal/data-processing-addendum","kept_on":"2026-11-03","snapshot_sha256":"d932580a20340627ba7ac1ac70ae6ec6f710a99ef5c060e3e2ba7b3ff5e1e429","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"xAI","product":"xAI API","field":"usage_limits","label":"Published usage limits","value":"Per-model limits on requests per second and tokens per minute, by spend tier; voice and audio by requests and concurrent sessions","quote":"Every xAI API team has per-model rate limits on two dimensions: requests per second (RPS) and tokens per minute (TPM).","context":"The page says: “Your tier is based on cumulative spend on the xAI API since January 1, 2026.” It also says that increases to Imagine API limits go through xAI sales.","document":"Rate Limits","source_url":"https://docs.x.ai/developers/rate-limits","kept_on":"2026-11-03","snapshot_sha256":"9b4d45abfec062caef6af1999c8f2d8150f70d33b4d20d68bc914db75157f2a2","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Alibaba Cloud","product":"Alibaba Cloud Model Studio, international site","field":"trains_on_customer_data","label":"Training on business and API data","value":"No","quote":"Alibaba Cloud strictly protects your data privacy and will never use your data for model training.","context":"The data retention policy says it will not use business data to train, fine-tune or improve a foundation model without “separate consent”.","document":"Security certifications and privacy","source_url":"https://www.alibabacloud.com/help/en/model-studio/privacy-notice","kept_on":"2026-10-26","snapshot_sha256":"60573ba1ba19bb4030c3193263005b8b7a2b9f4b34fd1809558a72657f02a2c0","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/alibaba/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Alibaba Cloud","product":"Alibaba Cloud Model Studio, international site","field":"customer_data_retention_period","label":"How long API data is kept","value":"Up to 30 days, with listed exceptions","quote":"By default, user’s prompts and responses from model inference calls are retained for no longer than 30 days, unless longer retention is required by applicable laws or is reasonably necessary to ensure the security of Alibaba Cloud Model Studio services.","context":"The same paragraph adds: “Stateful features (conversation storage, files) are retained until deleted by users.”","document":"Alibaba Cloud Model Studio Data Retention Policy","source_url":"https://www.alibabacloud.com/help/en/model-studio/data-retention-policy","kept_on":"2026-10-26","snapshot_sha256":"8e88f476d5c7da5daea273aec57b4e8ae7093540d8d4f75800fcb07a12feb28b","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/alibaba/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Alibaba Cloud","product":"Alibaba Cloud Model Studio, international site","field":"zero_data_retention","label":"Option to keep no data","value":"Zero Data Retention, for enterprise customers on assessment","quote":"ZDR is available to enterprise customers with an Alibaba Cloud account manager, subject to a needs assessment.","context":"For the international site, in regions outside mainland China, on listed models only. Content flagged by safety filters is kept for up to two years.","document":"Alibaba Cloud Model Studio Data Retention Policy","source_url":"https://www.alibabacloud.com/help/en/model-studio/data-retention-policy","kept_on":"2026-10-26","snapshot_sha256":"8e88f476d5c7da5daea273aec57b4e8ae7093540d8d4f75800fcb07a12feb28b","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/alibaba/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Alibaba Cloud","product":"Alibaba Cloud Model Studio, international site","field":"data_residency","label":"Where data is processed and stored","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/alibaba/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Alibaba Cloud","product":"Alibaba Cloud Model Studio, international site","field":"ai_subprocessors","label":"Sub-processors","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/alibaba/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Alibaba Cloud","product":"Alibaba Cloud Model Studio, international site","field":"certifications","label":"Certifications and audits","value":"SOC 2","quote":"Alibaba Cloud Model Studio has achieved SOC 2 compliance with an unqualified opinion, validating our rigorous controls for Security, Availability, and Confidentiality.","context":null,"document":"Security certifications and privacy","source_url":"https://www.alibabacloud.com/help/en/model-studio/privacy-notice","kept_on":"2026-10-26","snapshot_sha256":"60573ba1ba19bb4030c3193263005b8b7a2b9f4b34fd1809558a72657f02a2c0","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/alibaba/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Alibaba Cloud","product":"Alibaba Cloud Model Studio, international site","field":"dpa","label":"Data processing agreement","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/alibaba/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Alibaba Cloud","product":"Alibaba Cloud Model Studio, international site","field":"usage_limits","label":"Published usage limits","value":"Requests and tokens per minute per model, at account level","quote":"Alibaba Cloud Model Studio applies rate limiting to model calls at the Alibaba Cloud account level, aggregating usage across all RAM users, workspaces, and API keys under the account.","context":null,"document":"Rate limits","source_url":"https://www.alibabacloud.com/help/en/model-studio/rate-limit","kept_on":"2026-11-03","snapshot_sha256":"4a945caac0cbe6a0bc87060a1b34125db2897f63b2a6f3e9199b62b45c8b7745","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/alibaba/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Z.ai","product":"Z.ai API Services (GLM models)","field":"trains_on_customer_data","label":"Training on business and API data","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/zai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Z.ai","product":"Z.ai API Services (GLM models)","field":"customer_data_retention_period","label":"How long API data is kept","value":"API content not stored; other customer data kept until the terms end, with listed exceptions","quote":"This information is processed in real-time to provide the Customer and End Users with the API Service and is not saved on our servers.","context":"In the Data Processing Addendum for API Services, section 4. Section 4(c): “For Customer Data other than those provided under Section 4(b), Company will temporarily store such data for the purposes of providing the API Services or in compliance with applicable laws.” It goes on: “The Company will delete such data after the termination of the Terms unless otherwise required by applicable laws.”","document":"Privacy Policy, with the Data Processing Addendum for API Services","source_url":"https://docs.z.ai/legal-agreement/privacy-policy","kept_on":"2026-10-26","snapshot_sha256":"a4b5f6921825cd54ce7bcedec9f7847ea4bbf6d72e14fe3ab8d0295ff4a268b0","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/zai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Z.ai","product":"Z.ai API Services (GLM models)","field":"zero_data_retention","label":"Option to keep no data","value":"API content is not stored, the addendum says","quote":"The Company do not store any of the content the Customer or its End Users provide or generate while using our Services.","context":"Data Processing Addendum for API Services, section 4(b).","document":"Privacy Policy, with the Data Processing Addendum for API Services","source_url":"https://docs.z.ai/legal-agreement/privacy-policy","kept_on":"2026-10-26","snapshot_sha256":"a4b5f6921825cd54ce7bcedec9f7847ea4bbf6d72e14fe3ab8d0295ff4a268b0","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/zai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Z.ai","product":"Z.ai API Services (GLM models)","field":"data_residency","label":"Where data is processed and stored","value":"Generally processed in Singapore","quote":"Company generally provide the Services from Singapore, and our group companies and their designated service providers are typically located in Singapore. As a result, Customer Data is generally processed in Singapore.","context":null,"document":"Privacy Policy, with the Data Processing Addendum for API Services","source_url":"https://docs.z.ai/legal-agreement/privacy-policy","kept_on":"2026-10-26","snapshot_sha256":"a4b5f6921825cd54ce7bcedec9f7847ea4bbf6d72e14fe3ab8d0295ff4a268b0","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/zai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Z.ai","product":"Z.ai API Services (GLM models)","field":"ai_subprocessors","label":"Sub-processors","value":"Group companies and service providers, typically in Singapore; no list","quote":"Company generally provide the Services from Singapore, and our group companies and their designated service providers are typically located in Singapore.","context":null,"document":"Privacy Policy, with the Data Processing Addendum for API Services","source_url":"https://docs.z.ai/legal-agreement/privacy-policy","kept_on":"2026-10-26","snapshot_sha256":"a4b5f6921825cd54ce7bcedec9f7847ea4bbf6d72e14fe3ab8d0295ff4a268b0","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/zai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Z.ai","product":"Z.ai API Services (GLM models)","field":"certifications","label":"Certifications and audits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/zai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Z.ai","product":"Z.ai API Services (GLM models)","field":"dpa","label":"Data processing agreement","value":"A Data Processing Addendum for API Services, incorporated into the Additional Terms for API Services","quote":"If you are enterprises or developers using the API Services (“API Services”) available on Z.ai, please refer to the Data Processing Addendum for API Services.","context":"The addendum’s text is on the same page. It says it “is hereby incorporated into the Additional Terms for API Services”.","document":"Privacy Policy, with the Data Processing Addendum for API Services","source_url":"https://docs.z.ai/legal-agreement/privacy-policy","kept_on":"2026-10-26","snapshot_sha256":"a4b5f6921825cd54ce7bcedec9f7847ea4bbf6d72e14fe3ab8d0295ff4a268b0","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/zai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Z.ai","product":"Z.ai API Services (GLM models)","field":"usage_limits","label":"Published usage limits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/zai/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Moonshot AI","product":"Kimi OpenPlatform API","field":"trains_on_customer_data","label":"Training on business and API data","value":"Yes, unless agreed otherwise in writing","quote":"Customer who requires restrictions on the use of Customer Content for training or improving Moonshot AI models may contact Moonshot AI to discuss available enterprise arrangements or separate written agreements. Unless otherwise expressly agreed in writing, Customer Content may be used for the foregoing purposes.","context":"The sentence before lists the purposes: “We may use Content to provide, maintain, develop, support, and improve the Services, comply with applicable law, enforce our terms and policies, and keep the Services safe and secure.”","document":"Terms of Service for Kimi OpenPlatform","source_url":"https://platform.kimi.ai/docs/agreement/modeluse","kept_on":"2026-10-26","snapshot_sha256":"2f2977a5126855fd50e4eca35a341fafc3e7876677239d7a6b1a3625873373fe","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/moonshot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Moonshot AI","product":"Kimi OpenPlatform API","field":"customer_data_retention_period","label":"How long API data is kept","value":"While the account is active, with listed exceptions","quote":"Retention periods vary based on factors such as information type, sensitivity, and legal requirements. For example, account, input, and payment information are retained while your account is active. Violation-related information is retained until the violation is resolved. Also, in some cases, the length of time we retain data depends on your settings.","context":null,"document":"Kimi OpenPlatform Privacy Policy","source_url":"https://platform.kimi.ai/docs/agreement/userprivacy","kept_on":"2026-10-26","snapshot_sha256":"2128083a8111ef084b0fae1f330b8f941643b2ef818d35e68392e210e376029c","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/moonshot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Moonshot AI","product":"Kimi OpenPlatform API","field":"zero_data_retention","label":"Option to keep no data","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/moonshot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Moonshot AI","product":"Kimi OpenPlatform API","field":"data_residency","label":"Where data is processed and stored","value":"Stored in Singapore","quote":"We store the information we collect in secure servers located in Singapore.","context":null,"document":"Kimi OpenPlatform Privacy Policy","source_url":"https://platform.kimi.ai/docs/agreement/userprivacy","kept_on":"2026-10-26","snapshot_sha256":"2128083a8111ef084b0fae1f330b8f941643b2ef818d35e68392e210e376029c","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/moonshot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Moonshot AI","product":"Kimi OpenPlatform API","field":"ai_subprocessors","label":"Sub-processors","value":"Service providers by category; no list","quote":"These providers include hosting services, customer service vendors, cloud services, content delivery services, support and safety monitoring services, email communication software, web analytics services, payment and transaction processors, and other information technology providers.","context":null,"document":"Kimi OpenPlatform Privacy Policy","source_url":"https://platform.kimi.ai/docs/agreement/userprivacy","kept_on":"2026-10-26","snapshot_sha256":"2128083a8111ef084b0fae1f330b8f941643b2ef818d35e68392e210e376029c","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/moonshot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Moonshot AI","product":"Kimi OpenPlatform API","field":"certifications","label":"Certifications and audits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/moonshot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Moonshot AI","product":"Kimi OpenPlatform API","field":"dpa","label":"Data processing agreement","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/moonshot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Moonshot AI","product":"Kimi OpenPlatform API","field":"usage_limits","label":"Published usage limits","value":"Concurrency, requests and tokens limits by cumulative recharge; limits can change with load","quote":"Rate limits are applied based on each account’s cumulative recharge amount to ensure fair resource distribution and prevent abuse.","context":"The page says: “When cluster load reaches capacity, rate limits may be temporarily adjusted.” and, for abnormal activity, “Once triggered, the restriction cannot be lifted.”","document":"Recharge and Rate Limits","source_url":"https://platform.kimi.ai/docs/pricing/limits","kept_on":"2026-11-03","snapshot_sha256":"53f97162ea20a9337c2716e925580ab297d04d54cb11393324229e1b9f0c25de","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/moonshot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Perplexity","product":"Perplexity API Platform","field":"trains_on_customer_data","label":"Training on business and API data","value":"Not by default","quote":"No training by default: Under the API Terms of Service, Perplexity does not use Customer Content to train generative AI models. Certain APIs may be subject to product-specific terms.","context":null,"document":"API Privacy & Security","source_url":"https://docs.perplexity.ai/docs/resources/privacy-security","kept_on":"2026-10-26","snapshot_sha256":"9ee8051da300c4378c115cd4a057dc66bdc9b63855ad9c9fd8f1cc201228fea1","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/perplexity/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Perplexity","product":"Perplexity API Platform","field":"customer_data_retention_period","label":"How long API data is kept","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/perplexity/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Perplexity","product":"Perplexity API Platform","field":"zero_data_retention","label":"Option to keep no data","value":"Zero Data Retention, for eligible customers by written agreement","quote":"ZDR is available only to eligible customers through an account-level configuration under a written agreement with Perplexity.","context":"Not every model supports it: “Some providers require limited retention as a condition of offering their models.”","document":"API Privacy & Security","source_url":"https://docs.perplexity.ai/docs/resources/privacy-security","kept_on":"2026-10-26","snapshot_sha256":"9ee8051da300c4378c115cd4a057dc66bdc9b63855ad9c9fd8f1cc201228fea1","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/perplexity/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Perplexity","product":"Perplexity API Platform","field":"data_residency","label":"Where data is processed and stored","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/perplexity/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Perplexity","product":"Perplexity API Platform","field":"ai_subprocessors","label":"Sub-processors","value":"Listed on its Trust Center","quote":"Personal data: Perplexity processes personal data in accordance with its Data Processing Addendum, and information about subprocessors is available on Perplexity’s Trust Center.","context":null,"document":"API Privacy & Security","source_url":"https://docs.perplexity.ai/docs/resources/privacy-security","kept_on":"2026-10-26","snapshot_sha256":"9ee8051da300c4378c115cd4a057dc66bdc9b63855ad9c9fd8f1cc201228fea1","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/perplexity/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Perplexity","product":"Perplexity API Platform","field":"certifications","label":"Certifications and audits","value":"SOC 2 Type II","quote":"SOC 2 Type II Report - Comprehensive security controls audit covering security, availability, processing integrity, confidentiality, and privacy","context":"The same list names a “2025 HIPAA Gap Assessment” and “CAIQlite”.","document":"API Privacy & Security","source_url":"https://docs.perplexity.ai/docs/resources/privacy-security","kept_on":"2026-10-26","snapshot_sha256":"9ee8051da300c4378c115cd4a057dc66bdc9b63855ad9c9fd8f1cc201228fea1","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/perplexity/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Perplexity","product":"Perplexity API Platform","field":"dpa","label":"Data processing agreement","value":"Personal data processed under its Data Processing Addendum","quote":"Personal data: Perplexity processes personal data in accordance with its Data Processing Addendum, and information about subprocessors is available on Perplexity’s Trust Center.","context":null,"document":"API Privacy & Security","source_url":"https://docs.perplexity.ai/docs/resources/privacy-security","kept_on":"2026-10-26","snapshot_sha256":"9ee8051da300c4378c115cd4a057dc66bdc9b63855ad9c9fd8f1cc201228fea1","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/perplexity/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Perplexity","product":"Perplexity API Platform","field":"usage_limits","label":"Published usage limits","value":"Rate limits by usage tier, from cumulative spend","quote":"Usage tiers determine your rate limits and access to beta features based on your cumulative API spending.","context":null,"document":"Rate Limits & Usage Tiers","source_url":"https://docs.perplexity.ai/docs/admin/rate-limits-usage-tiers","kept_on":"2026-11-03","snapshot_sha256":"f4a6c2821eade4620183f3643f6644ea45074346f27ae91c83ae996f937cae0a","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/perplexity/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft Copilot","product":"Microsoft Copilot for work, formerly Microsoft 365 Copilot","field":"trains_on_customer_data","label":"Training on business and API data","value":"Not used to train foundation LLMs","quote":"Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot.","context":null,"document":"Data, Privacy, and Security for Microsoft Copilot","source_url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","kept_on":"2026-10-26","snapshot_sha256":"d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft Copilot","product":"Microsoft Copilot for work, formerly Microsoft 365 Copilot","field":"customer_data_retention_period","label":"How long API data is kept","value":"Stored with the organization’s Microsoft 365 content; admins set retention","quote":"When you enter prompts using Microsoft Copilot, the information contained within your prompts, the data they retrieve, and the generated responses are processed and stored in alignment with contractual commitments with your organization's other content in Microsoft 365.","context":"The page adds: “Admins can also use Microsoft Purview to set retention policies for the data related to chat interactions with Copilot.”","document":"Data, Privacy, and Security for Microsoft Copilot","source_url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","kept_on":"2026-10-26","snapshot_sha256":"d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft Copilot","product":"Microsoft Copilot for work, formerly Microsoft 365 Copilot","field":"zero_data_retention","label":"Option to keep no data","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft Copilot","product":"Microsoft Copilot for work, formerly Microsoft 365 Copilot","field":"data_residency","label":"Where data is processed and stored","value":"EU traffic stays in the EU Data Boundary, except on Anthropic models","quote":"EU traffic stays within the EU Data Boundary while worldwide traffic can be sent to the EU and other countries or regions for LLM processing.","context":"The next line reads: “Models provided by Anthropic as a subprocessor are currently excluded from the EU Data Boundary.”","document":"Data, Privacy, and Security for Microsoft Copilot","source_url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","kept_on":"2026-10-26","snapshot_sha256":"d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft Copilot","product":"Microsoft Copilot for work, formerly Microsoft 365 Copilot","field":"ai_subprocessors","label":"Sub-processors","value":"Names Anthropic and OpenAI as subprocessors for their models","quote":"For information about models provided by Anthropic as a subprocessor within Microsoft Copilot experiences, see Anthropic models in Microsoft Online Services. For information about models provided by OpenAI as a subprocessor within Microsoft Copilot experiences, see OpenAI as a subprocessor in Microsoft Online Services.","context":null,"document":"Data, Privacy, and Security for Microsoft Copilot","source_url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","kept_on":"2026-10-26","snapshot_sha256":"d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft Copilot","product":"Microsoft Copilot for work, formerly Microsoft 365 Copilot","field":"certifications","label":"Certifications and audits","value":"ISO 27001 and ISO 42001, listed beside GDPR and HIPAA","quote":"Microsoft Copilot provides broad compliance offerings and certifications, including GDPR, ISO 27001, HIPAA, and the ISO 42001 standard for AI management systems.","context":null,"document":"Data, Privacy, and Security for Microsoft Copilot","source_url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","kept_on":"2026-10-26","snapshot_sha256":"d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft Copilot","product":"Microsoft Copilot for work, formerly Microsoft 365 Copilot","field":"dpa","label":"Data processing agreement","value":"The Microsoft Product Terms and Data Protection Addendum, named for data residency","quote":"Microsoft Copilot is upholding data residency commitments as outlined in the Microsoft Product Terms and Data Protection Addendum.","context":null,"document":"Data, Privacy, and Security for Microsoft Copilot","source_url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","kept_on":"2026-10-26","snapshot_sha256":"d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Microsoft Copilot","product":"Microsoft Copilot for work, formerly Microsoft 365 Copilot","field":"usage_limits","label":"Published usage limits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/microsoft-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"GitHub Copilot","product":"GitHub Copilot Business and Enterprise","field":"trains_on_customer_data","label":"Training on business and API data","value":"No","quote":"No. GitHub does not use either Copilot Business or Enterprise data to train its models.","context":"Answer to “Does GitHub use Copilot Business or Enterprise data to train GitHub’s model?”","document":"GitHub Copilot, frequently asked questions","source_url":"https://github.com/features/copilot","kept_on":"2026-10-26","snapshot_sha256":"30826739dddc8befe67f24935ff304a2a9924bccdae74cb429ccfe8f73d2b423","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/github-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"GitHub Copilot","product":"GitHub Copilot Business and Enterprise","field":"trains_on_free_use","label":"Training on free and consumer use","value":"Yes on Free, Pro and Pro+, unless the user opts out","quote":"Starting on April 24, GitHub may also use interactions from users with a Copilot Free, Copilot Pro, and Copilot Pro+ subscription - including inputs, outputs, code snippets, and associated context - to train and improve our AI models unless they have opted out.","context":null,"document":"GitHub Copilot, frequently asked questions","source_url":"https://github.com/features/copilot","kept_on":"2026-10-26","snapshot_sha256":"30826739dddc8befe67f24935ff304a2a9924bccdae74cb429ccfe8f73d2b423","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/github-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"GitHub Copilot","product":"GitHub Copilot Business and Enterprise","field":"customer_data_retention_period","label":"How long API data is kept","value":"Not kept in the IDE; 28 days for other use, with listed exceptions","quote":"Access through IDE for Chat and Code Completions: Prompts and Suggestions: Not retained User Engagement Data: Kept for two years. Feedback Data: Stored for as long as needed for its intended purpose. All other GitHub Copilot access and use: Prompts and Suggestions: Retained for 28 days.","context":"These are the default settings for Copilot Business and Enterprise customers.","document":"GitHub Copilot, frequently asked questions","source_url":"https://github.com/features/copilot","kept_on":"2026-10-26","snapshot_sha256":"30826739dddc8befe67f24935ff304a2a9924bccdae74cb429ccfe8f73d2b423","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/github-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"GitHub Copilot","product":"GitHub Copilot Business and Enterprise","field":"zero_data_retention","label":"Option to keep no data","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/github-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"GitHub Copilot","product":"GitHub Copilot Business and Enterprise","field":"data_residency","label":"Where data is processed and stored","value":"Listed for each sub-processor; AI inference in the US and other countries","quote":"Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore","context":"Each row of the list gives a “Location of Processing”. Fireworks AI lists “United States, Germany, Iceland”.","document":"GitHub Subprocessors","source_url":"https://docs.github.com/en/site-policy/privacy-policies/github-subprocessors","kept_on":"2026-10-26","snapshot_sha256":"fafcdb7003b578650b127a8fab76f9970f860fb04ea0e0cc28f50c4ff0f81407","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/github-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"GitHub Copilot","product":"GitHub Copilot Business and Enterprise","field":"ai_subprocessors","label":"Sub-processors","value":"A published list; new names 30 days in advance","quote":"GitHub publishes the names of any new subprocessors for its online services at least 30 days in advance of the subprocessor’s authorization to perform services that may involve access to customer data or personal data.","context":null,"document":"GitHub Subprocessors","source_url":"https://docs.github.com/en/site-policy/privacy-policies/github-subprocessors","kept_on":"2026-10-26","snapshot_sha256":"fafcdb7003b578650b127a8fab76f9970f860fb04ea0e0cc28f50c4ff0f81407","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/github-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"GitHub Copilot","product":"GitHub Copilot Business and Enterprise","field":"certifications","label":"Certifications and audits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/github-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"GitHub Copilot","product":"GitHub Copilot Business and Enterprise","field":"dpa","label":"Data processing agreement","value":"GitHub’s Data Protection Agreement, for business customers","quote":"These practices are outlined in GitHub’s Data Protection Agreement (DPA), which details our data handling commitments to our data controller customers.","context":null,"document":"GitHub Copilot, frequently asked questions","source_url":"https://github.com/features/copilot","kept_on":"2026-10-26","snapshot_sha256":"30826739dddc8befe67f24935ff304a2a9924bccdae74cb429ccfe8f73d2b423","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/github-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"GitHub Copilot","product":"GitHub Copilot Business and Enterprise","field":"usage_limits","label":"Published usage limits","value":"A monthly allowance of AI credits per plan; on Business and Enterprise, admins set limits on paid usage beyond it; GitHub’s own rate limits have no published numbers","quote":"On GitHub Copilot Business and GitHub Copilot Enterprise, admins set usage limits and decide whether additional paid usage is allowed. If it isn't, Copilot pauses until the next cycle.","context":"The same page says: “Every plan includes a monthly allowance: 1 AI credit = $0.01 USD.” The usage-limits page says GitHub uses rate limits for fairness and against abuse, and gives no figures.","document":"GitHub Copilot, frequently asked questions","source_url":"https://github.com/features/copilot","kept_on":"2026-10-26","snapshot_sha256":"30826739dddc8befe67f24935ff304a2a9924bccdae74cb429ccfe8f73d2b423","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/github-copilot/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cursor","product":"Cursor, by Anysphere","field":"trains_on_customer_data","label":"Training on business and API data","value":"Not with Privacy Mode on","quote":"If you choose to turn off “Privacy Mode”: we may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models.","context":"With Privacy Mode on: “Customer Data will not be used for training by Cursor.” The page does not say which setting is the default.","document":"Data Use & Privacy Overview","source_url":"https://cursor.com/data-use","kept_on":"2026-10-26","snapshot_sha256":"3c9ff56d3aa0af39ff66c7ff75e6f005efe1a0a42ed42b9e4c0ab869d9e17c7e","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cursor/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cursor","product":"Cursor, by Anysphere","field":"customer_data_retention_period","label":"How long API data is kept","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cursor/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cursor","product":"Cursor, by Anysphere","field":"zero_data_retention","label":"Option to keep no data","value":"With Privacy Mode on, ZDR agreements with all providers; non-ZDR models are marked or need an admin; flagged data may be kept for investigation","quote":"Cursor maintains zero data retention (ZDR) agreements with all providers, and AI model providers will not store or train on your data.","context":"The same paragraph: “Non-ZDR models will be designated as such or require an admin to opt-in to enable the model for your workspace.” Abuse detectors can keep data for investigation.","document":"Data Use & Privacy Overview","source_url":"https://cursor.com/data-use","kept_on":"2026-10-26","snapshot_sha256":"3c9ff56d3aa0af39ff66c7ff75e6f005efe1a0a42ed42b9e4c0ab869d9e17c7e","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cursor/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cursor","product":"Cursor, by Anysphere","field":"data_residency","label":"Where data is processed and stored","value":"No infrastructure in China","quote":"Cursor does not use or maintain any infrastructure in China.","context":null,"document":"Security","source_url":"https://cursor.com/security","kept_on":"2026-10-26","snapshot_sha256":"66d02e9bb248ee28dcc5021959006a025143b33828873662622d1124aa7d4134","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cursor/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cursor","product":"Cursor, by Anysphere","field":"ai_subprocessors","label":"Sub-processors","value":"Listed on its trust portal; none headquartered in China","quote":"Our list of subprocessors is published on our trust portal.","context":"The same section adds: “We do not use any companies headquartered in China as subprocessors, and to our knowledge none of our subprocessors do either.”","document":"Security","source_url":"https://cursor.com/security","kept_on":"2026-10-26","snapshot_sha256":"66d02e9bb248ee28dcc5021959006a025143b33828873662622d1124aa7d4134","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cursor/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cursor","product":"Cursor, by Anysphere","field":"certifications","label":"Certifications and audits","value":"SOC 2 Type II; ISO 27001, ISO 42001 and AIUC-1","quote":"Cursor holds AIUC-1, ISO/IEC 27001:2022, and ISO/IEC 42001:2023 certifications, along with a SOC 2 Type II attestation.","context":null,"document":"Security","source_url":"https://cursor.com/security","kept_on":"2026-10-26","snapshot_sha256":"66d02e9bb248ee28dcc5021959006a025143b33828873662622d1124aa7d4134","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cursor/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cursor","product":"Cursor, by Anysphere","field":"dpa","label":"Data processing agreement","value":"Published; governs processing under the Master Services Agreement","quote":"This Data Processing Addendum (“DPA”) governs Anysphere, Inc.’s (“Anysphere” or “Vendor”) processing of Personal Data provided by Customer through the Service, in accordance with the Master Services Agreement between Anysphere and Customer (“Agreement”).","context":null,"document":"Data Processing Addendum","source_url":"https://cursor.com/terms/dpa","kept_on":"2026-11-03","snapshot_sha256":"95face0c2e6cc4f05737d9bb2e3cd43b7ab6f2497cf8c761abd7620e7f24e044","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cursor/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Cursor","product":"Cursor, by Anysphere","field":"usage_limits","label":"Published usage limits","value":"A weekly pool of usage for Cursor models on each paid plan; third-party models on Premium and above at API list price","quote":"Each paid plan includes one pool of usage for Cursor models.","context":"The page says the pool “refreshes weekly, so one heavy day doesn't use up your month.” It also says: “Plus and Free don't include third-party models.”","document":"Models and pricing","source_url":"https://cursor.com/docs/models-and-pricing","kept_on":"2026-11-03","snapshot_sha256":"cb5ece5b5229ffe067d8af2f829bb180001455896812b687547282a8d90c9cb7","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/cursor/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Meta","product":"Meta Model API","field":"trains_on_customer_data","label":"Training on business and API data","value":"No on Standard Services; Contributor (Discounted) Services content may train Meta models","quote":"Meta will collect, use, process, and share such data as a “Service Provider” or “Processor” (each as defined in the MGPT) to you in relation to your use of the Services, and will not use Content submitted in a request to the Standard Services to train Meta Models.","context":"Section 6.1 says for Contributor Services: “You agree that Meta may use your Content to train, develop, evaluate, and improve Meta’s artificial intelligence models, products, and services.” Coding Harness Subscriptions use “the Contributor Services by default regardless of which Meta Model you select”.","document":"Meta Model API Terms of Service","source_url":"https://dev.meta.ai/legal/terms-of-service","kept_on":"2026-11-04","snapshot_sha256":"667e9e034fcd18af99f61867602e3a8987b0a22e65040225002a41714be37790","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/meta/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Meta","product":"Meta Model API","field":"trains_on_free_use","label":"Training on free and consumer use","value":"Yes on Discounted (Contributor) Services; Standard Services content is not used to train","quote":"Discounted Services: Meta may use your Content, including Inputs and Outputs, to train, develop, evaluate, and improve Meta's AI models, products, and services. Before using Content from Discounted Services to train artificial intelligence models, Meta takes steps designed to disassociate that Content from your Accounts and your Meta Model API key.","context":"The same page says: “If you do not want Content used for training, you may upgrade to Standard Services.”","document":"Meta Model API Data Commitments","source_url":"https://dev.meta.ai/legal/commitments","kept_on":"2026-11-04","snapshot_sha256":"8cee13786c4039f56d5a26830d2e901d941bd3e3367f4c0e15633f3fa4a1ef81","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/meta/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Meta","product":"Meta Model API","field":"customer_data_retention_period","label":"How long API data is kept","value":"No fixed period; kept as needed for the Services, law, Meta’s use rights, and safety review","quote":"4.4 Retention. Meta will retain your Content and Usage Data as needed: (i) to provide the Services under these Terms; (ii) to the extent necessary for compliance with applicable laws; (iii) in connection with the exercise of Meta’s rights to use your Content and Usage Data under these Terms; (iv) when our systems flag data for a potential policy violation; and (v) for security, safety, abuse, and policy review and improvements.","context":"The commitments page adds that a customer can view and delete its Content through its account.","document":"Meta Model API Terms of Service","source_url":"https://dev.meta.ai/legal/terms-of-service","kept_on":"2026-11-04","snapshot_sha256":"667e9e034fcd18af99f61867602e3a8987b0a22e65040225002a41714be37790","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/meta/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Meta","product":"Meta Model API","field":"zero_data_retention","label":"Option to keep no data","value":"ZDR is named for Muse Voice Transcribe, priced the same as Standard mode","quote":"Streaming and non-streaming transcription are priced the same. Zero data retention (ZDR) is priced at parity with Standard mode. Contributor mode isn't available for Muse Voice Transcribe.","context":"The page names ZDR only in the Muse Voice Transcribe section.","document":"Pricing and rate limits","source_url":"https://dev.meta.ai/docs/pricing-rate-limits","kept_on":"2026-11-04","snapshot_sha256":"826b3f3c5fe8184f218a7ee4ce276643944b464b0c22b210243f43dd900fd6d0","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/meta/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Meta","product":"Meta Model API","field":"data_residency","label":"Where data is processed and stored","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/meta/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Meta","product":"Meta Model API","field":"ai_subprocessors","label":"Sub-processors","value":"On Standard Services, Meta may engage subprocessors from a linked list it may update","quote":"You authorize Meta to engage subprocessors included in the list located here, as may be updated by Meta from time to time.","context":"This sentence is in Section 5.1, which applies “When you use Standard Services”.","document":"Meta Model API Terms of Service","source_url":"https://dev.meta.ai/legal/terms-of-service","kept_on":"2026-11-04","snapshot_sha256":"667e9e034fcd18af99f61867602e3a8987b0a22e65040225002a41714be37790","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/meta/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Meta","product":"Meta Model API","field":"certifications","label":"Certifications and audits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/meta/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Meta","product":"Meta Model API","field":"dpa","label":"Data processing agreement","value":"On Standard Services, Meta acts as Processor under the Meta Global Processor Terms (MGPT)","quote":"5.1 Processor Terms. When you use Standard Services, Meta will process applicable data as described in the MGPT.","context":"Section 2 incorporates the “Meta Global Processor Terms” by reference. The Section 5.1 processor terms are in the Standard Services section, not the Contributor Services section.","document":"Meta Model API Terms of Service","source_url":"https://dev.meta.ai/legal/terms-of-service","kept_on":"2026-11-04","snapshot_sha256":"667e9e034fcd18af99f61867602e3a8987b0a22e65040225002a41714be37790","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/meta/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Meta","product":"Meta Model API","field":"usage_limits","label":"Published usage limits","value":"Per-team, per-model limits; Contributor variants allow 150 RPM against 3,000 RPM on Standard","quote":"Rate limits apply per team, not per API key: requests, tokens, and streams from every key in a team count toward the same limits. Each model below has its own limits, so traffic to one model doesn't use up another's.","context":"The table lists “muse-spark-1.3” at “3,000” RPM and “4,000,000” TPM, and “muse-spark-1.3-contributor” at “150” RPM and “3,000,000” TPM.","document":"Pricing and rate limits","source_url":"https://dev.meta.ai/docs/pricing-rate-limits","kept_on":"2026-11-04","snapshot_sha256":"826b3f3c5fe8184f218a7ee4ce276643944b464b0c22b210243f43dd900fd6d0","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/meta/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Tencent","product":"Tencent HY (Hunyuan) on Tencent Cloud International","field":"trains_on_customer_data","label":"Training on business and API data","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/tencent/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Tencent","product":"Tencent HY (Hunyuan) on Tencent Cloud International","field":"customer_data_retention_period","label":"How long API data is kept","value":"Generally up to 7 days for the HY module’s listed data, longer for billing; varies with settings","quote":"For Account Data, Configuration Data, Network and Connection Data, and Diagnostic and Usage Data, we generally retain information for up to 7 days after your task request in connection with the Features to provide you the Features and for troubleshooting purposes, but may process or retain such data for a longer period (for example as long as you use the Features) for billing purposes.","context":"This is the HY product module, for “Tencent HY 3D Global, and Text Generation”. Diagnostic and Usage Data includes “output information”, and the module does not name prompts. It adds: “The actual retention period can vary for different data categories”. The umbrella DPSA, which does not list the HY module, gives the duration of the Terms of Service as the period for personal data in uploaded Content, and says Tencent returns or destroys personal data when the customer asks.","document":"Tencent HY 3D Global and Text Generation Privacy Policy","source_url":"https://www.tencentcloud.com/document/product/1284/75293","kept_on":"2026-11-04","snapshot_sha256":"1a363137893a3b0c6d3b26e721b2b5ae42f6f52858e9ed4279ef0a82143f1664","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/tencent/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Tencent","product":"Tencent HY (Hunyuan) on Tencent Cloud International","field":"zero_data_retention","label":"Option to keep no data","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/tencent/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Tencent","product":"Tencent HY (Hunyuan) on Tencent Cloud International","field":"data_residency","label":"Where data is processed and stored","value":"Personal Data processed in the Service Region the customer selects, with exceptions","quote":"5.1 Subject to clause 5.2, where Organisation has selected a Service Region for the Services, Tencent will Process Personal Data in that Service Region.","context":"Tencent Cloud International umbrella document, not specific to HY. Clause 5.2 says Tencent “may need to Process Personal Data outside the Service Region from time to time”, with prior consent or authorisation; authorising Sub-Processors counts as that consent.","document":"Data Processing and Security Agreement","source_url":"https://www.tencentcloud.com/document/product/301/17347","kept_on":"2026-11-04","snapshot_sha256":"f4ca9074d616075ccc1a5ec836e2111cdb2d02a186ec4ef306a38a7f8009dfcc","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/tencent/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Tencent","product":"Tencent HY (Hunyuan) on Tencent Cloud International","field":"ai_subprocessors","label":"Sub-processors","value":"Listed on a Third Party Information page; 14 days to object to changes, where law requires notice","quote":"Organisation hereby grants Tencent general written authorisation to engage such Sub-Processors listed at Third Party Information to Process Personal Data on its behalf, subject to the requirements of this clause 8.","context":"Tencent Cloud International umbrella document; it does not name AI sub-processors. Clause 8.2 gives notice of changes “to the extent its processing of the Personal Data is subject to Data Protection Laws that require such notification”, then “fourteen (14) days from the date of receipt of the notice to approve or reject the change.”","document":"Data Processing and Security Agreement","source_url":"https://www.tencentcloud.com/document/product/301/17347","kept_on":"2026-11-04","snapshot_sha256":"f4ca9074d616075ccc1a5ec836e2111cdb2d02a186ec4ef306a38a7f8009dfcc","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/tencent/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Tencent","product":"Tencent HY (Hunyuan) on Tencent Cloud International","field":"certifications","label":"Certifications and audits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/tencent/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Tencent","product":"Tencent HY (Hunyuan) on Tencent Cloud International","field":"dpa","label":"Data processing agreement","value":"A Data Processing and Security Addendum covers Content under the Terms of Service, not account data","quote":"This DPSA applies if you have entered into the Terms of Service for the supply of Services by Tencent. This DPSA applies to the Processing of Content. Personal Data that is Administrative Information is Processed in accordance with the Privacy Policy and this DPSA shall not apply to the Processing of Administrative Information.","context":"Tencent Cloud International umbrella document. Its Section 9 list of Feature Modules does not name Tencent HY or Text Generation.","document":"Data Processing and Security Agreement","source_url":"https://www.tencentcloud.com/document/product/301/17347","kept_on":"2026-11-04","snapshot_sha256":"f4ca9074d616075ccc1a5ec836e2111cdb2d02a186ec4ef306a38a7f8009dfcc","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/tencent/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Tencent","product":"Tencent HY (Hunyuan) on Tencent Cloud International","field":"usage_limits","label":"Published usage limits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/tencent/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Xiaomi","product":"Xiaomi MiMo API Open Platform, under its privacy policy for use in China","field":"trains_on_customer_data","label":"Training on business and API data","value":"No for the text content a user gives, unless the user gives prior consent","quote":"Without your prior consent, Xiaomi will not use the text content provided by you for model training or any other purposes.","context":"The statement names text content only. The same section says Xiaomi collects “text, image, video, and audio information” to run the API and Xiaomi MiMo Code services.","document":"Xiaomi MiMo Privacy Policy","source_url":"https://privacy.mi.com/XiaomiMiMoPlatform/en_GB/","kept_on":"2026-11-04","snapshot_sha256":"8ed89989df4832348b5f3ac6b534e9a0a9dd26d47c3fb6e01ff945e6d7a07910","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xiaomi/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Xiaomi","product":"Xiaomi MiMo API Open Platform, under its privacy policy for use in China","field":"customer_data_retention_period","label":"How long API data is kept","value":"No fixed period: kept as long as its purposes need or law requires, with exceptions","quote":"We retain your personal information for the period necessary to fulfill the purposes for which it was collected as described in this Privacy Policy, or as required by applicable laws and regulations.","context":"The policy speaks of personal information and names no period for prompts or outputs. The same paragraph keeps data longer for public interest, research or statistical purposes, and the policy says deleted data may not leave backups at once.","document":"Xiaomi MiMo Privacy Policy","source_url":"https://privacy.mi.com/XiaomiMiMoPlatform/en_GB/","kept_on":"2026-11-04","snapshot_sha256":"8ed89989df4832348b5f3ac6b534e9a0a9dd26d47c3fb6e01ff945e6d7a07910","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xiaomi/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Xiaomi","product":"Xiaomi MiMo API Open Platform, under its privacy policy for use in China","field":"zero_data_retention","label":"Option to keep no data","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xiaomi/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Xiaomi","product":"Xiaomi MiMo API Open Platform, under its privacy policy for use in China","field":"data_residency","label":"Where data is processed and stored","value":"Personal information is stored in China, for use of the service within China","quote":"This agreement applies to your use of Xiaomi MiMo services within the territory of the People's Republic of China. Accordingly, your personal information will be stored within the territory of the People's Republic of China.","context":"For use outside China, the page says a different privacy policy “applicable to services outside the People's Republic of China” governs.","document":"Xiaomi MiMo Privacy Policy","source_url":"https://privacy.mi.com/XiaomiMiMoPlatform/en_GB/","kept_on":"2026-11-04","snapshot_sha256":"8ed89989df4832348b5f3ac6b534e9a0a9dd26d47c3fb6e01ff945e6d7a07910","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xiaomi/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Xiaomi","product":"Xiaomi MiMo API Open Platform, under its privacy policy for use in China","field":"ai_subprocessors","label":"Sub-processors","value":"Some services use third-party service providers that get some personal information; none named here","quote":"Some of our services are provided by third-party service providers. To this end, we need to provide some of your personal information to these third-party service providers.","context":null,"document":"Xiaomi MiMo Privacy Policy","source_url":"https://privacy.mi.com/XiaomiMiMoPlatform/en_GB/","kept_on":"2026-11-04","snapshot_sha256":"8ed89989df4832348b5f3ac6b534e9a0a9dd26d47c3fb6e01ff945e6d7a07910","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xiaomi/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Xiaomi","product":"Xiaomi MiMo API Open Platform, under its privacy policy for use in China","field":"certifications","label":"Certifications and audits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xiaomi/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Xiaomi","product":"Xiaomi MiMo API Open Platform, under its privacy policy for use in China","field":"dpa","label":"Data processing agreement","value":"Xiaomi signs data processing agreements with its third-party providers; no customer DPA stated","quote":"We also enter into strict data processing agreements with them, requiring these third parties to adopt adequate protective measures for your information and to strictly comply with applicable laws, regulations, and regulatory requirements.","context":null,"document":"Xiaomi MiMo Privacy Policy","source_url":"https://privacy.mi.com/XiaomiMiMoPlatform/en_GB/","kept_on":"2026-11-04","snapshot_sha256":"8ed89989df4832348b5f3ac6b534e9a0a9dd26d47c3fb6e01ff945e6d7a07910","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xiaomi/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Xiaomi","product":"Xiaomi MiMo API Open Platform, under its privacy policy for use in China","field":"usage_limits","label":"Published usage limits","value":"Per-account RPM and TPM limits for each model, e.g. 100 RPM and 10M TPM for mimo-v2.6-pro","quote":"RPM (Requests Per Minute) : The maximum number of requests initiated per minute. The calculation scope is the sum of the total number of requests from all API Keys under a single account when calling the same model.","context":"The table lists mimo-v2.6-pro at “100” RPM and “10M” TPM. For mimo-v2.6-pro-ultraspeed it says “Reserved quota (contact us for more)”.","document":"Rate Limit","source_url":"https://mimo.mi.com/docs/en-US/api/guidance/rate-limit","kept_on":"2026-11-04","snapshot_sha256":"1383019f859a7f1832aea97697484983f99456e76e0f99ab3c0a3f9c185a14e1","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/xiaomi/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"StepFun","product":"StepFun Open Platform, international site","field":"trains_on_customer_data","label":"Training on business and API data","value":"May train: the terms license prompts, outputs and API call logs to StepFun for any purpose","quote":"When you use the Services in accordance with these Terms, you grant us, to the fullest extent permitted under the applicable law, a nonexclusive, worldwide, royalty-free, fully paid up, transferable, sublicensable, perpetual, irrevocable license to copy, display, upload, perform, distribute, transmit, make available, store, access, modify, exploit, commercialize and otherwise use all Output, Prompts and associated API call logs (“Usage Data”) elicited by you for any purpose in any form, medium or technology now known or later developed, including but not limited to (i) facilitating other users’ ability to elicit Output, and (ii) promoting the Services.","context":"The terms also say the Services “MAY BE IMPROVED THROUGH THE USE OF USAGE DATA FOR MODEL TRAINING AND FINE-TUNING”. For the StepFun Startup Program and other early access programs, the license “specifically includes the right to use Usage Data for training, fine-tuning, and otherwise improving StepFun’s artificial intelligence models and systems.”","document":"Terms of Service","source_url":"https://platform.stepfun.ai/docs/en/agreement/userservice","kept_on":"2026-11-04","snapshot_sha256":"ba64e4507c3fe00741365f5c316e28df82af866a3e7de8b2915bd3bd29cbebb2","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/stepfun/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"StepFun","product":"StepFun Open Platform, international site","field":"customer_data_retention_period","label":"How long API data is kept","value":"Customer Data is deleted within 30 days after the agreement ends, with exceptions","quote":"Within 30 days of termination or expiration of the Agreement, StepFun will:","context":"StepFun will “delete all copies of Customer Data, including Customer Personal Data, processed by StepFun or any subprocessors”, except where law requires storage, to resolve a dispute, or “to combat harmful use of the Services”. The terms also give StepFun a perpetual, irrevocable license to store and use prompts, outputs and API call logs. For its Startup Program and other early access programs, the privacy policy says StepFun may use and retain such data as a controller.","document":"Data Processing Agreement","source_url":"https://platform.stepfun.ai/docs/en/agreement/dataprocess","kept_on":"2026-11-04","snapshot_sha256":"4f6547754c82d04d002040a48dfc7dbf15434cb0a9549f97ade574eae9dd2f6b","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/stepfun/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"StepFun","product":"StepFun Open Platform, international site","field":"zero_data_retention","label":"Option to keep no data","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/stepfun/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"StepFun","product":"StepFun Open Platform, international site","field":"data_residency","label":"Where data is processed and stored","value":"Privacy policy: servers in the United States; affiliates and providers elsewhere may access data","quote":"Our servers are located in the United States. Meanwhile, due to the international nature of our business, your personal information may also be accessed by our affiliates or be transferred to third-party service providers and business partners, in connection with the purposes set out in this Policy.","context":"The sentence is about personal information. The policy “does not apply when we act as a data processor” for commercial customers, and the DPA names no processing location for Customer Data.","document":"User Privacy","source_url":"https://platform.stepfun.ai/docs/en/agreement/userprivacy","kept_on":"2026-11-04","snapshot_sha256":"cb0c3efb4fe3cc776ece0969f1ac1cf47d99cebbf969c607a92e06d70be35380","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/stepfun/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"StepFun","product":"StepFun Open Platform, international site","field":"ai_subprocessors","label":"Sub-processors","value":"The customer gives StepFun general authorization to engage subprocessors","quote":"Customer grants StepFun general authorization to engage subprocessors.","context":"StepFun will put a contract with each subprocessor and will “remain liable to Customer, subject to the liability limitations in the Agreement, for each subprocessor’s acts and omissions”.","document":"Data Processing Agreement","source_url":"https://platform.stepfun.ai/docs/en/agreement/dataprocess","kept_on":"2026-11-04","snapshot_sha256":"4f6547754c82d04d002040a48dfc7dbf15434cb0a9549f97ade574eae9dd2f6b","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/stepfun/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"StepFun","product":"StepFun Open Platform, international site","field":"certifications","label":"Certifications and audits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/stepfun/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"StepFun","product":"StepFun Open Platform, international site","field":"dpa","label":"Data processing agreement","value":"A DPA forms part of the Terms of Service and applies to StepFun’s processing of Customer Data","quote":"This Data Processing Agreement (“DPA”) is incorporated into and forms part of the Terms of Service or other agreement between Customer and StepFun that references this DPA and governs Customer’s use of the Services (the “Agreement”). It applies to StepFun’s processing of Customer Data as defined below.","context":"The DPA incorporates the EU Standard Contractual Clauses “to the extent required by applicable data protection laws”, with UK and Swiss addenda.","document":"Data Processing Agreement","source_url":"https://platform.stepfun.ai/docs/en/agreement/dataprocess","kept_on":"2026-11-04","snapshot_sha256":"4f6547754c82d04d002040a48dfc7dbf15434cb0a9549f97ade574eae9dd2f6b","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/stepfun/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"StepFun","product":"StepFun Open Platform, international site","field":"usage_limits","label":"Published usage limits","value":"Pay-as-you-go rate limits by tier of cash top-up; enterprise tiers through sales","quote":"Pay-as-you-go calls to the standard Open Platform API are rate limited by tier according to the cumulative top-up amount on your account. Only cash top-ups count toward that amount; vouchers do not.","context":"Individual tiers run from V0 (“Under $15”, 5 concurrency, 100 RPM, “500,000” TPM) to V4 (“$1,500 and above”). Step Plan usage follows a “monthly Credit allowance”, and limits may change “When resources reach capacity”.","document":"Pricing and rate limits","source_url":"https://platform.stepfun.ai/docs/en/guides/pricing/details","kept_on":"2026-11-04","snapshot_sha256":"392dc4e5afc265b83d9894e987e187d5fbca4833942bb9f4b861320aae32bb0c","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/stepfun/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Gemini Apps","product":"Gemini Apps for personal Google Accounts","field":"trains_on_customer_data","label":"Training on business and API data","value":"Yes while Keep Activity is on; not in temporary chats, or with it off unless you send feedback","quote":"Google uses your activity to provide, develop, and improve its services (including training generative AI models), as well as to protect Google, its users, and the public with the help of human reviewers.","context":"This applies “If the Keep Activity setting is on”. With it off, future chats “won’t be used to train our AI models, unless you choose to send Google feedback”, and “Temporary chats are not used to train Google’s AI models.” The page adds: “Your Gemini settings don’t control processing of your chats to create anonymized data to improve Google services.”","document":"Gemini Apps Privacy Hub","source_url":"https://support.google.com/gemini/answer/13594961?hl=en","kept_on":"2026-11-04","snapshot_sha256":"ee8f0fa990d2760ebb62bbd7bad5cd6352b42e56252a35987d877bddb685621c","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/gemini-app/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Gemini Apps","product":"Gemini Apps for personal Google Accounts","field":"customer_data_retention_period","label":"How long API data is kept","value":"Activity auto-deletes after 18 months by default (3, 36 months or indefinite); some chats kept longer","quote":"You can change your auto-delete setting in Gemini Apps Activity from the default of 18 months to 3 months, 36 months, or indefinite. You can also manually delete your Gemini Apps chats anytime.","context":"Chats reviewed by human reviewers are “retained for up to three years” after you delete activity. Temporary chats and chats with Keep Activity off “are retained with your account for 72 hours”.","document":"Gemini Apps Privacy Hub","source_url":"https://support.google.com/gemini/answer/13594961?hl=en","kept_on":"2026-11-04","snapshot_sha256":"ee8f0fa990d2760ebb62bbd7bad5cd6352b42e56252a35987d877bddb685621c","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/gemini-app/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Gemini Apps","product":"Gemini Apps for personal Google Accounts","field":"zero_data_retention","label":"Option to keep no data","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/gemini-app/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Gemini Apps","product":"Gemini Apps for personal Google Accounts","field":"data_residency","label":"Where data is processed and stored","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/gemini-app/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Gemini Apps","product":"Gemini Apps for personal Google Accounts","field":"ai_subprocessors","label":"Sub-processors","value":"Service providers' reviewers see some chats, disconnected from the account; none are named","quote":"We take your privacy seriously, and we do not sell your personal information to anyone. Chats are disconnected from your account before being sent to service providers.","context":"“A subset of chats are reviewed by human reviewers (including Google’s trained service providers) to help improve Google services.”","document":"Gemini Apps Privacy Hub","source_url":"https://support.google.com/gemini/answer/13594961?hl=en","kept_on":"2026-11-04","snapshot_sha256":"ee8f0fa990d2760ebb62bbd7bad5cd6352b42e56252a35987d877bddb685621c","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/gemini-app/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Gemini Apps","product":"Gemini Apps for personal Google Accounts","field":"certifications","label":"Certifications and audits","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/gemini-app/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Gemini Apps","product":"Gemini Apps for personal Google Accounts","field":"dpa","label":"Data processing agreement","value":"not stated in the pages kept","quote":null,"context":null,"document":null,"source_url":null,"kept_on":null,"snapshot_sha256":null,"license":"quoted for comment","page":"https://jesseahawkins.com/vendors/gemini-app/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor":"Gemini Apps","product":"Gemini Apps for personal Google Accounts","field":"usage_limits","label":"Published usage limits","value":"Compute-based limits refresh every 5 hours up to a weekly limit; higher on paid plans; may change","quote":"Gemini Apps have compute-based usage limits that determine how much you can interact with Gemini tools and features. These limits factor in the complexity of your prompt, the models and features you use, and the length of your chat. Your limit refreshes every 5 hours until you reach your weekly limit.","context":"The page gives “Standard limits” without an AI plan, and AI Plus “2x higher than standard limits”. It also says “Limits may change without notice, including due to capacity constraints.”","document":"Gemini Apps limits & feature availability","source_url":"https://support.google.com/gemini/answer/16275805?hl=en","kept_on":"2026-11-04","snapshot_sha256":"9b8c6b0ed82564d6151b3baa7099af9fbadaae654dd2b1fa42c4ebd84b5b9fdf","license":"quoted for comment","page":"https://jesseahawkins.com/vendors/gemini-app/","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."}]}