{"title":"The AI vendor questionnaire, answered: each vendor’s answer to nine buyer questions, quoted","page":"https://jesseahawkins.com/vendors/questionnaire/","csv":"https://jesseahawkins.com/vendors/questionnaire.csv","terms":["Answers quote each vendor’s own page","questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)"],"checked":"2026-11-04","nextCheckBy":"2026-11-08","fields":[{"name":"vendor_id","type":"string"},{"name":"vendor","type":"string"},{"name":"question_id","type":"string"},{"name":"question","type":"string"},{"name":"state","type":"string"},{"name":"answer","type":"string"},{"name":"quote","type":"string"},{"name":"context","type":"string"},{"name":"source_title","type":"string"},{"name":"source_url","type":"string"},{"name":"kept_on","type":"string"},{"name":"kept_sha256","type":"string"},{"name":"note","type":"string"},{"name":"nist_ai_rmf","type":"string"},{"name":"nist_ai_600_1","type":"string"},{"name":"page","type":"string"},{"name":"license","type":"string"},{"name":"notice","type":"string"}],"rowCount":189,"rows":[{"vendor_id":"openai","vendor":"OpenAI","question_id":"Q1","question":"Does the vendor train its models on business and API customers’ data?","state":"answered","answer":"Not by default","quote":"As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us).","context":null,"source_title":"Data controls in the OpenAI platform","source_url":"https://developers.openai.com/api/docs/guides/your-data","kept_on":"2026-10-24","kept_sha256":"d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/openai/questionnaire/#q1","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"openai","vendor":"OpenAI","question_id":"Q2","question":"Does the vendor train its models on free and consumer use of its products?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"The vendor record does not read this point for OpenAI.","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/openai/questionnaire/#q2","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"openai","vendor":"OpenAI","question_id":"Q3","question":"How long does the vendor keep the data that customers send?","state":"answered","answer":"Up to 30 days in abuse monitoring logs, with listed exceptions","quote":"By default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days, unless longer retention is required by law, or is reasonably necessary to protect our services or any third party from harm.","context":"Under “Data retention controls for abuse monitoring”. Application state is kept separately; for /v1/responses the page says “response data will be stored for at least 30 days.”","source_title":"Data controls in the OpenAI platform","source_url":"https://developers.openai.com/api/docs/guides/your-data","kept_on":"2026-10-24","kept_sha256":"d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/openai/questionnaire/#q3","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"openai","vendor":"OpenAI","question_id":"Q4","question":"Can a customer have the vendor keep none of its data?","state":"answered","answer":"Zero Data Retention, on approval","quote":"Eligible customers may have their customer content excluded from these abuse monitoring logs, subject to the limitations below, by getting approved for the Zero Data Retention or Modified Abuse Monitoring controls.","context":null,"source_title":"Data controls in the OpenAI platform","source_url":"https://developers.openai.com/api/docs/guides/your-data","kept_on":"2026-10-24","kept_sha256":"d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/openai/questionnaire/#q4","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"openai","vendor":"OpenAI","question_id":"Q5","question":"Where does the vendor process and store customer data?","state":"answered","answer":"Data residency controls, for eligible customers","quote":"Data residency controls are a project configuration option that allow you to configure the location of infrastructure OpenAI uses to provide services.","context":"The next line reads: “Contact our sales team to see if you’re eligible for using data residency controls.”","source_title":"Data controls in the OpenAI platform","source_url":"https://developers.openai.com/api/docs/guides/your-data","kept_on":"2026-10-24","kept_sha256":"d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95","note":null,"nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"GV-6.1-009","page":"https://jesseahawkins.com/vendors/openai/questionnaire/#q5","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"openai","vendor":"OpenAI","question_id":"Q6","question":"Which other companies process customer data for the vendor?","state":"answered","answer":"Uses sub-processors; names Cloudflare for the US and EU endpoints","quote":"OpenAI uses sub-processors to provide its services. For requests sent to us.api.openai.com or eu.api.openai.com, OpenAI uses Cloudflare Regional Services so that TLS termination and HTTPS decryption occur within the selected processing region.","context":null,"source_title":"Data controls in the OpenAI platform","source_url":"https://developers.openai.com/api/docs/guides/your-data","kept_on":"2026-10-24","kept_sha256":"d0d554ce8d61f818c2daec0dc677f03534203f6e4c9b1cc74417687e61905c95","note":null,"nist_ai_rmf":"GOVERN-6.1 MANAGE-3.1","nist_ai_600_1":"GV-6.1-007","page":"https://jesseahawkins.com/vendors/openai/questionnaire/#q6","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"openai","vendor":"OpenAI","question_id":"Q7","question":"Which independent audits or certifications does the vendor name?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Data controls in the OpenAI platform; Rate limits","nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"A.1.3","page":"https://jesseahawkins.com/vendors/openai/questionnaire/#q7","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"openai","vendor":"OpenAI","question_id":"Q8","question":"Does the vendor publish a history of its service incidents?","state":"answered","answer":"Yes: a status history feed, with 106 incidents kept since 2026-07-28","quote":null,"context":null,"source_title":"Status history feed","source_url":"https://status.openai.com/feed.atom","kept_on":"2026-11-01","kept_sha256":"88638b2719babc963303bc5ee1759c9a85e62b1e828ad2fc480594a1f680e7dc","note":null,"nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/openai/questionnaire/#q8","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"openai","vendor":"OpenAI","question_id":"Q9","question":"Does the vendor publish the dates on which it retires its models?","state":"answered","answer":"Yes: OpenAI (“Deprecations”), with 171 dated retirements kept","quote":null,"context":null,"source_title":"Deprecations","source_url":"https://developers.openai.com/api/docs/deprecations","kept_on":"2026-10-26","kept_sha256":"2aa6645af2073bebb20649ece02be2159017dee0e5da36a3009ac5832e51afb6","note":null,"nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/openai/questionnaire/#q9","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"anthropic","vendor":"Anthropic","question_id":"Q1","question":"Does the vendor train its models on business and API customers’ data?","state":"answered","answer":"Not by default","quote":"By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models.","context":null,"source_title":"Is my data used for model training?","source_url":"https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training","kept_on":"2026-10-24","kept_sha256":"54617b76403faa9ba4db2ad4b7ba43a5c8d98fb8d9a2efbdbe18caac95e8a450","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/anthropic/questionnaire/#q1","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"anthropic","vendor":"Anthropic","question_id":"Q2","question":"Does the vendor train its models on free and consumer use of its products?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"The vendor record does not read this point for Anthropic.","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/anthropic/questionnaire/#q2","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"anthropic","vendor":"Anthropic","question_id":"Q3","question":"How long does the vendor keep the data that customers send?","state":"answered","answer":"Anthropic API: deleted within 30 days, with listed exceptions","quote":"For Anthropic API users, we automatically delete inputs and outputs on our backend within 30 days of receipt or generation","context":"Under “Standard Retention Timeframe”. The sentence continues with exceptions: longer-retention services such as the Files API, a zero data retention or other agreement, Usage Policy enforcement, and law. For other commercial products the page says: “we retain your chats and coding sessions in the product to provide you with a consistent product experience.”","source_title":"How long do you store my organization's data?","source_url":"https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data","kept_on":"2026-10-24","kept_sha256":"31c58317fd20d708fdb599ee7a29d7d8bd7875152c2cdad9fcc4a427c15149c0","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/anthropic/questionnaire/#q3","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"anthropic","vendor":"Anthropic","question_id":"Q4","question":"Can a customer have the vendor keep none of its data?","state":"answered","answer":"Zero data retention, by agreement","quote":"When you and we have agreed otherwise (e.g. zero data retention agreement)","context":"Under “Standard Retention Timeframe”, one of the listed exceptions to the rule that Anthropic API inputs and outputs are deleted within 30 days.","source_title":"How long do you store my organization's data?","source_url":"https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data","kept_on":"2026-10-24","kept_sha256":"31c58317fd20d708fdb599ee7a29d7d8bd7875152c2cdad9fcc4a427c15149c0","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/anthropic/questionnaire/#q4","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"anthropic","vendor":"Anthropic","question_id":"Q5","question":"Where does the vendor process and store customer data?","state":"answered","answer":"API inference: global by default (any geography) or US-only via inference_geo on Claude 4.6 and later, on the first-party API (except the OpenAI SDK compatibility endpoint) and some partner platforms; workspace data at rest: US only","quote":"Data residency controls let you manage where your data is processed and stored.","context":"The page says “Inference may run in any available geography for optimal performance and availability” for the default, “global”. Also: “The inference_geo parameter is supported on Claude 4.6 and later models.” Workspace geo: “Currently, \"us\" is the only available workspace geo.”","source_title":"Data residency","source_url":"https://platform.claude.com/docs/en/manage-claude/data-residency","kept_on":"2026-10-26","kept_sha256":"0171e6e8e8a1d63a6e24483d2d437d75b8ef141e26b197787c969208bb2345a7","note":null,"nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"GV-6.1-009","page":"https://jesseahawkins.com/vendors/anthropic/questionnaire/#q5","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"anthropic","vendor":"Anthropic","question_id":"Q6","question":"Which other companies process customer data for the vendor?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Is my data used for model training?; How long do you store my organization's data?; Commercial Terms of Service; Data residency; Rate limits","nist_ai_rmf":"GOVERN-6.1 MANAGE-3.1","nist_ai_600_1":"GV-6.1-007","page":"https://jesseahawkins.com/vendors/anthropic/questionnaire/#q6","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"anthropic","vendor":"Anthropic","question_id":"Q7","question":"Which independent audits or certifications does the vendor name?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Is my data used for model training?; How long do you store my organization's data?; Commercial Terms of Service; Data residency; Rate limits","nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"A.1.3","page":"https://jesseahawkins.com/vendors/anthropic/questionnaire/#q7","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"anthropic","vendor":"Anthropic","question_id":"Q8","question":"Does the vendor publish a history of its service incidents?","state":"answered","answer":"Yes: a status history feed, with 29 incidents kept since 2026-09-01","quote":null,"context":null,"source_title":"Status history feed","source_url":"https://status.claude.com/history.atom","kept_on":"2026-11-01","kept_sha256":"98e45177fc1ef3a14f1b3b1f64ebfd5239bea98f056c99e5407738c36b29271a","note":null,"nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/anthropic/questionnaire/#q8","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"anthropic","vendor":"Anthropic","question_id":"Q9","question":"Does the vendor publish the dates on which it retires its models?","state":"answered","answer":"Yes: Anthropic (“Model deprecations”), with 20 dated retirements kept","quote":null,"context":null,"source_title":"Model deprecations","source_url":"https://platform.claude.com/docs/en/about-claude/model-deprecations","kept_on":"2026-10-26","kept_sha256":"0bcf96b2eeed3e7d61b29fc17011e1593553806234dae0227815d574258b6c8a","note":null,"nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/anthropic/questionnaire/#q9","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"google","vendor":"Google","question_id":"Q1","question":"Does the vendor train its models on business and API customers’ data?","state":"answered","answer":"Not used to improve products, on paid use","quote":"When you use Paid Services, including, for example, the paid quota of the Gemini API, Google doesn't use your prompts (including associated system instructions, cached content, and files such as images, videos, or documents) or responses to improve our products","context":null,"source_title":"Gemini API Additional Terms of Service","source_url":"https://ai.google.dev/gemini-api/terms?hl=en","kept_on":"2026-10-24","kept_sha256":"0424aabe6c15afb2fd95ffdb4d70aadc44796c9d2f43592acfb015c56559734e","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/google/questionnaire/#q1","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"google","vendor":"Google","question_id":"Q2","question":"Does the vendor train its models on free and consumer use of its products?","state":"answered","answer":"Used to improve products, on unpaid use outside the EEA, Switzerland and the UK","quote":"When you use Unpaid Services, including, for example, Google AI Studio and the unpaid quota on Gemini API, Google uses the content you submit to the Services and any generated responses to provide, improve, and develop Google products and services and machine learning technologies","context":"Under “Unpaid Services”, “How Google Uses Your Data”. The same section says: “If you're in the European Economic Area, Switzerland, or the United Kingdom, the terms under \"How Google uses Your Data\" in \"Paid Services\" apply to all Services, including Google AI Studio and unpaid quota in the Gemini API, even though they are offered free of charge.”","source_title":"Gemini API Additional Terms of Service","source_url":"https://ai.google.dev/gemini-api/terms?hl=en","kept_on":"2026-10-24","kept_sha256":"0424aabe6c15afb2fd95ffdb4d70aadc44796c9d2f43592acfb015c56559734e","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/google/questionnaire/#q2","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"google","vendor":"Google","question_id":"Q3","question":"How long does the vendor keep the data that customers send?","state":"answered","answer":"A limited period, for abuse detection and legal disclosures, on paid use","quote":"For Paid Services, Google logs prompts and responses for a limited period of time, solely for detecting and preventing violations of the Prohibited Use Policy to maintain the safety and security of the Services, and any required legal or regulatory disclosures.","context":"Under “Paid Services”, “How Google Uses Your Data”. The page does not state the length of the period. Some features have their own terms; for Grounding with Google Search the page says Google will store prompts, contextual information that you may provide, and output for thirty (30) days.","source_title":"Gemini API Additional Terms of Service","source_url":"https://ai.google.dev/gemini-api/terms?hl=en","kept_on":"2026-10-24","kept_sha256":"0424aabe6c15afb2fd95ffdb4d70aadc44796c9d2f43592acfb015c56559734e","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/google/questionnaire/#q3","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"google","vendor":"Google","question_id":"Q4","question":"Can a customer have the vendor keep none of its data?","state":"answered","answer":"Zero data retention on Google Cloud, with customer actions; not possible with some features","quote":"To achieve zero data retention, customers must take specific actions within each of these areas:","context":"Under “Customer data retention and achieving zero data retention”. The same page says: “Zero data retention may not be possible when using some Advanced AI features.” and, for Grounding with Google Search and Google Maps, “There is no way to disable the storage of this information”.","source_title":"Gemini Enterprise Agent Platform and zero data retention","source_url":"https://docs.cloud.google.com/gemini-enterprise-agent-platform/resources/zero-data-retention","kept_on":"2026-10-24","kept_sha256":"dca5cdf5c2adfdd633ad5d1a6f3cabc94ce13e9cff0daacccd29d591ee853056","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/google/questionnaire/#q4","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"google","vendor":"Google","question_id":"Q5","question":"Where does the vendor process and store customer data?","state":"answered","answer":"On Google Cloud: at rest in the chosen location; global endpoints carry no guarantee","quote":"Data stored at rest in the customer selected location remains at rest in that location, independent of the Gemini Enterprise Agent Platform endpoint called by that customer's request.","context":"The page adds: “Requests submitted to a global endpoint may be processed in any Google Cloud location around the world, and therefore don't provide any data residency guarantees.”","source_title":"Data residency","source_url":"https://docs.cloud.google.com/gemini-enterprise-agent-platform/resources/data-residency","kept_on":"2026-10-26","kept_sha256":"dbd4fd892d3f15210d9d553cb2e6920be55a339c3fe9ec124cc6501551d0040b","note":null,"nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"GV-6.1-009","page":"https://jesseahawkins.com/vendors/google/questionnaire/#q5","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"google","vendor":"Google","question_id":"Q6","question":"Which other companies process customer data for the vendor?","state":"answered","answer":"A published list for Google Cloud, AI services included","quote":"Google and its affiliates engage the third-party entities in the table below to perform limited activities in connection with the Google Cloud Platform Services.","context":"Several rows name the service “All AI Solutions, Pre-Trained APIs, AI Platform/Gemini platform (formerly Vertex AI), Generative AI Services and Agentic AI Services”.","source_title":"Google Cloud Platform Subprocessors","source_url":"https://cloud.google.com/terms/subprocessors","kept_on":"2026-10-26","kept_sha256":"a6ed1984ff40698b2be48013e848b0eea59c98994ce442ecc48211e699a547d6","note":null,"nist_ai_rmf":"GOVERN-6.1 MANAGE-3.1","nist_ai_600_1":"GV-6.1-007","page":"https://jesseahawkins.com/vendors/google/questionnaire/#q6","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"google","vendor":"Google","question_id":"Q7","question":"Which independent audits or certifications does the vendor name?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Gemini API Additional Terms of Service; Gemini Enterprise Agent Platform and zero data retention; Data residency; Google Cloud Platform Subprocessors; Generative AI on Agent Platform quotas and system limits","nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"A.1.3","page":"https://jesseahawkins.com/vendors/google/questionnaire/#q7","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"google","vendor":"Google","question_id":"Q8","question":"Does the vendor publish a history of its service incidents?","state":"answered","answer":"Yes: a status history feed, with 1 incident kept since 2026-02-27","quote":null,"context":null,"source_title":"Status history feed","source_url":"https://status.cloud.google.com/incidents.json","kept_on":"2026-11-01","kept_sha256":"5e979a2555c2cf1adacb3da57cf2e35ee54bc7ff72ea6b436dba8db507c43f9d","note":null,"nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/google/questionnaire/#q8","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"google","vendor":"Google","question_id":"Q9","question":"Does the vendor publish the dates on which it retires its models?","state":"answered","answer":"Yes: Google’s Gemini API (“Gemini deprecations”) and Google’s Vertex AI (“Model versions and lifecycle”), with 94 dated retirements kept","quote":null,"context":null,"source_title":"Gemini deprecations / Model versions and lifecycle","source_url":"https://ai.google.dev/gemini-api/docs/deprecations / https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/model-versions","kept_on":"2026-10-26 / 2026-10-26","kept_sha256":"e067aa760fafd771111be18309af9e764403de776977128e8ea89f9f40a987ec / 6cf2d171db3cd6f6bb529afc4508a573c29b651e1c82a6d6ea28476d417112c8","note":null,"nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/google/questionnaire/#q9","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"microsoft","vendor":"Microsoft","question_id":"Q1","question":"Does the vendor train its models on business and API customers’ data?","state":"answered","answer":"Not without permission","quote":"Your prompts (inputs) and completions (outputs), your embeddings, and your training data: are NOT available to other customers. are NOT available to OpenAI or other providers of Models sold by Azure. are NOT used by providers of Models sold by Azure to improve their models or services. are NOT used to train any generative AI foundation models without your permission or instruction.","context":null,"source_title":"Data, privacy, and security for Foundry Models sold by Azure","source_url":"https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy","kept_on":"2026-10-24","kept_sha256":"cb7f0b5243c1a1e30e5074c37119277a1f985a202df84c4f208cc881f9f23a54","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/microsoft/questionnaire/#q1","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"microsoft","vendor":"Microsoft","question_id":"Q2","question":"Does the vendor train its models on free and consumer use of its products?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"The vendor record does not read this point for Microsoft.","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/microsoft/questionnaire/#q2","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"microsoft","vendor":"Microsoft","question_id":"Q3","question":"How long does the vendor keep the data that customers send?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Data, privacy, and security for Foundry Models sold by Azure; Abuse monitoring; Azure OpenAI in Microsoft Foundry Models quotas and limits; Microsoft Products and Services Data Protection Addendum","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/microsoft/questionnaire/#q3","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"microsoft","vendor":"Microsoft","question_id":"Q4","question":"Can a customer have the vendor keep none of its data?","state":"answered","answer":"Modified abuse monitoring, by application","quote":"Microsoft allows customers who meet additional Limited Access eligibility criteria to apply to modify abuse monitoring by completing this form.","context":null,"source_title":"Abuse monitoring","source_url":"https://learn.microsoft.com/en-us/azure/foundry/openai/concepts/abuse-monitoring","kept_on":"2026-10-24","kept_sha256":"8ccd372f07b1ff5025f76ee926a327ed635d65e8bc318ac3d3a498f194d57f6f","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/microsoft/questionnaire/#q4","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"microsoft","vendor":"Microsoft","question_id":"Q5","question":"Where does the vendor process and store customer data?","state":"answered","answer":"In the customer’s chosen geography, except Global and DataZone deployments","quote":"Prompts and responses are processed within the customer-specified geography (unless you are using a Global or DataZone deployment type), but may be processed between regions within the geography for operational purposes (including performance and capacity management).","context":null,"source_title":"Data, privacy, and security for Foundry Models sold by Azure","source_url":"https://learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy","kept_on":"2026-10-24","kept_sha256":"cb7f0b5243c1a1e30e5074c37119277a1f985a202df84c4f208cc881f9f23a54","note":null,"nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"GV-6.1-009","page":"https://jesseahawkins.com/vendors/microsoft/questionnaire/#q5","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"microsoft","vendor":"Microsoft","question_id":"Q6","question":"Which other companies process customer data for the vendor?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Data, privacy, and security for Foundry Models sold by Azure; Abuse monitoring; Azure OpenAI in Microsoft Foundry Models quotas and limits; Microsoft Products and Services Data Protection Addendum","nist_ai_rmf":"GOVERN-6.1 MANAGE-3.1","nist_ai_600_1":"GV-6.1-007","page":"https://jesseahawkins.com/vendors/microsoft/questionnaire/#q6","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"microsoft","vendor":"Microsoft","question_id":"Q7","question":"Which independent audits or certifications does the vendor name?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Data, privacy, and security for Foundry Models sold by Azure; Abuse monitoring; Azure OpenAI in Microsoft Foundry Models quotas and limits; Microsoft Products and Services Data Protection Addendum","nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"A.1.3","page":"https://jesseahawkins.com/vendors/microsoft/questionnaire/#q7","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"microsoft","vendor":"Microsoft","question_id":"Q8","question":"Does the vendor publish a history of its service incidents?","state":"not-kept","answer":"No answer kept","quote":null,"context":null,"source_title":null,"source_url":"https://azure.status.microsoft/en-us/status/feed/","kept_on":null,"kept_sha256":null,"note":"The linked feed holds open events only. Past incidents are reviews on an HTML page, not a feed.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/microsoft/questionnaire/#q8","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"microsoft","vendor":"Microsoft","question_id":"Q9","question":"Does the vendor publish the dates on which it retires its models?","state":"answered","answer":"Yes: Azure AI Foundry (“Model retirement schedule”), with 166 dated retirements kept","quote":null,"context":null,"source_title":"Model retirement schedule","source_url":"https://learn.microsoft.com/en-us/azure/foundry/openai/concepts/model-retirement-schedule","kept_on":"2026-10-26","kept_sha256":"ab49910725d1a89ff85729928ee88081540b2ba8b066c3fe57ab01ac40e7bc0b","note":null,"nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/microsoft/questionnaire/#q9","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"aws","vendor":"AWS","question_id":"Q1","question":"Does the vendor train its models on business and API customers’ data?","state":"answered","answer":"No, for Amazon Nova, Amazon Titan and third-party models","quote":"No, AWS and the third-party model providers will not use any inputs to or outputs from Amazon Bedrock to train Amazon Nova, Amazon Titan, or any third-party models.","context":"Answer to the FAQ “Will AWS and third-party model providers use customer inputs to or outputs from Amazon Bedrock to train Amazon Nova, Amazon Titan or any third-party models?”","source_title":"Amazon Bedrock FAQs","source_url":"https://aws.amazon.com/bedrock/faqs/","kept_on":"2026-10-24","kept_sha256":"b48072e9d7367e42810904e0a76cd855f3583e22f714aa924bdf453312e751ce","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/aws/questionnaire/#q1","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"aws","vendor":"AWS","question_id":"Q2","question":"Does the vendor train its models on free and consumer use of its products?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"The vendor record does not read this point for AWS.","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/aws/questionnaire/#q2","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"aws","vendor":"AWS","question_id":"Q3","question":"How long does the vendor keep the data that customers send?","state":"answered","answer":"Set by the model and the account's retention mode","quote":"Default means the data retention policy of the model applies. There is no change to previous model retention behavior; if ZDR applied previously, then ZDR still applies. Actual retention depends on the model — consult the model's terms for specifics.","context":null,"source_title":"Data retention","source_url":"https://docs.aws.amazon.com/bedrock/latest/userguide/data-retention.html","kept_on":"2026-10-24","kept_sha256":"a7a8c4c5f2f7d3fbcd9a722db22b01822e09ddbfc7ee27aae794c3e3a757d163","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/aws/questionnaire/#q3","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"aws","vendor":"AWS","question_id":"Q4","question":"Can a customer have the vendor keep none of its data?","state":"answered","answer":"Zero data retention mode, for models that allow it; for other models, eligibility is evaluated per account and model","quote":"Zero data retention. No request or response data is written to durable storage by AWS or shared with the model provider.","context":"In the “Data retention modes” table, the behavior of mode “none”. Under “Zero data retention (ZDR) access” the page says: “Some models require data retention for safety and abuse-prevention purposes.” and “ZDR access is evaluated on a per-account, per-model basis in coordination with the model provider.”","source_title":"Data retention","source_url":"https://docs.aws.amazon.com/bedrock/latest/userguide/data-retention.html","kept_on":"2026-10-24","kept_sha256":"a7a8c4c5f2f7d3fbcd9a722db22b01822e09ddbfc7ee27aae794c3e3a757d163","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/aws/questionnaire/#q4","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"aws","vendor":"AWS","question_id":"Q5","question":"Where does the vendor process and store customer data?","state":"answered","answer":"Stored at rest in the AWS Region in use","quote":"Any customer content processed by Amazon Bedrock is encrypted and stored at rest in the AWS Region where you are using Amazon Bedrock.","context":null,"source_title":"Amazon Bedrock FAQs","source_url":"https://aws.amazon.com/bedrock/faqs/","kept_on":"2026-10-24","kept_sha256":"b48072e9d7367e42810904e0a76cd855f3583e22f714aa924bdf453312e751ce","note":null,"nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"GV-6.1-009","page":"https://jesseahawkins.com/vendors/aws/questionnaire/#q5","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"aws","vendor":"AWS","question_id":"Q6","question":"Which other companies process customer data for the vendor?","state":"answered","answer":"A published list, by Region and service","quote":"Sub-processors relevant to an individual customer will depend on the AWS Region the customer selects and the particular AWS services that the customer uses.","context":null,"source_title":"AWS Sub-processors","source_url":"https://aws.amazon.com/compliance/sub-processors/","kept_on":"2026-10-26","kept_sha256":"f2060d7e438446b0ed1f7c951c195c9268e686dff08f34a64b33336d68bf2295","note":null,"nist_ai_rmf":"GOVERN-6.1 MANAGE-3.1","nist_ai_600_1":"GV-6.1-007","page":"https://jesseahawkins.com/vendors/aws/questionnaire/#q6","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"aws","vendor":"AWS","question_id":"Q7","question":"Which independent audits or certifications does the vendor name?","state":"answered","answer":"In scope for FedRAMP Moderate, SOC, ISO and HIPAA eligibility","quote":"Amazon Bedrock is in scope for common compliance standards such as Fedramp Moderate, Service and Organization Control (SOC), International Organization for Standardization (ISO), Health Insurance Portability and Accountability Act (HIPAA) eligibility, and customers can use Bedrock in compliance with the General Data Protection Regulation (GDPR).","context":"The same answer lists “ISO 9001, ISO 27001, ISO 27017, ISO 27018, ISO 27701, ISO 22301, and ISO 20000”.","source_title":"Amazon Bedrock FAQs","source_url":"https://aws.amazon.com/bedrock/faqs/","kept_on":"2026-10-24","kept_sha256":"b48072e9d7367e42810904e0a76cd855f3583e22f714aa924bdf453312e751ce","note":null,"nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"A.1.3","page":"https://jesseahawkins.com/vendors/aws/questionnaire/#q7","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"aws","vendor":"AWS","question_id":"Q8","question":"Does the vendor publish a history of its service incidents?","state":"not-kept","answer":"No answer kept","quote":null,"context":null,"source_title":null,"source_url":"https://status.aws.amazon.com/rss/bedrock-us-east-1.rss","kept_on":null,"kept_sha256":null,"note":"AWS links one feed for each service in each region, not a history for Bedrock as a whole.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/aws/questionnaire/#q8","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"aws","vendor":"AWS","question_id":"Q9","question":"Does the vendor publish the dates on which it retires its models?","state":"answered","answer":"Yes: Amazon Bedrock (“Model lifecycle (Legacy)”), with 48 dated retirements kept","quote":null,"context":null,"source_title":"Model lifecycle (Legacy)","source_url":"https://docs.aws.amazon.com/bedrock/latest/userguide/model-lifecycle-legacy.html","kept_on":"2026-10-26","kept_sha256":"288d35192d0980cbe5aee02b367577b1234dcdc79e20d416993f7e09846bbd4e","note":null,"nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/aws/questionnaire/#q9","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"mistral","vendor":"Mistral AI","question_id":"Q1","question":"Does the vendor train its models on business and API customers’ data?","state":"answered","answer":"Opt-out offered on Mistral Studio pay-as-you-go; Vibe Enterprise is opted out by default","quote":"Customers retain full control over this processing and have the right to opt out at any time.","context":"Under “Pay-as-you-go”, in “Controls on Mistral Studio”. Under “Vibe (Enterprise)” the page says: “Enterprise customers are opted out of training by default.”","source_title":"Do you use my user data to train your Artificial Intelligence models?","source_url":"https://help.mistral.ai/en/articles/347617-do-you-use-my-user-data-to-train-your-artificial-intelligence-models","kept_on":"2026-10-24","kept_sha256":"d89b5b5e734d152d8688519b0a5e89ead5f72b8361021febf216a7dfae1c4bdf","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/mistral/questionnaire/#q1","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"mistral","vendor":"Mistral AI","question_id":"Q2","question":"Does the vendor train its models on free and consumer use of its products?","state":"answered","answer":"Yes by default on Vibe, with an opt-out","quote":"Input and output data are used by default to train our artificial intelligence models, unless you opt out of training at any time.","context":"Under “Vibe”, in “Controls on Vibe”.","source_title":"Do you use my user data to train your Artificial Intelligence models?","source_url":"https://help.mistral.ai/en/articles/347617-do-you-use-my-user-data-to-train-your-artificial-intelligence-models","kept_on":"2026-10-24","kept_sha256":"d89b5b5e734d152d8688519b0a5e89ead5f72b8361021febf216a7dfae1c4bdf","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/mistral/questionnaire/#q2","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"mistral","vendor":"Mistral AI","question_id":"Q3","question":"How long does the vendor keep the data that customers send?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Do you use my user data to train your Artificial Intelligence models?; Can I activate Zero Data Retention (ZDR)?; Usage and limits","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/mistral/questionnaire/#q3","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"mistral","vendor":"Mistral AI","question_id":"Q4","question":"Can a customer have the vendor keep none of its data?","state":"answered","answer":"Zero Data Retention, pay-as-you-go stateless API calls, on approved request","quote":"Zero Data Retention (ZDR) is available only with pay-as-you-go and only for stateless API calls.","context":"Under “How to request ZDR” the same page says: “We will review your request and, at our discretion, approve or deny it.”","source_title":"Can I activate Zero Data Retention (ZDR)?","source_url":"https://help.mistral.ai/en/articles/347612-can-i-activate-zero-data-retention-zdr","kept_on":"2026-10-24","kept_sha256":"c96aadfeac722f65391666944a3e15859341f48d6418bf79e34919e2cd8b2d49","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/mistral/questionnaire/#q4","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"mistral","vendor":"Mistral AI","question_id":"Q5","question":"Where does the vendor process and store customer data?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Do you use my user data to train your Artificial Intelligence models?; Can I activate Zero Data Retention (ZDR)?; Usage and limits","nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"GV-6.1-009","page":"https://jesseahawkins.com/vendors/mistral/questionnaire/#q5","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"mistral","vendor":"Mistral AI","question_id":"Q6","question":"Which other companies process customer data for the vendor?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Do you use my user data to train your Artificial Intelligence models?; Can I activate Zero Data Retention (ZDR)?; Usage and limits","nist_ai_rmf":"GOVERN-6.1 MANAGE-3.1","nist_ai_600_1":"GV-6.1-007","page":"https://jesseahawkins.com/vendors/mistral/questionnaire/#q6","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"mistral","vendor":"Mistral AI","question_id":"Q7","question":"Which independent audits or certifications does the vendor name?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Do you use my user data to train your Artificial Intelligence models?; Can I activate Zero Data Retention (ZDR)?; Usage and limits","nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"A.1.3","page":"https://jesseahawkins.com/vendors/mistral/questionnaire/#q7","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"mistral","vendor":"Mistral AI","question_id":"Q8","question":"Does the vendor publish a history of its service incidents?","state":"not-kept","answer":"No answer kept","quote":null,"context":null,"source_title":null,"source_url":"https://status.mistral.ai/","kept_on":null,"kept_sha256":null,"note":"The status page refused this site’s request.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/mistral/questionnaire/#q8","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"mistral","vendor":"Mistral AI","question_id":"Q9","question":"Does the vendor publish the dates on which it retires its models?","state":"answered","answer":"Yes: Mistral AI (“Models: deprecated and retired”), with 44 dated retirements kept","quote":null,"context":null,"source_title":"Models: deprecated and retired","source_url":"https://docs.mistral.ai/models","kept_on":"2026-10-26","kept_sha256":"436af2fc557411e93da8115e6a2a884a38c06e5d69b362d1dbd118a40459f30d","note":null,"nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/mistral/questionnaire/#q9","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"cohere","vendor":"Cohere","question_id":"Q1","question":"Does the vendor train its models on business and API customers’ data?","state":"answered","answer":"Opt-out offered","quote":"Enterprise customers can access opt out toggle in the Cohere dashboard settings. If you are opted out, prompts and generations will not be used to train Cohere models.","context":null,"source_title":"Enterprise data commitments","source_url":"https://cohere.com/enterprise-data-commitments","kept_on":"2026-10-24","kept_sha256":"efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/cohere/questionnaire/#q1","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"cohere","vendor":"Cohere","question_id":"Q2","question":"Does the vendor train its models on free and consumer use of its products?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"The vendor record does not read this point for Cohere.","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/cohere/questionnaire/#q2","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"cohere","vendor":"Cohere","question_id":"Q3","question":"How long does the vendor keep the data that customers send?","state":"answered","answer":"Deleted after 30 days, with listed exceptions","quote":"For the SaaS Platform, we automatically delete logged prompts and generations after 30 days, unless we need to retain them to comply with a legal requirement or a customer contract, or unless your usage is flagged as potentially violating our terms, including our Usage Policy (e.g. abuse or misuse of our services).","context":"Under the FAQ “How long does Cohere retain enterprise data?”. The same answer says: “Prompts and generations that you allow Cohere to use for training purposes may be retained separately.”","source_title":"Enterprise data commitments","source_url":"https://cohere.com/enterprise-data-commitments","kept_on":"2026-10-24","kept_sha256":"efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/cohere/questionnaire/#q3","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"cohere","vendor":"Cohere","question_id":"Q4","question":"Can a customer have the vendor keep none of its data?","state":"answered","answer":"Zero data retention, on request, for enterprise customers who make additional usage commitments","quote":"we only allow ZDR for enterprise customers who can make additional commitments about their usage of the Cohere Services","context":"Under the FAQ “What is zero data retention and how do I request it?”. The same answer says: “ZDR does not affect usage data, which Cohere still receives.”","source_title":"Enterprise data commitments","source_url":"https://cohere.com/enterprise-data-commitments","kept_on":"2026-10-24","kept_sha256":"efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/cohere/questionnaire/#q4","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"cohere","vendor":"Cohere","question_id":"Q5","question":"Where does the vendor process and store customer data?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Enterprise data commitments; Different Types of API Keys and Rate Limits","nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"GV-6.1-009","page":"https://jesseahawkins.com/vendors/cohere/questionnaire/#q5","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"cohere","vendor":"Cohere","question_id":"Q6","question":"Which other companies process customer data for the vendor?","state":"answered","answer":"Listed on its Trust Center","quote":"You can view a list of sub-processors by visiting Cohere’s Trust Center.","context":null,"source_title":"Enterprise data commitments","source_url":"https://cohere.com/enterprise-data-commitments","kept_on":"2026-10-24","kept_sha256":"efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb","note":null,"nist_ai_rmf":"GOVERN-6.1 MANAGE-3.1","nist_ai_600_1":"GV-6.1-007","page":"https://jesseahawkins.com/vendors/cohere/questionnaire/#q6","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"cohere","vendor":"Cohere","question_id":"Q7","question":"Which independent audits or certifications does the vendor name?","state":"answered","answer":"ISO 27001, ISO 42001 and a SOC 2 Type II report, on request","quote":"Seamlessly complete your privacy and security compliance reviews by visiting Cohere’s Trust Center where you can request a copy of our certifications (including ISO 27001 and ISO 42001) or of our SOC 2 Type II Report or review our other compliance resources.","context":null,"source_title":"Enterprise data commitments","source_url":"https://cohere.com/enterprise-data-commitments","kept_on":"2026-10-24","kept_sha256":"efc3dd381093d26d11f8964c533648dbf1cf7b560630dec1d2a055ac77701aeb","note":null,"nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"A.1.3","page":"https://jesseahawkins.com/vendors/cohere/questionnaire/#q7","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"cohere","vendor":"Cohere","question_id":"Q8","question":"Does the vendor publish a history of its service incidents?","state":"answered","answer":"Yes: a status history feed, with 2 incidents kept since 2026-08-05","quote":null,"context":null,"source_title":"Status history feed","source_url":"https://status.cohere.com/feed.atom","kept_on":"2026-11-01","kept_sha256":"0c5b950805a1d00f26c28105b5c71683c72794b00b52efd60549fb9c5c9f3677","note":null,"nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/cohere/questionnaire/#q8","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"cohere","vendor":"Cohere","question_id":"Q9","question":"Does the vendor publish the dates on which it retires its models?","state":"answered","answer":"Yes: Cohere (“Deprecations”), with 2 dated retirements kept","quote":null,"context":null,"source_title":"Deprecations","source_url":"https://docs.cohere.com/docs/deprecations","kept_on":"2026-10-26","kept_sha256":"1bfa133780c0da5e0246dc4370424d48384b2b745e3b3d312903375533c6f9c8","note":null,"nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/cohere/questionnaire/#q9","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"deepseek","vendor":"DeepSeek","question_id":"Q1","question":"Does the vendor train its models on business and API customers’ data?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: DeepSeek Privacy Policy; DeepSeek Open Platform Terms of Service; Rate Limit & Isolation","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/deepseek/questionnaire/#q1","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"deepseek","vendor":"DeepSeek","question_id":"Q2","question":"Does the vendor train its models on free and consumer use of its products?","state":"answered","answer":"Listed as a use of personal data","quote":"To improve and develop the Services and to train and improve our technology, such as our machine learning models and algorithms.","context":null,"source_title":"DeepSeek Privacy Policy","source_url":"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html","kept_on":"2026-10-24","kept_sha256":"339984e36a795843ee2b5b917797072ec249f3c0e9ff7cbbfe754c01caa4f069","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/deepseek/questionnaire/#q2","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"deepseek","vendor":"DeepSeek","question_id":"Q3","question":"How long does the vendor keep the data that customers send?","state":"answered","answer":"As long as necessary; inputs are kept for as long as you have an account","quote":"we keep this Personal Data for as long as you have an account. This Personal Data includes your account Personal Data, input and payment Personal Data.","context":"Under “How Long Do We Keep Your Personal Data”, given as an example of the general rule: “We retain Personal Data for as long as necessary to provide our Services and for the other purposes set out in this Privacy Policy.” The Privacy Policy does not cover end users of apps built on the Open Platform.","source_title":"DeepSeek Privacy Policy","source_url":"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html","kept_on":"2026-10-24","kept_sha256":"339984e36a795843ee2b5b917797072ec249f3c0e9ff7cbbfe754c01caa4f069","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/deepseek/questionnaire/#q3","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"deepseek","vendor":"DeepSeek","question_id":"Q4","question":"Can a customer have the vendor keep none of its data?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: DeepSeek Privacy Policy; DeepSeek Open Platform Terms of Service; Rate Limit & Isolation","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/deepseek/questionnaire/#q4","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"deepseek","vendor":"DeepSeek","question_id":"Q5","question":"Where does the vendor process and store customer data?","state":"answered","answer":"Personal data collected, processed and stored in the People’s Republic of China","quote":"To provide you with our services, we directly collect, process and store your Personal Data in People's Republic of China.","context":null,"source_title":"DeepSeek Privacy Policy","source_url":"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html","kept_on":"2026-10-24","kept_sha256":"339984e36a795843ee2b5b917797072ec249f3c0e9ff7cbbfe754c01caa4f069","note":null,"nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"GV-6.1-009","page":"https://jesseahawkins.com/vendors/deepseek/questionnaire/#q5","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"deepseek","vendor":"DeepSeek","question_id":"Q6","question":"Which other companies process customer data for the vendor?","state":"answered","answer":"Service providers by category; no list in the kept pages","quote":"We engage service providers that help us provide, support, and develop the Services and understand how they are used.","context":null,"source_title":"DeepSeek Privacy Policy","source_url":"https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html","kept_on":"2026-10-24","kept_sha256":"339984e36a795843ee2b5b917797072ec249f3c0e9ff7cbbfe754c01caa4f069","note":null,"nist_ai_rmf":"GOVERN-6.1 MANAGE-3.1","nist_ai_600_1":"GV-6.1-007","page":"https://jesseahawkins.com/vendors/deepseek/questionnaire/#q6","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"deepseek","vendor":"DeepSeek","question_id":"Q7","question":"Which independent audits or certifications does the vendor name?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: DeepSeek Privacy Policy; DeepSeek Open Platform Terms of Service; Rate Limit & Isolation","nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"A.1.3","page":"https://jesseahawkins.com/vendors/deepseek/questionnaire/#q7","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"deepseek","vendor":"DeepSeek","question_id":"Q8","question":"Does the vendor publish a history of its service incidents?","state":"answered","answer":"Yes: a status history feed, with 36 incidents kept since 2026-07-28","quote":null,"context":null,"source_title":"Status history feed","source_url":"https://status.deepseek.com/feed.atom","kept_on":"2026-11-01","kept_sha256":"367102b1baade2310f96e83d54f15dc7981b278c4dadad3e96a28d6861fcad19","note":null,"nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/deepseek/questionnaire/#q8","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"deepseek","vendor":"DeepSeek","question_id":"Q9","question":"Does the vendor publish the dates on which it retires its models?","state":"not-kept","answer":"No answer kept","quote":null,"context":null,"source_title":null,"source_url":"https://api-docs.deepseek.com/updates","kept_on":null,"kept_sha256":null,"note":"The change log names model updates but gives no table of deprecation or retirement dates.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/deepseek/questionnaire/#q9","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"xai","vendor":"xAI","question_id":"Q1","question":"Does the vendor train its models on business and API customers’ data?","state":"answered","answer":"Not without permission","quote":"SpaceXSI never trains on your API inputs or outputs without your explicit permission.","context":null,"source_title":"FAQ: API security","source_url":"https://docs.x.ai/developers/faq/security","kept_on":"2026-10-24","kept_sha256":"30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/xai/questionnaire/#q1","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"xai","vendor":"xAI","question_id":"Q2","question":"Does the vendor train its models on free and consumer use of its products?","state":"answered","answer":"Listed as a use of personal information","quote":"To develop and improve our Service and to conduct research: For example to develop new product features, to train our models","context":null,"source_title":"Privacy Policy","source_url":"https://x.ai/legal/privacy-policy","kept_on":"2026-10-24","kept_sha256":"17d51a8463735c94cddbabee411c750b5ae36e9b761d5c6a806aed870c48dd04","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/xai/questionnaire/#q2","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"xai","vendor":"xAI","question_id":"Q3","question":"How long does the vendor keep the data that customers send?","state":"answered","answer":"30 days","quote":"By default, all API requests and responses are stored on our servers (encrypted at rest) for 30 days","context":null,"source_title":"FAQ: API security","source_url":"https://docs.x.ai/developers/faq/security","kept_on":"2026-10-24","kept_sha256":"30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/xai/questionnaire/#q3","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"xai","vendor":"xAI","question_id":"Q4","question":"Can a customer have the vendor keep none of its data?","state":"answered","answer":"Zero Data Retention, a team setting where self-serve is available","quote":"Where available, a team admin can turn it on or off directly from the xAI Console.","context":"Under “What is Zero Data Retention (ZDR)?”, item “Self-serve”. Under “How to enable ZDR” the page says “self-serve ZDR may not be enabled for your environment yet”; teams on a negotiated Enterprise Customer Agreement are told to contact sales.","source_title":"FAQ: API security","source_url":"https://docs.x.ai/developers/faq/security","kept_on":"2026-10-24","kept_sha256":"30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/xai/questionnaire/#q4","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"xai","vendor":"xAI","question_id":"Q5","question":"Where does the vendor process and store customer data?","state":"answered","answer":"US only on the US regional endpoint, for two models, with listed exclusions","quote":"To keep API request handling, model inference, moderation, and retained request data in the United States, use the US regional endpoint, https://us.api.x.ai/v1.","context":"The same answer begins: “The default endpoint, https://api.x.ai, does not guarantee a processing region.” It adds: “It currently serves only grok-4.7 and grok-4.6” and “Files, Collections, server-side tools, and the network path from your systems to the endpoint are outside the guarantee.”","source_title":"FAQ: API security","source_url":"https://docs.x.ai/developers/faq/security","kept_on":"2026-10-24","kept_sha256":"30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1","note":null,"nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"GV-6.1-009","page":"https://jesseahawkins.com/vendors/xai/questionnaire/#q5","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"xai","vendor":"xAI","question_id":"Q6","question":"Which other companies process customer data for the vendor?","state":"answered","answer":"A published list; new names 15 days in advance","quote":"SpaceXSI will notify you if we add or replace Subprocessors at least fifteen (15) days before such changes take effect.","context":"The DPA says: “SpaceXSI's list of general Subprocessors is available at https://x.ai/legal/subprocessor-list”. The record does not keep that list.","source_title":"Data Processing Addendum","source_url":"https://x.ai/legal/data-processing-addendum","kept_on":"2026-11-03","kept_sha256":"d932580a20340627ba7ac1ac70ae6ec6f710a99ef5c060e3e2ba7b3ff5e1e429","note":null,"nist_ai_rmf":"GOVERN-6.1 MANAGE-3.1","nist_ai_600_1":"GV-6.1-007","page":"https://jesseahawkins.com/vendors/xai/questionnaire/#q6","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"xai","vendor":"xAI","question_id":"Q7","question":"Which independent audits or certifications does the vendor name?","state":"answered","answer":"SOC 2 Type 2","quote":"We are SOC 2 Type 2 compliant. Customers with a signed NDA can refer to our Trust Center for up-to-date information on our certifications and data governance.","context":null,"source_title":"FAQ: API security","source_url":"https://docs.x.ai/developers/faq/security","kept_on":"2026-10-24","kept_sha256":"30d858f37eb6b63d74058ff36e9c32176398af2d0e4799f71af83b4c35b7f1d1","note":null,"nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"A.1.3","page":"https://jesseahawkins.com/vendors/xai/questionnaire/#q7","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"xai","vendor":"xAI","question_id":"Q8","question":"Does the vendor publish a history of its service incidents?","state":"answered","answer":"Yes: a status history feed, with 97 incidents kept since 2026-08-17","quote":null,"context":null,"source_title":"Status history feed","source_url":"https://status.x.ai/feed.xml","kept_on":"2026-11-01","kept_sha256":"d6ccd699fcdff1a0e751cf57de85ac11717413ced8e0f2db163646211b903374","note":null,"nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/xai/questionnaire/#q8","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"xai","vendor":"xAI","question_id":"Q9","question":"Does the vendor publish the dates on which it retires its models?","state":"not-kept","answer":"No answer kept","quote":null,"context":null,"source_title":null,"source_url":"https://docs.x.ai/developers/models","kept_on":null,"kept_sha256":null,"note":"The models page holds no table in its HTML. Its retirement dates are in the page’s script, which this record does not run.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/xai/questionnaire/#q9","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"alibaba","vendor":"Alibaba Cloud","question_id":"Q1","question":"Does the vendor train its models on business and API customers’ data?","state":"answered","answer":"No","quote":"Alibaba Cloud strictly protects your data privacy and will never use your data for model training.","context":"The data retention policy says it will not use business data to train, fine-tune or improve a foundation model without “separate consent”.","source_title":"Security certifications and privacy","source_url":"https://www.alibabacloud.com/help/en/model-studio/privacy-notice","kept_on":"2026-10-26","kept_sha256":"60573ba1ba19bb4030c3193263005b8b7a2b9f4b34fd1809558a72657f02a2c0","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/alibaba/questionnaire/#q1","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"alibaba","vendor":"Alibaba Cloud","question_id":"Q2","question":"Does the vendor train its models on free and consumer use of its products?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"The vendor record does not read this point for Alibaba Cloud.","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/alibaba/questionnaire/#q2","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"alibaba","vendor":"Alibaba Cloud","question_id":"Q3","question":"How long does the vendor keep the data that customers send?","state":"answered","answer":"Up to 30 days, with listed exceptions","quote":"By default, user’s prompts and responses from model inference calls are retained for no longer than 30 days, unless longer retention is required by applicable laws or is reasonably necessary to ensure the security of Alibaba Cloud Model Studio services.","context":"The same paragraph adds: “Stateful features (conversation storage, files) are retained until deleted by users.”","source_title":"Alibaba Cloud Model Studio Data Retention Policy","source_url":"https://www.alibabacloud.com/help/en/model-studio/data-retention-policy","kept_on":"2026-10-26","kept_sha256":"8e88f476d5c7da5daea273aec57b4e8ae7093540d8d4f75800fcb07a12feb28b","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/alibaba/questionnaire/#q3","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"alibaba","vendor":"Alibaba Cloud","question_id":"Q4","question":"Can a customer have the vendor keep none of its data?","state":"answered","answer":"Zero Data Retention, for enterprise customers on assessment","quote":"ZDR is available to enterprise customers with an Alibaba Cloud account manager, subject to a needs assessment.","context":"For the international site, in regions outside mainland China, on listed models only. Content flagged by safety filters is kept for up to two years.","source_title":"Alibaba Cloud Model Studio Data Retention Policy","source_url":"https://www.alibabacloud.com/help/en/model-studio/data-retention-policy","kept_on":"2026-10-26","kept_sha256":"8e88f476d5c7da5daea273aec57b4e8ae7093540d8d4f75800fcb07a12feb28b","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/alibaba/questionnaire/#q4","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"alibaba","vendor":"Alibaba Cloud","question_id":"Q5","question":"Where does the vendor process and store customer data?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Alibaba Cloud Model Studio Data Retention Policy; Security certifications and privacy; Rate limits","nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"GV-6.1-009","page":"https://jesseahawkins.com/vendors/alibaba/questionnaire/#q5","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"alibaba","vendor":"Alibaba Cloud","question_id":"Q6","question":"Which other companies process customer data for the vendor?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Alibaba Cloud Model Studio Data Retention Policy; Security certifications and privacy; Rate limits","nist_ai_rmf":"GOVERN-6.1 MANAGE-3.1","nist_ai_600_1":"GV-6.1-007","page":"https://jesseahawkins.com/vendors/alibaba/questionnaire/#q6","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"alibaba","vendor":"Alibaba Cloud","question_id":"Q7","question":"Which independent audits or certifications does the vendor name?","state":"answered","answer":"SOC 2","quote":"Alibaba Cloud Model Studio has achieved SOC 2 compliance with an unqualified opinion, validating our rigorous controls for Security, Availability, and Confidentiality.","context":null,"source_title":"Security certifications and privacy","source_url":"https://www.alibabacloud.com/help/en/model-studio/privacy-notice","kept_on":"2026-10-26","kept_sha256":"60573ba1ba19bb4030c3193263005b8b7a2b9f4b34fd1809558a72657f02a2c0","note":null,"nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"A.1.3","page":"https://jesseahawkins.com/vendors/alibaba/questionnaire/#q7","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"alibaba","vendor":"Alibaba Cloud","question_id":"Q8","question":"Does the vendor publish a history of its service incidents?","state":"not-kept","answer":"No answer kept","quote":null,"context":null,"source_title":null,"source_url":"https://status.alibabacloud.com/","kept_on":null,"kept_sha256":null,"note":"The status page draws its events with script and links no history feed.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/alibaba/questionnaire/#q8","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"alibaba","vendor":"Alibaba Cloud","question_id":"Q9","question":"Does the vendor publish the dates on which it retires its models?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"This site reads no retirement page for Alibaba Cloud.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/alibaba/questionnaire/#q9","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"zai","vendor":"Z.ai","question_id":"Q1","question":"Does the vendor train its models on business and API customers’ data?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Privacy Policy, with the Data Processing Addendum for API Services","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/zai/questionnaire/#q1","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"zai","vendor":"Z.ai","question_id":"Q2","question":"Does the vendor train its models on free and consumer use of its products?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"The vendor record does not read this point for Z.ai.","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/zai/questionnaire/#q2","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"zai","vendor":"Z.ai","question_id":"Q3","question":"How long does the vendor keep the data that customers send?","state":"answered","answer":"API content not stored; other customer data kept until the terms end, with listed exceptions","quote":"This information is processed in real-time to provide the Customer and End Users with the API Service and is not saved on our servers.","context":"In the Data Processing Addendum for API Services, section 4. Section 4(c): “For Customer Data other than those provided under Section 4(b), Company will temporarily store such data for the purposes of providing the API Services or in compliance with applicable laws.” It goes on: “The Company will delete such data after the termination of the Terms unless otherwise required by applicable laws.”","source_title":"Privacy Policy, with the Data Processing Addendum for API Services","source_url":"https://docs.z.ai/legal-agreement/privacy-policy","kept_on":"2026-10-26","kept_sha256":"a4b5f6921825cd54ce7bcedec9f7847ea4bbf6d72e14fe3ab8d0295ff4a268b0","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/zai/questionnaire/#q3","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"zai","vendor":"Z.ai","question_id":"Q4","question":"Can a customer have the vendor keep none of its data?","state":"answered","answer":"API content is not stored, the addendum says","quote":"The Company do not store any of the content the Customer or its End Users provide or generate while using our Services.","context":"Data Processing Addendum for API Services, section 4(b).","source_title":"Privacy Policy, with the Data Processing Addendum for API Services","source_url":"https://docs.z.ai/legal-agreement/privacy-policy","kept_on":"2026-10-26","kept_sha256":"a4b5f6921825cd54ce7bcedec9f7847ea4bbf6d72e14fe3ab8d0295ff4a268b0","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/zai/questionnaire/#q4","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"zai","vendor":"Z.ai","question_id":"Q5","question":"Where does the vendor process and store customer data?","state":"answered","answer":"Generally processed in Singapore","quote":"Company generally provide the Services from Singapore, and our group companies and their designated service providers are typically located in Singapore. As a result, Customer Data is generally processed in Singapore.","context":null,"source_title":"Privacy Policy, with the Data Processing Addendum for API Services","source_url":"https://docs.z.ai/legal-agreement/privacy-policy","kept_on":"2026-10-26","kept_sha256":"a4b5f6921825cd54ce7bcedec9f7847ea4bbf6d72e14fe3ab8d0295ff4a268b0","note":null,"nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"GV-6.1-009","page":"https://jesseahawkins.com/vendors/zai/questionnaire/#q5","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"zai","vendor":"Z.ai","question_id":"Q6","question":"Which other companies process customer data for the vendor?","state":"answered","answer":"Group companies and service providers, typically in Singapore; no list","quote":"Company generally provide the Services from Singapore, and our group companies and their designated service providers are typically located in Singapore.","context":null,"source_title":"Privacy Policy, with the Data Processing Addendum for API Services","source_url":"https://docs.z.ai/legal-agreement/privacy-policy","kept_on":"2026-10-26","kept_sha256":"a4b5f6921825cd54ce7bcedec9f7847ea4bbf6d72e14fe3ab8d0295ff4a268b0","note":null,"nist_ai_rmf":"GOVERN-6.1 MANAGE-3.1","nist_ai_600_1":"GV-6.1-007","page":"https://jesseahawkins.com/vendors/zai/questionnaire/#q6","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"zai","vendor":"Z.ai","question_id":"Q7","question":"Which independent audits or certifications does the vendor name?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Privacy Policy, with the Data Processing Addendum for API Services","nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"A.1.3","page":"https://jesseahawkins.com/vendors/zai/questionnaire/#q7","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"zai","vendor":"Z.ai","question_id":"Q8","question":"Does the vendor publish a history of its service incidents?","state":"not-kept","answer":"No answer kept","quote":null,"context":null,"source_title":null,"source_url":"https://status.z.ai/","kept_on":null,"kept_sha256":null,"note":"Z.ai links no status page; status.z.ai does not resolve.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/zai/questionnaire/#q8","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"zai","vendor":"Z.ai","question_id":"Q9","question":"Does the vendor publish the dates on which it retires its models?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"This site reads no retirement page for Z.ai.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/zai/questionnaire/#q9","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"moonshot","vendor":"Moonshot AI","question_id":"Q1","question":"Does the vendor train its models on business and API customers’ data?","state":"answered","answer":"Yes, unless agreed otherwise in writing","quote":"Customer who requires restrictions on the use of Customer Content for training or improving Moonshot AI models may contact Moonshot AI to discuss available enterprise arrangements or separate written agreements. Unless otherwise expressly agreed in writing, Customer Content may be used for the foregoing purposes.","context":"The sentence before lists the purposes: “We may use Content to provide, maintain, develop, support, and improve the Services, comply with applicable law, enforce our terms and policies, and keep the Services safe and secure.”","source_title":"Terms of Service for Kimi OpenPlatform","source_url":"https://platform.kimi.ai/docs/agreement/modeluse","kept_on":"2026-10-26","kept_sha256":"2f2977a5126855fd50e4eca35a341fafc3e7876677239d7a6b1a3625873373fe","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/moonshot/questionnaire/#q1","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"moonshot","vendor":"Moonshot AI","question_id":"Q2","question":"Does the vendor train its models on free and consumer use of its products?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"The vendor record does not read this point for Moonshot AI.","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/moonshot/questionnaire/#q2","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"moonshot","vendor":"Moonshot AI","question_id":"Q3","question":"How long does the vendor keep the data that customers send?","state":"answered","answer":"While the account is active, with listed exceptions","quote":"Retention periods vary based on factors such as information type, sensitivity, and legal requirements. For example, account, input, and payment information are retained while your account is active. Violation-related information is retained until the violation is resolved. Also, in some cases, the length of time we retain data depends on your settings.","context":null,"source_title":"Kimi OpenPlatform Privacy Policy","source_url":"https://platform.kimi.ai/docs/agreement/userprivacy","kept_on":"2026-10-26","kept_sha256":"2128083a8111ef084b0fae1f330b8f941643b2ef818d35e68392e210e376029c","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/moonshot/questionnaire/#q3","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"moonshot","vendor":"Moonshot AI","question_id":"Q4","question":"Can a customer have the vendor keep none of its data?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Terms of Service for Kimi OpenPlatform; Kimi OpenPlatform Privacy Policy; Recharge and Rate Limits","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/moonshot/questionnaire/#q4","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"moonshot","vendor":"Moonshot AI","question_id":"Q5","question":"Where does the vendor process and store customer data?","state":"answered","answer":"Stored in Singapore","quote":"We store the information we collect in secure servers located in Singapore.","context":null,"source_title":"Kimi OpenPlatform Privacy Policy","source_url":"https://platform.kimi.ai/docs/agreement/userprivacy","kept_on":"2026-10-26","kept_sha256":"2128083a8111ef084b0fae1f330b8f941643b2ef818d35e68392e210e376029c","note":null,"nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"GV-6.1-009","page":"https://jesseahawkins.com/vendors/moonshot/questionnaire/#q5","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"moonshot","vendor":"Moonshot AI","question_id":"Q6","question":"Which other companies process customer data for the vendor?","state":"answered","answer":"Service providers by category; no list","quote":"These providers include hosting services, customer service vendors, cloud services, content delivery services, support and safety monitoring services, email communication software, web analytics services, payment and transaction processors, and other information technology providers.","context":null,"source_title":"Kimi OpenPlatform Privacy Policy","source_url":"https://platform.kimi.ai/docs/agreement/userprivacy","kept_on":"2026-10-26","kept_sha256":"2128083a8111ef084b0fae1f330b8f941643b2ef818d35e68392e210e376029c","note":null,"nist_ai_rmf":"GOVERN-6.1 MANAGE-3.1","nist_ai_600_1":"GV-6.1-007","page":"https://jesseahawkins.com/vendors/moonshot/questionnaire/#q6","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"moonshot","vendor":"Moonshot AI","question_id":"Q7","question":"Which independent audits or certifications does the vendor name?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Terms of Service for Kimi OpenPlatform; Kimi OpenPlatform Privacy Policy; Recharge and Rate Limits","nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"A.1.3","page":"https://jesseahawkins.com/vendors/moonshot/questionnaire/#q7","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"moonshot","vendor":"Moonshot AI","question_id":"Q8","question":"Does the vendor publish a history of its service incidents?","state":"not-kept","answer":"No answer kept","quote":null,"context":null,"source_title":null,"source_url":"https://status.moonshot.cn/history.atom","kept_on":null,"kept_sha256":null,"note":"The status page links this feed, but it answered 404 to this site on 2026-10-26.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/moonshot/questionnaire/#q8","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"moonshot","vendor":"Moonshot AI","question_id":"Q9","question":"Does the vendor publish the dates on which it retires its models?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"This site reads no retirement page for Moonshot AI.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/moonshot/questionnaire/#q9","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"perplexity","vendor":"Perplexity","question_id":"Q1","question":"Does the vendor train its models on business and API customers’ data?","state":"answered","answer":"Not by default","quote":"No training by default: Under the API Terms of Service, Perplexity does not use Customer Content to train generative AI models. Certain APIs may be subject to product-specific terms.","context":null,"source_title":"API Privacy & Security","source_url":"https://docs.perplexity.ai/docs/resources/privacy-security","kept_on":"2026-10-26","kept_sha256":"9ee8051da300c4378c115cd4a057dc66bdc9b63855ad9c9fd8f1cc201228fea1","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/perplexity/questionnaire/#q1","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"perplexity","vendor":"Perplexity","question_id":"Q2","question":"Does the vendor train its models on free and consumer use of its products?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"The vendor record does not read this point for Perplexity.","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/perplexity/questionnaire/#q2","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"perplexity","vendor":"Perplexity","question_id":"Q3","question":"How long does the vendor keep the data that customers send?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: API Privacy & Security; Rate Limits & Usage Tiers","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/perplexity/questionnaire/#q3","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"perplexity","vendor":"Perplexity","question_id":"Q4","question":"Can a customer have the vendor keep none of its data?","state":"answered","answer":"Zero Data Retention, for eligible customers by written agreement","quote":"ZDR is available only to eligible customers through an account-level configuration under a written agreement with Perplexity.","context":"Not every model supports it: “Some providers require limited retention as a condition of offering their models.”","source_title":"API Privacy & Security","source_url":"https://docs.perplexity.ai/docs/resources/privacy-security","kept_on":"2026-10-26","kept_sha256":"9ee8051da300c4378c115cd4a057dc66bdc9b63855ad9c9fd8f1cc201228fea1","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/perplexity/questionnaire/#q4","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"perplexity","vendor":"Perplexity","question_id":"Q5","question":"Where does the vendor process and store customer data?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: API Privacy & Security; Rate Limits & Usage Tiers","nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"GV-6.1-009","page":"https://jesseahawkins.com/vendors/perplexity/questionnaire/#q5","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"perplexity","vendor":"Perplexity","question_id":"Q6","question":"Which other companies process customer data for the vendor?","state":"answered","answer":"Listed on its Trust Center","quote":"Personal data: Perplexity processes personal data in accordance with its Data Processing Addendum, and information about subprocessors is available on Perplexity’s Trust Center.","context":null,"source_title":"API Privacy & Security","source_url":"https://docs.perplexity.ai/docs/resources/privacy-security","kept_on":"2026-10-26","kept_sha256":"9ee8051da300c4378c115cd4a057dc66bdc9b63855ad9c9fd8f1cc201228fea1","note":null,"nist_ai_rmf":"GOVERN-6.1 MANAGE-3.1","nist_ai_600_1":"GV-6.1-007","page":"https://jesseahawkins.com/vendors/perplexity/questionnaire/#q6","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"perplexity","vendor":"Perplexity","question_id":"Q7","question":"Which independent audits or certifications does the vendor name?","state":"answered","answer":"SOC 2 Type II","quote":"SOC 2 Type II Report - Comprehensive security controls audit covering security, availability, processing integrity, confidentiality, and privacy","context":"The same list names a “2025 HIPAA Gap Assessment” and “CAIQlite”.","source_title":"API Privacy & Security","source_url":"https://docs.perplexity.ai/docs/resources/privacy-security","kept_on":"2026-10-26","kept_sha256":"9ee8051da300c4378c115cd4a057dc66bdc9b63855ad9c9fd8f1cc201228fea1","note":null,"nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"A.1.3","page":"https://jesseahawkins.com/vendors/perplexity/questionnaire/#q7","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"perplexity","vendor":"Perplexity","question_id":"Q8","question":"Does the vendor publish a history of its service incidents?","state":"answered","answer":"Yes: a status history feed, with 10 incidents kept since 2026-08-06","quote":null,"context":null,"source_title":"Status history feed","source_url":"https://status.perplexity.com/history.atom","kept_on":"2026-11-01","kept_sha256":"14181e2ab5848dbed391df4c55a9808806058671618111dd9115e8cc3b42de65","note":null,"nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/perplexity/questionnaire/#q8","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"perplexity","vendor":"Perplexity","question_id":"Q9","question":"Does the vendor publish the dates on which it retires its models?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Perplexity is an AI application; this site reads model retirement pages of model makers and clouds only.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/perplexity/questionnaire/#q9","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"microsoft-copilot","vendor":"Microsoft Copilot","question_id":"Q1","question":"Does the vendor train its models on business and API customers’ data?","state":"answered","answer":"Not used to train foundation LLMs","quote":"Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot.","context":null,"source_title":"Data, Privacy, and Security for Microsoft Copilot","source_url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","kept_on":"2026-10-26","kept_sha256":"d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/microsoft-copilot/questionnaire/#q1","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"microsoft-copilot","vendor":"Microsoft Copilot","question_id":"Q2","question":"Does the vendor train its models on free and consumer use of its products?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"The vendor record does not read this point for Microsoft Copilot.","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/microsoft-copilot/questionnaire/#q2","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"microsoft-copilot","vendor":"Microsoft Copilot","question_id":"Q3","question":"How long does the vendor keep the data that customers send?","state":"answered","answer":"Stored with the organization’s Microsoft 365 content; admins set retention","quote":"When you enter prompts using Microsoft Copilot, the information contained within your prompts, the data they retrieve, and the generated responses are processed and stored in alignment with contractual commitments with your organization's other content in Microsoft 365.","context":"The page adds: “Admins can also use Microsoft Purview to set retention policies for the data related to chat interactions with Copilot.”","source_title":"Data, Privacy, and Security for Microsoft Copilot","source_url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","kept_on":"2026-10-26","kept_sha256":"d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/microsoft-copilot/questionnaire/#q3","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"microsoft-copilot","vendor":"Microsoft Copilot","question_id":"Q4","question":"Can a customer have the vendor keep none of its data?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Data, Privacy, and Security for Microsoft Copilot","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/microsoft-copilot/questionnaire/#q4","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"microsoft-copilot","vendor":"Microsoft Copilot","question_id":"Q5","question":"Where does the vendor process and store customer data?","state":"answered","answer":"EU traffic stays in the EU Data Boundary, except on Anthropic models","quote":"EU traffic stays within the EU Data Boundary while worldwide traffic can be sent to the EU and other countries or regions for LLM processing.","context":"The next line reads: “Models provided by Anthropic as a subprocessor are currently excluded from the EU Data Boundary.”","source_title":"Data, Privacy, and Security for Microsoft Copilot","source_url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","kept_on":"2026-10-26","kept_sha256":"d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c","note":null,"nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"GV-6.1-009","page":"https://jesseahawkins.com/vendors/microsoft-copilot/questionnaire/#q5","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"microsoft-copilot","vendor":"Microsoft Copilot","question_id":"Q6","question":"Which other companies process customer data for the vendor?","state":"answered","answer":"Names Anthropic and OpenAI as subprocessors for their models","quote":"For information about models provided by Anthropic as a subprocessor within Microsoft Copilot experiences, see Anthropic models in Microsoft Online Services. For information about models provided by OpenAI as a subprocessor within Microsoft Copilot experiences, see OpenAI as a subprocessor in Microsoft Online Services.","context":null,"source_title":"Data, Privacy, and Security for Microsoft Copilot","source_url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","kept_on":"2026-10-26","kept_sha256":"d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c","note":null,"nist_ai_rmf":"GOVERN-6.1 MANAGE-3.1","nist_ai_600_1":"GV-6.1-007","page":"https://jesseahawkins.com/vendors/microsoft-copilot/questionnaire/#q6","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"microsoft-copilot","vendor":"Microsoft Copilot","question_id":"Q7","question":"Which independent audits or certifications does the vendor name?","state":"answered","answer":"ISO 27001 and ISO 42001, listed beside GDPR and HIPAA","quote":"Microsoft Copilot provides broad compliance offerings and certifications, including GDPR, ISO 27001, HIPAA, and the ISO 42001 standard for AI management systems.","context":null,"source_title":"Data, Privacy, and Security for Microsoft Copilot","source_url":"https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy","kept_on":"2026-10-26","kept_sha256":"d37a9d8c79ebb04b72181db415a9283d7d685608388415920547d68abd97d32c","note":null,"nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"A.1.3","page":"https://jesseahawkins.com/vendors/microsoft-copilot/questionnaire/#q7","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"microsoft-copilot","vendor":"Microsoft Copilot","question_id":"Q8","question":"Does the vendor publish a history of its service incidents?","state":"not-kept","answer":"No answer kept","quote":null,"context":null,"source_title":null,"source_url":"https://status.cloud.microsoft/","kept_on":null,"kept_sha256":null,"note":"The public page shows current status only. Incident history is in each tenant's admin center, behind a sign-in.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/microsoft-copilot/questionnaire/#q8","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"microsoft-copilot","vendor":"Microsoft Copilot","question_id":"Q9","question":"Does the vendor publish the dates on which it retires its models?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Microsoft Copilot is an AI application; this site reads model retirement pages of model makers and clouds only.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/microsoft-copilot/questionnaire/#q9","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"github-copilot","vendor":"GitHub Copilot","question_id":"Q1","question":"Does the vendor train its models on business and API customers’ data?","state":"answered","answer":"No","quote":"No. GitHub does not use either Copilot Business or Enterprise data to train its models.","context":"Answer to “Does GitHub use Copilot Business or Enterprise data to train GitHub’s model?”","source_title":"GitHub Copilot, frequently asked questions","source_url":"https://github.com/features/copilot","kept_on":"2026-10-26","kept_sha256":"30826739dddc8befe67f24935ff304a2a9924bccdae74cb429ccfe8f73d2b423","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/github-copilot/questionnaire/#q1","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"github-copilot","vendor":"GitHub Copilot","question_id":"Q2","question":"Does the vendor train its models on free and consumer use of its products?","state":"answered","answer":"Yes on Free, Pro and Pro+, unless the user opts out","quote":"Starting on April 24, GitHub may also use interactions from users with a Copilot Free, Copilot Pro, and Copilot Pro+ subscription - including inputs, outputs, code snippets, and associated context - to train and improve our AI models unless they have opted out.","context":null,"source_title":"GitHub Copilot, frequently asked questions","source_url":"https://github.com/features/copilot","kept_on":"2026-10-26","kept_sha256":"30826739dddc8befe67f24935ff304a2a9924bccdae74cb429ccfe8f73d2b423","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/github-copilot/questionnaire/#q2","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"github-copilot","vendor":"GitHub Copilot","question_id":"Q3","question":"How long does the vendor keep the data that customers send?","state":"answered","answer":"Not kept in the IDE; 28 days for other use, with listed exceptions","quote":"Access through IDE for Chat and Code Completions: Prompts and Suggestions: Not retained User Engagement Data: Kept for two years. Feedback Data: Stored for as long as needed for its intended purpose. All other GitHub Copilot access and use: Prompts and Suggestions: Retained for 28 days.","context":"These are the default settings for Copilot Business and Enterprise customers.","source_title":"GitHub Copilot, frequently asked questions","source_url":"https://github.com/features/copilot","kept_on":"2026-10-26","kept_sha256":"30826739dddc8befe67f24935ff304a2a9924bccdae74cb429ccfe8f73d2b423","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/github-copilot/questionnaire/#q3","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"github-copilot","vendor":"GitHub Copilot","question_id":"Q4","question":"Can a customer have the vendor keep none of its data?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: GitHub Copilot, frequently asked questions; GitHub Subprocessors; Usage limits for GitHub Copilot","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/github-copilot/questionnaire/#q4","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"github-copilot","vendor":"GitHub Copilot","question_id":"Q5","question":"Where does the vendor process and store customer data?","state":"answered","answer":"Listed for each sub-processor; AI inference in the US and other countries","quote":"Google Cloud Platform (GCP) Cloud Hosted Infrastructure, AI Inference and AI Services United States, Belgium, Singapore","context":"Each row of the list gives a “Location of Processing”. Fireworks AI lists “United States, Germany, Iceland”.","source_title":"GitHub Subprocessors","source_url":"https://docs.github.com/en/site-policy/privacy-policies/github-subprocessors","kept_on":"2026-10-26","kept_sha256":"fafcdb7003b578650b127a8fab76f9970f860fb04ea0e0cc28f50c4ff0f81407","note":null,"nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"GV-6.1-009","page":"https://jesseahawkins.com/vendors/github-copilot/questionnaire/#q5","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"github-copilot","vendor":"GitHub Copilot","question_id":"Q6","question":"Which other companies process customer data for the vendor?","state":"answered","answer":"A published list; new names 30 days in advance","quote":"GitHub publishes the names of any new subprocessors for its online services at least 30 days in advance of the subprocessor’s authorization to perform services that may involve access to customer data or personal data.","context":null,"source_title":"GitHub Subprocessors","source_url":"https://docs.github.com/en/site-policy/privacy-policies/github-subprocessors","kept_on":"2026-10-26","kept_sha256":"fafcdb7003b578650b127a8fab76f9970f860fb04ea0e0cc28f50c4ff0f81407","note":null,"nist_ai_rmf":"GOVERN-6.1 MANAGE-3.1","nist_ai_600_1":"GV-6.1-007","page":"https://jesseahawkins.com/vendors/github-copilot/questionnaire/#q6","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"github-copilot","vendor":"GitHub Copilot","question_id":"Q7","question":"Which independent audits or certifications does the vendor name?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: GitHub Copilot, frequently asked questions; GitHub Subprocessors; Usage limits for GitHub Copilot","nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"A.1.3","page":"https://jesseahawkins.com/vendors/github-copilot/questionnaire/#q7","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"github-copilot","vendor":"GitHub Copilot","question_id":"Q8","question":"Does the vendor publish a history of its service incidents?","state":"answered","answer":"Yes: a status history feed, with 32 incidents kept since 2026-09-18","quote":null,"context":null,"source_title":"Status history feed","source_url":"https://www.githubstatus.com/history.atom","kept_on":"2026-11-01","kept_sha256":"dd5bc7c080ddc3414930f31a3c18a5447f4310b100b229c0db5d06dc69be8e05","note":null,"nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/github-copilot/questionnaire/#q8","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"github-copilot","vendor":"GitHub Copilot","question_id":"Q9","question":"Does the vendor publish the dates on which it retires its models?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"GitHub Copilot is an AI application; this site reads model retirement pages of model makers and clouds only.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/github-copilot/questionnaire/#q9","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"cursor","vendor":"Cursor","question_id":"Q1","question":"Does the vendor train its models on business and API customers’ data?","state":"answered","answer":"Not with Privacy Mode on","quote":"If you choose to turn off “Privacy Mode”: we may use and store codebase data, prompts, editor actions, code snippets, and other code data and actions to improve our AI features and train our models.","context":"With Privacy Mode on: “Customer Data will not be used for training by Cursor.” The page does not say which setting is the default.","source_title":"Data Use & Privacy Overview","source_url":"https://cursor.com/data-use","kept_on":"2026-10-26","kept_sha256":"3c9ff56d3aa0af39ff66c7ff75e6f005efe1a0a42ed42b9e4c0ab869d9e17c7e","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/cursor/questionnaire/#q1","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"cursor","vendor":"Cursor","question_id":"Q2","question":"Does the vendor train its models on free and consumer use of its products?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"The vendor record does not read this point for Cursor.","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/cursor/questionnaire/#q2","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"cursor","vendor":"Cursor","question_id":"Q3","question":"How long does the vendor keep the data that customers send?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Data Use & Privacy Overview; Security; Models and pricing; Data Processing Addendum","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/cursor/questionnaire/#q3","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"cursor","vendor":"Cursor","question_id":"Q4","question":"Can a customer have the vendor keep none of its data?","state":"answered","answer":"With Privacy Mode on, ZDR agreements with all providers; non-ZDR models are marked or need an admin; flagged data may be kept for investigation","quote":"Cursor maintains zero data retention (ZDR) agreements with all providers, and AI model providers will not store or train on your data.","context":"The same paragraph: “Non-ZDR models will be designated as such or require an admin to opt-in to enable the model for your workspace.” Abuse detectors can keep data for investigation.","source_title":"Data Use & Privacy Overview","source_url":"https://cursor.com/data-use","kept_on":"2026-10-26","kept_sha256":"3c9ff56d3aa0af39ff66c7ff75e6f005efe1a0a42ed42b9e4c0ab869d9e17c7e","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/cursor/questionnaire/#q4","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"cursor","vendor":"Cursor","question_id":"Q5","question":"Where does the vendor process and store customer data?","state":"answered","answer":"No infrastructure in China","quote":"Cursor does not use or maintain any infrastructure in China.","context":null,"source_title":"Security","source_url":"https://cursor.com/security","kept_on":"2026-10-26","kept_sha256":"66d02e9bb248ee28dcc5021959006a025143b33828873662622d1124aa7d4134","note":null,"nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"GV-6.1-009","page":"https://jesseahawkins.com/vendors/cursor/questionnaire/#q5","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"cursor","vendor":"Cursor","question_id":"Q6","question":"Which other companies process customer data for the vendor?","state":"answered","answer":"Listed on its trust portal; none headquartered in China","quote":"Our list of subprocessors is published on our trust portal.","context":"The same section adds: “We do not use any companies headquartered in China as subprocessors, and to our knowledge none of our subprocessors do either.”","source_title":"Security","source_url":"https://cursor.com/security","kept_on":"2026-10-26","kept_sha256":"66d02e9bb248ee28dcc5021959006a025143b33828873662622d1124aa7d4134","note":null,"nist_ai_rmf":"GOVERN-6.1 MANAGE-3.1","nist_ai_600_1":"GV-6.1-007","page":"https://jesseahawkins.com/vendors/cursor/questionnaire/#q6","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"cursor","vendor":"Cursor","question_id":"Q7","question":"Which independent audits or certifications does the vendor name?","state":"answered","answer":"SOC 2 Type II; ISO 27001, ISO 42001 and AIUC-1","quote":"Cursor holds AIUC-1, ISO/IEC 27001:2022, and ISO/IEC 42001:2023 certifications, along with a SOC 2 Type II attestation.","context":null,"source_title":"Security","source_url":"https://cursor.com/security","kept_on":"2026-10-26","kept_sha256":"66d02e9bb248ee28dcc5021959006a025143b33828873662622d1124aa7d4134","note":null,"nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"A.1.3","page":"https://jesseahawkins.com/vendors/cursor/questionnaire/#q7","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"cursor","vendor":"Cursor","question_id":"Q8","question":"Does the vendor publish a history of its service incidents?","state":"answered","answer":"Yes: a status history feed, with 25 incidents kept since 2026-09-29","quote":null,"context":null,"source_title":"Status history feed","source_url":"https://status.cursor.com/history.atom","kept_on":"2026-11-01","kept_sha256":"d6ccd699fcdff1a0e751cf57de85ac11717413ced8e0f2db163646211b903374","note":null,"nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/cursor/questionnaire/#q8","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"cursor","vendor":"Cursor","question_id":"Q9","question":"Does the vendor publish the dates on which it retires its models?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Cursor is an AI application; this site reads model retirement pages of model makers and clouds only.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/cursor/questionnaire/#q9","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"meta","vendor":"Meta","question_id":"Q1","question":"Does the vendor train its models on business and API customers’ data?","state":"answered","answer":"No on Standard Services; Contributor (Discounted) Services content may train Meta models","quote":"Meta will collect, use, process, and share such data as a “Service Provider” or “Processor” (each as defined in the MGPT) to you in relation to your use of the Services, and will not use Content submitted in a request to the Standard Services to train Meta Models.","context":"Section 6.1 says for Contributor Services: “You agree that Meta may use your Content to train, develop, evaluate, and improve Meta’s artificial intelligence models, products, and services.” Coding Harness Subscriptions use “the Contributor Services by default regardless of which Meta Model you select”.","source_title":"Meta Model API Terms of Service","source_url":"https://dev.meta.ai/legal/terms-of-service","kept_on":"2026-11-04","kept_sha256":"667e9e034fcd18af99f61867602e3a8987b0a22e65040225002a41714be37790","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/meta/questionnaire/#q1","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"meta","vendor":"Meta","question_id":"Q2","question":"Does the vendor train its models on free and consumer use of its products?","state":"answered","answer":"Yes on Discounted (Contributor) Services; Standard Services content is not used to train","quote":"Discounted Services: Meta may use your Content, including Inputs and Outputs, to train, develop, evaluate, and improve Meta's AI models, products, and services. Before using Content from Discounted Services to train artificial intelligence models, Meta takes steps designed to disassociate that Content from your Accounts and your Meta Model API key.","context":"The same page says: “If you do not want Content used for training, you may upgrade to Standard Services.”","source_title":"Meta Model API Data Commitments","source_url":"https://dev.meta.ai/legal/commitments","kept_on":"2026-11-04","kept_sha256":"8cee13786c4039f56d5a26830d2e901d941bd3e3367f4c0e15633f3fa4a1ef81","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/meta/questionnaire/#q2","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"meta","vendor":"Meta","question_id":"Q3","question":"How long does the vendor keep the data that customers send?","state":"answered","answer":"No fixed period; kept as needed for the Services, law, Meta’s use rights, and safety review","quote":"4.4 Retention. Meta will retain your Content and Usage Data as needed: (i) to provide the Services under these Terms; (ii) to the extent necessary for compliance with applicable laws; (iii) in connection with the exercise of Meta’s rights to use your Content and Usage Data under these Terms; (iv) when our systems flag data for a potential policy violation; and (v) for security, safety, abuse, and policy review and improvements.","context":"The commitments page adds that a customer can view and delete its Content through its account.","source_title":"Meta Model API Terms of Service","source_url":"https://dev.meta.ai/legal/terms-of-service","kept_on":"2026-11-04","kept_sha256":"667e9e034fcd18af99f61867602e3a8987b0a22e65040225002a41714be37790","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/meta/questionnaire/#q3","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"meta","vendor":"Meta","question_id":"Q4","question":"Can a customer have the vendor keep none of its data?","state":"answered","answer":"ZDR is named for Muse Voice Transcribe, priced the same as Standard mode","quote":"Streaming and non-streaming transcription are priced the same. Zero data retention (ZDR) is priced at parity with Standard mode. Contributor mode isn't available for Muse Voice Transcribe.","context":"The page names ZDR only in the Muse Voice Transcribe section.","source_title":"Pricing and rate limits","source_url":"https://dev.meta.ai/docs/pricing-rate-limits","kept_on":"2026-11-04","kept_sha256":"826b3f3c5fe8184f218a7ee4ce276643944b464b0c22b210243f43dd900fd6d0","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/meta/questionnaire/#q4","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"meta","vendor":"Meta","question_id":"Q5","question":"Where does the vendor process and store customer data?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Meta Model API Data Commitments; Meta Model API Terms of Service; Pricing and rate limits","nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"GV-6.1-009","page":"https://jesseahawkins.com/vendors/meta/questionnaire/#q5","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"meta","vendor":"Meta","question_id":"Q6","question":"Which other companies process customer data for the vendor?","state":"answered","answer":"On Standard Services, Meta may engage subprocessors from a linked list it may update","quote":"You authorize Meta to engage subprocessors included in the list located here, as may be updated by Meta from time to time.","context":"This sentence is in Section 5.1, which applies “When you use Standard Services”.","source_title":"Meta Model API Terms of Service","source_url":"https://dev.meta.ai/legal/terms-of-service","kept_on":"2026-11-04","kept_sha256":"667e9e034fcd18af99f61867602e3a8987b0a22e65040225002a41714be37790","note":null,"nist_ai_rmf":"GOVERN-6.1 MANAGE-3.1","nist_ai_600_1":"GV-6.1-007","page":"https://jesseahawkins.com/vendors/meta/questionnaire/#q6","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"meta","vendor":"Meta","question_id":"Q7","question":"Which independent audits or certifications does the vendor name?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Meta Model API Data Commitments; Meta Model API Terms of Service; Pricing and rate limits","nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"A.1.3","page":"https://jesseahawkins.com/vendors/meta/questionnaire/#q7","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"meta","vendor":"Meta","question_id":"Q8","question":"Does the vendor publish a history of its service incidents?","state":"not-kept","answer":"No answer kept","quote":null,"context":null,"source_title":null,"source_url":"https://dev.meta.ai/status","kept_on":null,"kept_sha256":null,"note":"The status page drew no events for this site on 2026-11-04. It said “Status information is unavailable” and links no history feed.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/meta/questionnaire/#q8","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"meta","vendor":"Meta","question_id":"Q9","question":"Does the vendor publish the dates on which it retires its models?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"This site reads no retirement page for Meta.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/meta/questionnaire/#q9","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"tencent","vendor":"Tencent","question_id":"Q1","question":"Does the vendor train its models on business and API customers’ data?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Tencent HY 3D Global and Text Generation Privacy Policy; Privacy Policy; Data Processing and Security Agreement; Privacy FAQs","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/tencent/questionnaire/#q1","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"tencent","vendor":"Tencent","question_id":"Q2","question":"Does the vendor train its models on free and consumer use of its products?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"The vendor record does not read this point for Tencent.","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/tencent/questionnaire/#q2","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"tencent","vendor":"Tencent","question_id":"Q3","question":"How long does the vendor keep the data that customers send?","state":"answered","answer":"Generally up to 7 days for the HY module’s listed data, longer for billing; varies with settings","quote":"For Account Data, Configuration Data, Network and Connection Data, and Diagnostic and Usage Data, we generally retain information for up to 7 days after your task request in connection with the Features to provide you the Features and for troubleshooting purposes, but may process or retain such data for a longer period (for example as long as you use the Features) for billing purposes.","context":"This is the HY product module, for “Tencent HY 3D Global, and Text Generation”. Diagnostic and Usage Data includes “output information”, and the module does not name prompts. It adds: “The actual retention period can vary for different data categories”. The umbrella DPSA, which does not list the HY module, gives the duration of the Terms of Service as the period for personal data in uploaded Content, and says Tencent returns or destroys personal data when the customer asks.","source_title":"Tencent HY 3D Global and Text Generation Privacy Policy","source_url":"https://www.tencentcloud.com/document/product/1284/75293","kept_on":"2026-11-04","kept_sha256":"1a363137893a3b0c6d3b26e721b2b5ae42f6f52858e9ed4279ef0a82143f1664","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/tencent/questionnaire/#q3","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"tencent","vendor":"Tencent","question_id":"Q4","question":"Can a customer have the vendor keep none of its data?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Tencent HY 3D Global and Text Generation Privacy Policy; Privacy Policy; Data Processing and Security Agreement; Privacy FAQs","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/tencent/questionnaire/#q4","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"tencent","vendor":"Tencent","question_id":"Q5","question":"Where does the vendor process and store customer data?","state":"answered","answer":"Personal Data processed in the Service Region the customer selects, with exceptions","quote":"5.1 Subject to clause 5.2, where Organisation has selected a Service Region for the Services, Tencent will Process Personal Data in that Service Region.","context":"Tencent Cloud International umbrella document, not specific to HY. Clause 5.2 says Tencent “may need to Process Personal Data outside the Service Region from time to time”, with prior consent or authorisation; authorising Sub-Processors counts as that consent.","source_title":"Data Processing and Security Agreement","source_url":"https://www.tencentcloud.com/document/product/301/17347","kept_on":"2026-11-04","kept_sha256":"f4ca9074d616075ccc1a5ec836e2111cdb2d02a186ec4ef306a38a7f8009dfcc","note":null,"nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"GV-6.1-009","page":"https://jesseahawkins.com/vendors/tencent/questionnaire/#q5","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"tencent","vendor":"Tencent","question_id":"Q6","question":"Which other companies process customer data for the vendor?","state":"answered","answer":"Listed on a Third Party Information page; 14 days to object to changes, where law requires notice","quote":"Organisation hereby grants Tencent general written authorisation to engage such Sub-Processors listed at Third Party Information to Process Personal Data on its behalf, subject to the requirements of this clause 8.","context":"Tencent Cloud International umbrella document; it does not name AI sub-processors. Clause 8.2 gives notice of changes “to the extent its processing of the Personal Data is subject to Data Protection Laws that require such notification”, then “fourteen (14) days from the date of receipt of the notice to approve or reject the change.”","source_title":"Data Processing and Security Agreement","source_url":"https://www.tencentcloud.com/document/product/301/17347","kept_on":"2026-11-04","kept_sha256":"f4ca9074d616075ccc1a5ec836e2111cdb2d02a186ec4ef306a38a7f8009dfcc","note":null,"nist_ai_rmf":"GOVERN-6.1 MANAGE-3.1","nist_ai_600_1":"GV-6.1-007","page":"https://jesseahawkins.com/vendors/tencent/questionnaire/#q6","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"tencent","vendor":"Tencent","question_id":"Q7","question":"Which independent audits or certifications does the vendor name?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Tencent HY 3D Global and Text Generation Privacy Policy; Privacy Policy; Data Processing and Security Agreement; Privacy FAQs","nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"A.1.3","page":"https://jesseahawkins.com/vendors/tencent/questionnaire/#q7","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"tencent","vendor":"Tencent","question_id":"Q8","question":"Does the vendor publish a history of its service incidents?","state":"not-kept","answer":"No answer kept","quote":null,"context":null,"source_title":null,"source_url":"https://www.tencentcloud.com/","kept_on":null,"kept_sha256":null,"note":"Tencent Cloud International links no public status page or history feed for Tencent HY.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/tencent/questionnaire/#q8","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"tencent","vendor":"Tencent","question_id":"Q9","question":"Does the vendor publish the dates on which it retires its models?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"This site reads no retirement page for Tencent.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/tencent/questionnaire/#q9","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"xiaomi","vendor":"Xiaomi","question_id":"Q1","question":"Does the vendor train its models on business and API customers’ data?","state":"answered","answer":"No for the text content a user gives, unless the user gives prior consent","quote":"Without your prior consent, Xiaomi will not use the text content provided by you for model training or any other purposes.","context":"The statement names text content only. The same section says Xiaomi collects “text, image, video, and audio information” to run the API and Xiaomi MiMo Code services.","source_title":"Xiaomi MiMo Privacy Policy","source_url":"https://privacy.mi.com/XiaomiMiMoPlatform/en_GB/","kept_on":"2026-11-04","kept_sha256":"8ed89989df4832348b5f3ac6b534e9a0a9dd26d47c3fb6e01ff945e6d7a07910","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/xiaomi/questionnaire/#q1","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"xiaomi","vendor":"Xiaomi","question_id":"Q2","question":"Does the vendor train its models on free and consumer use of its products?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"The vendor record does not read this point for Xiaomi.","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/xiaomi/questionnaire/#q2","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"xiaomi","vendor":"Xiaomi","question_id":"Q3","question":"How long does the vendor keep the data that customers send?","state":"answered","answer":"No fixed period: kept as long as its purposes need or law requires, with exceptions","quote":"We retain your personal information for the period necessary to fulfill the purposes for which it was collected as described in this Privacy Policy, or as required by applicable laws and regulations.","context":"The policy speaks of personal information and names no period for prompts or outputs. The same paragraph keeps data longer for public interest, research or statistical purposes, and the policy says deleted data may not leave backups at once.","source_title":"Xiaomi MiMo Privacy Policy","source_url":"https://privacy.mi.com/XiaomiMiMoPlatform/en_GB/","kept_on":"2026-11-04","kept_sha256":"8ed89989df4832348b5f3ac6b534e9a0a9dd26d47c3fb6e01ff945e6d7a07910","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/xiaomi/questionnaire/#q3","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"xiaomi","vendor":"Xiaomi","question_id":"Q4","question":"Can a customer have the vendor keep none of its data?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Xiaomi MiMo Privacy Policy; Rate Limit","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/xiaomi/questionnaire/#q4","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"xiaomi","vendor":"Xiaomi","question_id":"Q5","question":"Where does the vendor process and store customer data?","state":"answered","answer":"Personal information is stored in China, for use of the service within China","quote":"This agreement applies to your use of Xiaomi MiMo services within the territory of the People's Republic of China. Accordingly, your personal information will be stored within the territory of the People's Republic of China.","context":"For use outside China, the page says a different privacy policy “applicable to services outside the People's Republic of China” governs.","source_title":"Xiaomi MiMo Privacy Policy","source_url":"https://privacy.mi.com/XiaomiMiMoPlatform/en_GB/","kept_on":"2026-11-04","kept_sha256":"8ed89989df4832348b5f3ac6b534e9a0a9dd26d47c3fb6e01ff945e6d7a07910","note":null,"nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"GV-6.1-009","page":"https://jesseahawkins.com/vendors/xiaomi/questionnaire/#q5","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"xiaomi","vendor":"Xiaomi","question_id":"Q6","question":"Which other companies process customer data for the vendor?","state":"answered","answer":"Some services use third-party service providers that get some personal information; none named here","quote":"Some of our services are provided by third-party service providers. To this end, we need to provide some of your personal information to these third-party service providers.","context":null,"source_title":"Xiaomi MiMo Privacy Policy","source_url":"https://privacy.mi.com/XiaomiMiMoPlatform/en_GB/","kept_on":"2026-11-04","kept_sha256":"8ed89989df4832348b5f3ac6b534e9a0a9dd26d47c3fb6e01ff945e6d7a07910","note":null,"nist_ai_rmf":"GOVERN-6.1 MANAGE-3.1","nist_ai_600_1":"GV-6.1-007","page":"https://jesseahawkins.com/vendors/xiaomi/questionnaire/#q6","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"xiaomi","vendor":"Xiaomi","question_id":"Q7","question":"Which independent audits or certifications does the vendor name?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Xiaomi MiMo Privacy Policy; Rate Limit","nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"A.1.3","page":"https://jesseahawkins.com/vendors/xiaomi/questionnaire/#q7","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"xiaomi","vendor":"Xiaomi","question_id":"Q8","question":"Does the vendor publish a history of its service incidents?","state":"not-kept","answer":"No answer kept","quote":null,"context":null,"source_title":null,"source_url":"https://mimo.mi.com/","kept_on":null,"kept_sha256":null,"note":"Xiaomi MiMo links no status page or history feed.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/xiaomi/questionnaire/#q8","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"xiaomi","vendor":"Xiaomi","question_id":"Q9","question":"Does the vendor publish the dates on which it retires its models?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"This site reads no retirement page for Xiaomi.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/xiaomi/questionnaire/#q9","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"stepfun","vendor":"StepFun","question_id":"Q1","question":"Does the vendor train its models on business and API customers’ data?","state":"answered","answer":"May train: the terms license prompts, outputs and API call logs to StepFun for any purpose","quote":"When you use the Services in accordance with these Terms, you grant us, to the fullest extent permitted under the applicable law, a nonexclusive, worldwide, royalty-free, fully paid up, transferable, sublicensable, perpetual, irrevocable license to copy, display, upload, perform, distribute, transmit, make available, store, access, modify, exploit, commercialize and otherwise use all Output, Prompts and associated API call logs (“Usage Data”) elicited by you for any purpose in any form, medium or technology now known or later developed, including but not limited to (i) facilitating other users’ ability to elicit Output, and (ii) promoting the Services.","context":"The terms also say the Services “MAY BE IMPROVED THROUGH THE USE OF USAGE DATA FOR MODEL TRAINING AND FINE-TUNING”. For the StepFun Startup Program and other early access programs, the license “specifically includes the right to use Usage Data for training, fine-tuning, and otherwise improving StepFun’s artificial intelligence models and systems.”","source_title":"Terms of Service","source_url":"https://platform.stepfun.ai/docs/en/agreement/userservice","kept_on":"2026-11-04","kept_sha256":"ba64e4507c3fe00741365f5c316e28df82af866a3e7de8b2915bd3bd29cbebb2","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/stepfun/questionnaire/#q1","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"stepfun","vendor":"StepFun","question_id":"Q2","question":"Does the vendor train its models on free and consumer use of its products?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"The vendor record does not read this point for StepFun.","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/stepfun/questionnaire/#q2","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"stepfun","vendor":"StepFun","question_id":"Q3","question":"How long does the vendor keep the data that customers send?","state":"answered","answer":"Customer Data is deleted within 30 days after the agreement ends, with exceptions","quote":"Within 30 days of termination or expiration of the Agreement, StepFun will:","context":"StepFun will “delete all copies of Customer Data, including Customer Personal Data, processed by StepFun or any subprocessors”, except where law requires storage, to resolve a dispute, or “to combat harmful use of the Services”. The terms also give StepFun a perpetual, irrevocable license to store and use prompts, outputs and API call logs. For its Startup Program and other early access programs, the privacy policy says StepFun may use and retain such data as a controller.","source_title":"Data Processing Agreement","source_url":"https://platform.stepfun.ai/docs/en/agreement/dataprocess","kept_on":"2026-11-04","kept_sha256":"4f6547754c82d04d002040a48dfc7dbf15434cb0a9549f97ade574eae9dd2f6b","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/stepfun/questionnaire/#q3","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"stepfun","vendor":"StepFun","question_id":"Q4","question":"Can a customer have the vendor keep none of its data?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: User Privacy; Terms of Service; Data Processing Agreement; Pricing and rate limits","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/stepfun/questionnaire/#q4","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"stepfun","vendor":"StepFun","question_id":"Q5","question":"Where does the vendor process and store customer data?","state":"answered","answer":"Privacy policy: servers in the United States; affiliates and providers elsewhere may access data","quote":"Our servers are located in the United States. Meanwhile, due to the international nature of our business, your personal information may also be accessed by our affiliates or be transferred to third-party service providers and business partners, in connection with the purposes set out in this Policy.","context":"The sentence is about personal information. The policy “does not apply when we act as a data processor” for commercial customers, and the DPA names no processing location for Customer Data.","source_title":"User Privacy","source_url":"https://platform.stepfun.ai/docs/en/agreement/userprivacy","kept_on":"2026-11-04","kept_sha256":"cb0c3efb4fe3cc776ece0969f1ac1cf47d99cebbf969c607a92e06d70be35380","note":null,"nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"GV-6.1-009","page":"https://jesseahawkins.com/vendors/stepfun/questionnaire/#q5","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"stepfun","vendor":"StepFun","question_id":"Q6","question":"Which other companies process customer data for the vendor?","state":"answered","answer":"The customer gives StepFun general authorization to engage subprocessors","quote":"Customer grants StepFun general authorization to engage subprocessors.","context":"StepFun will put a contract with each subprocessor and will “remain liable to Customer, subject to the liability limitations in the Agreement, for each subprocessor’s acts and omissions”.","source_title":"Data Processing Agreement","source_url":"https://platform.stepfun.ai/docs/en/agreement/dataprocess","kept_on":"2026-11-04","kept_sha256":"4f6547754c82d04d002040a48dfc7dbf15434cb0a9549f97ade574eae9dd2f6b","note":null,"nist_ai_rmf":"GOVERN-6.1 MANAGE-3.1","nist_ai_600_1":"GV-6.1-007","page":"https://jesseahawkins.com/vendors/stepfun/questionnaire/#q6","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"stepfun","vendor":"StepFun","question_id":"Q7","question":"Which independent audits or certifications does the vendor name?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: User Privacy; Terms of Service; Data Processing Agreement; Pricing and rate limits","nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"A.1.3","page":"https://jesseahawkins.com/vendors/stepfun/questionnaire/#q7","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"stepfun","vendor":"StepFun","question_id":"Q8","question":"Does the vendor publish a history of its service incidents?","state":"not-kept","answer":"No answer kept","quote":null,"context":null,"source_title":null,"source_url":"https://status.stepfun.ai/","kept_on":null,"kept_sha256":null,"note":"StepFun links no status page; status.stepfun.ai did not resolve on 2026-11-04.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/stepfun/questionnaire/#q8","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"stepfun","vendor":"StepFun","question_id":"Q9","question":"Does the vendor publish the dates on which it retires its models?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"This site reads no retirement page for StepFun.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/stepfun/questionnaire/#q9","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"gemini-app","vendor":"Gemini Apps","question_id":"Q1","question":"Does the vendor train its models on business and API customers’ data?","state":"answered","answer":"Yes while Keep Activity is on; not in temporary chats, or with it off unless you send feedback","quote":"Google uses your activity to provide, develop, and improve its services (including training generative AI models), as well as to protect Google, its users, and the public with the help of human reviewers.","context":"This applies “If the Keep Activity setting is on”. With it off, future chats “won’t be used to train our AI models, unless you choose to send Google feedback”, and “Temporary chats are not used to train Google’s AI models.” The page adds: “Your Gemini settings don’t control processing of your chats to create anonymized data to improve Google services.”","source_title":"Gemini Apps Privacy Hub","source_url":"https://support.google.com/gemini/answer/13594961?hl=en","kept_on":"2026-11-04","kept_sha256":"ee8f0fa990d2760ebb62bbd7bad5cd6352b42e56252a35987d877bddb685621c","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/gemini-app/questionnaire/#q1","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"gemini-app","vendor":"Gemini Apps","question_id":"Q2","question":"Does the vendor train its models on free and consumer use of its products?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"The vendor record does not read this point for Gemini Apps.","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/gemini-app/questionnaire/#q2","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"gemini-app","vendor":"Gemini Apps","question_id":"Q3","question":"How long does the vendor keep the data that customers send?","state":"answered","answer":"Activity auto-deletes after 18 months by default (3, 36 months or indefinite); some chats kept longer","quote":"You can change your auto-delete setting in Gemini Apps Activity from the default of 18 months to 3 months, 36 months, or indefinite. You can also manually delete your Gemini Apps chats anytime.","context":"Chats reviewed by human reviewers are “retained for up to three years” after you delete activity. Temporary chats and chats with Keep Activity off “are retained with your account for 72 hours”.","source_title":"Gemini Apps Privacy Hub","source_url":"https://support.google.com/gemini/answer/13594961?hl=en","kept_on":"2026-11-04","kept_sha256":"ee8f0fa990d2760ebb62bbd7bad5cd6352b42e56252a35987d877bddb685621c","note":null,"nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/gemini-app/questionnaire/#q3","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"gemini-app","vendor":"Gemini Apps","question_id":"Q4","question":"Can a customer have the vendor keep none of its data?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Gemini Apps Privacy Hub; Gemini Apps limits & feature availability","nist_ai_rmf":"MEASURE-2.10","nist_ai_600_1":"GV-6.1-004","page":"https://jesseahawkins.com/vendors/gemini-app/questionnaire/#q4","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"gemini-app","vendor":"Gemini Apps","question_id":"Q5","question":"Where does the vendor process and store customer data?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Gemini Apps Privacy Hub; Gemini Apps limits & feature availability","nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"GV-6.1-009","page":"https://jesseahawkins.com/vendors/gemini-app/questionnaire/#q5","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"gemini-app","vendor":"Gemini Apps","question_id":"Q6","question":"Which other companies process customer data for the vendor?","state":"answered","answer":"Service providers' reviewers see some chats, disconnected from the account; none are named","quote":"We take your privacy seriously, and we do not sell your personal information to anyone. Chats are disconnected from your account before being sent to service providers.","context":"“A subset of chats are reviewed by human reviewers (including Google’s trained service providers) to help improve Google services.”","source_title":"Gemini Apps Privacy Hub","source_url":"https://support.google.com/gemini/answer/13594961?hl=en","kept_on":"2026-11-04","kept_sha256":"ee8f0fa990d2760ebb62bbd7bad5cd6352b42e56252a35987d877bddb685621c","note":null,"nist_ai_rmf":"GOVERN-6.1 MANAGE-3.1","nist_ai_600_1":"GV-6.1-007","page":"https://jesseahawkins.com/vendors/gemini-app/questionnaire/#q6","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"gemini-app","vendor":"Gemini Apps","question_id":"Q7","question":"Which independent audits or certifications does the vendor name?","state":"none","answer":"Not published in the pages kept","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Searched: Gemini Apps Privacy Hub; Gemini Apps limits & feature availability","nist_ai_rmf":"GOVERN-6.1","nist_ai_600_1":"A.1.3","page":"https://jesseahawkins.com/vendors/gemini-app/questionnaire/#q7","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"gemini-app","vendor":"Gemini Apps","question_id":"Q8","question":"Does the vendor publish a history of its service incidents?","state":"not-kept","answer":"No answer kept","quote":null,"context":null,"source_title":null,"source_url":"https://www.google.com/appsstatus/dashboard/","kept_on":null,"kept_sha256":null,"note":"The Google Workspace status dashboard draws its events with script. This site keeps no history feed for Gemini Apps.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/gemini-app/questionnaire/#q8","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."},{"vendor_id":"gemini-app","vendor":"Gemini Apps","question_id":"Q9","question":"Does the vendor publish the dates on which it retires its models?","state":"not-read","answer":"Not read","quote":null,"context":null,"source_title":null,"source_url":null,"kept_on":null,"kept_sha256":null,"note":"Gemini Apps is an AI application; this site reads model retirement pages of model makers and clouds only.","nist_ai_rmf":"GOVERN-6.2","nist_ai_600_1":"GV-6.2-007","page":"https://jesseahawkins.com/vendors/gemini-app/questionnaire/#q9","license":"Answers quote each vendor’s own page; questions cite NIST AI 600-1 and AI RMF 1.0 (public domain in the US)","notice":"This record is a factual recitation of publicly available vendor documentation as of the verification date. It does not constitute a legal opinion, a regulatory compliance certification, or an allegation of wrongdoing. The kept pages are held strictly as an evidentiary record that supports these findings."}]}