Vendors
Twelve of twenty-one AI vendors say business data stays out of training
What OpenAI, Anthropic, Google and eighteen more AI vendors say about training on customer data, how long they keep it, how to keep none, where it is held, who else handles it, which audits they claim, whether a data processing agreement covers it and what usage limits apply, each line quoted from the vendor’s own page. The record keeps 66 of their pages with a sha256 for each, last checked on 4 Nov 2026.
The diff feed: each change to a kept page, with the lines added and removed.
The questionnaire, answered: nine buyer questions, tied to NIST, each answered in the vendor’s own words.
Service reliability: every incident on Anthropic, OpenAI, Google, Cohere, DeepSeek, xAI, Perplexity, GitHub and Cursor’s status pages, kept from their own feeds.
AI bill of materials: each vendor’s record as a CycloneDX and an SPDX file.
Federal AI contracts: federal contracts that name AI reached $449M in fiscal 2026, by agency and recipient, from USAspending.gov.
What each vendor says
Mistral AI, Cohere, Cursor and Gemini Apps offer an opt-out instead; each vendor’s page gives the words behind every cell| Vendor | Business data18 of 21 state it | Free use6 of 21 state it | Kept for17 of 21 state it | Keep nothing13 of 21 state it | Where15 of 21 state it | Sub-processors17 of 21 state it | Audits7 of 21 state it | DPA16 of 21 state it | Limits18 of 21 state it |
|---|---|---|---|---|---|---|---|---|---|
| Model makers | |||||||||
| OpenAI OpenAI API | Not by default | — | Up to 30 days in abuse monitoring logs, with listed exceptions | Zero Data Retention, on approval | Data residency controls, for eligible customers | Uses sub-processors; names Cloudflare for the US and EU endpoints | Not stated in the pages kept | Not stated in the pages kept | Rate limits by model, organization and project; usage tiers rise with credit purchases |
| Anthropic Anthropic API and Claude commercial products | Not by default | — | Anthropic API: deleted within 30 days, with listed exceptions | Zero data retention, by agreement | API inference: global by default (any geography) or US-only via inference_geo on Claude 4.6 and later, on the first-party API (except the OpenAI SDK compatibility endpoint) and some partner platforms; workspace data at rest: US only | Not stated in the pages kept | Not stated in the pages kept | Incorporated into the Commercial Terms by reference | Spend and rate limits by usage tier, set from usage history and account standing |
| Mistral AI Mistral Studio and Vibe | Opt-out offered on Mistral Studio pay-as-you-go; Vibe Enterprise is opted out by default | Yes by default on Vibe, with an opt-out | Not stated in the pages kept | Zero Data Retention, pay-as-you-go stateless API calls, on approved request | Not stated in the pages kept | Not stated in the pages kept | Not stated in the pages kept | Published online; Mistral does not sign it offline | Rate limits per model, set by the plan and shown in the Admin Panel, not on the page; spending limits by organization and workspace |
| Cohere Cohere SaaS platform | Opt-out offered | — | Deleted after 30 days, with listed exceptions | Zero data retention, on request, for enterprise customers who make additional usage commitments | Not stated in the pages kept | Listed on its Trust Center | ISO 27001, ISO 42001 and a SOC 2 Type II report, on request | On request, for SaaS Platform customers | Per-model rates for trial and production keys, some by contact with sales; 1,000 calls a month on trial keys and on production keys for newer Chat models |
| DeepSeek DeepSeek services and Open Platform | Not stated in the pages kept | Listed as a use of personal data | As long as necessary; inputs are kept for as long as you have an account | Not stated in the pages kept | Personal data collected, processed and stored in the People’s Republic of China | Service providers by category; no list in the kept pages | Not stated in the pages kept | Not stated in the pages kept | Concurrency limits per model, per account |
| xAI xAI API | Not without permission | Listed as a use of personal information | 30 days | Zero Data Retention, a team setting where self-serve is available | US only on the US regional endpoint, for two models, with listed exclusions | A published list; new names 15 days in advance | SOC 2 Type 2 | Incorporated into the enterprise terms; personal data only through the ZDR-Enabled API | Per-model limits on requests per second and tokens per minute, by spend tier; voice and audio by requests and concurrent sessions |
| Alibaba Cloud Alibaba Cloud Model Studio, international site | No | — | Up to 30 days, with listed exceptions | Zero Data Retention, for enterprise customers on assessment | Not stated in the pages kept | Not stated in the pages kept | SOC 2 | Not stated in the pages kept | Requests and tokens per minute per model, at account level |
| Z.ai Z.ai API Services (GLM models) | Not stated in the pages kept | — | API content not stored; other customer data kept until the terms end, with listed exceptions | API content is not stored, the addendum says | Generally processed in Singapore | Group companies and service providers, typically in Singapore; no list | Not stated in the pages kept | A Data Processing Addendum for API Services, incorporated into the Additional Terms for API Services | Not stated in the pages kept |
| Moonshot AI Kimi OpenPlatform API | Yes, unless agreed otherwise in writing | — | While the account is active, with listed exceptions | Not stated in the pages kept | Stored in Singapore | Service providers by category; no list | Not stated in the pages kept | Not stated in the pages kept | Concurrency, requests and tokens limits by cumulative recharge; limits can change with load |
| Meta Meta Model API | No on Standard Services; Contributor (Discounted) Services content may train Meta models | Yes on Discounted (Contributor) Services; Standard Services content is not used to train | No fixed period; kept as needed for the Services, law, Meta’s use rights, and safety review | ZDR is named for Muse Voice Transcribe, priced the same as Standard mode | Not stated in the pages kept | On Standard Services, Meta may engage subprocessors from a linked list it may update | Not stated in the pages kept | On Standard Services, Meta acts as Processor under the Meta Global Processor Terms (MGPT) | Per-team, per-model limits; Contributor variants allow 150 RPM against 3,000 RPM on Standard |
| Tencent Tencent HY (Hunyuan) on Tencent Cloud International | Not stated in the pages kept | — | Generally up to 7 days for the HY module’s listed data, longer for billing; varies with settings | Not stated in the pages kept | Personal Data processed in the Service Region the customer selects, with exceptions | Listed on a Third Party Information page; 14 days to object to changes, where law requires notice | Not stated in the pages kept | A Data Processing and Security Addendum covers Content under the Terms of Service, not account data | Not stated in the pages kept |
| Xiaomi Xiaomi MiMo API Open Platform, under its privacy policy for use in China | No for the text content a user gives, unless the user gives prior consent | — | No fixed period: kept as long as its purposes need or law requires, with exceptions | Not stated in the pages kept | Personal information is stored in China, for use of the service within China | Some services use third-party service providers that get some personal information; none named here | Not stated in the pages kept | Xiaomi signs data processing agreements with its third-party providers; no customer DPA stated | Per-account RPM and TPM limits for each model, e.g. 100 RPM and 10M TPM for mimo-v2.6-pro |
| StepFun StepFun Open Platform, international site | May train: the terms license prompts, outputs and API call logs to StepFun for any purpose | — | Customer Data is deleted within 30 days after the agreement ends, with exceptions | Not stated in the pages kept | Privacy policy: servers in the United States; affiliates and providers elsewhere may access data | The customer gives StepFun general authorization to engage subprocessors | Not stated in the pages kept | A DPA forms part of the Terms of Service and applies to StepFun’s processing of Customer Data | Pay-as-you-go rate limits by tier of cash top-up; enterprise tiers through sales |
| Clouds | |||||||||
| Google Gemini API and Gemini models on Google Cloud | Not used to improve products, on paid use | Used to improve products, on unpaid use outside the EEA, Switzerland and the UK | A limited period, for abuse detection and legal disclosures, on paid use | Zero data retention on Google Cloud, with customer actions; not possible with some features | On Google Cloud: at rest in the chosen location; global endpoints carry no guarantee | A published list for Google Cloud, AI services included | Not stated in the pages kept | Prompts and responses on paid use processed under Google’s Data Processing Addendum | Quotas by Google Cloud project, with default values that can typically be adjusted on request; fixed system limits |
| Microsoft Azure OpenAI and other models sold by Azure in Microsoft Foundry | Not without permission | — | Not stated in the pages kept | Modified abuse monitoring, by application | In the customer’s chosen geography, except Global and DataZone deployments | Not stated in the pages kept | Not stated in the pages kept | The Microsoft data protection addendum, part of the Product Terms | Quotas by Azure subscription and quota tier; tiers rise with usage unless the customer opts out |
| AWS Amazon Bedrock | No, for Amazon Nova, Amazon Titan and third-party models | — | Set by the model and the account's retention mode | Zero data retention mode, for models that allow it; for other models, eligibility is evaluated per account and model | Stored at rest in the AWS Region in use | A published list, by Region and service | In scope for FedRAMP Moderate, SOC, ISO and HIPAA eligibility | The AWS Data Processing Addendum, under which AWS engages sub-processors | Default quotas on token use, and on requests for embedding models; an account’s own quotas can be lower |
| AI applications | |||||||||
| Perplexity Perplexity API Platform | Not by default | — | Not stated in the pages kept | Zero Data Retention, for eligible customers by written agreement | Not stated in the pages kept | Listed on its Trust Center | SOC 2 Type II | Personal data processed under its Data Processing Addendum | Rate limits by usage tier, from cumulative spend |
| Microsoft Copilot Microsoft Copilot for work, formerly Microsoft 365 Copilot | Not used to train foundation LLMs | — | Stored with the organization’s Microsoft 365 content; admins set retention | Not stated in the pages kept | EU traffic stays in the EU Data Boundary, except on Anthropic models | Names Anthropic and OpenAI as subprocessors for their models | ISO 27001 and ISO 42001, listed beside GDPR and HIPAA | The Microsoft Product Terms and Data Protection Addendum, named for data residency | Not stated in the pages kept |
| GitHub Copilot GitHub Copilot Business and Enterprise | No | Yes on Free, Pro and Pro+, unless the user opts out | Not kept in the IDE; 28 days for other use, with listed exceptions | Not stated in the pages kept | Listed for each sub-processor; AI inference in the US and other countries | A published list; new names 30 days in advance | Not stated in the pages kept | GitHub’s Data Protection Agreement, for business customers | A monthly allowance of AI credits per plan; on Business and Enterprise, admins set limits on paid usage beyond it; GitHub’s own rate limits have no published numbers |
| Cursor Cursor, by Anysphere | Not with Privacy Mode on | — | Not stated in the pages kept | With Privacy Mode on, ZDR agreements with all providers; non-ZDR models are marked or need an admin; flagged data may be kept for investigation | No infrastructure in China | Listed on its trust portal; none headquartered in China | SOC 2 Type II; ISO 27001, ISO 42001 and AIUC-1 | Published; governs processing under the Master Services Agreement | A weekly pool of usage for Cursor models on each paid plan; third-party models on Premium and above at API list price |
| Gemini Apps Gemini Apps for personal Google Accounts | Yes while Keep Activity is on; not in temporary chats, or with it off unless you send feedback | — | Activity auto-deletes after 18 months by default (3, 36 months or indefinite); some chats kept longer | Not stated in the pages kept | Not stated in the pages kept | Service providers' reviewers see some chats, disconnected from the account; none are named | Not stated in the pages kept | Not stated in the pages kept | Compute-based limits refresh every 5 hours up to a weekly limit; higher on paid plans; may change |
No vendor page has changed since the first snapshot
first kept on 24 Oct 2026; checked again on 4 Nov 2026Each page is fetched again on a schedule. A changed page gets its added and removed lines here and on its vendor’s page.
Pages the record could not keep
no page is kept from behind a sign-in or a refusal- OpenAI: Privacy policy. The site refused the request (HTTP 403) on 26 Oct 2026.
- OpenAI: Terms of use. The site refused the request (HTTP 403) on 26 Oct 2026.
- OpenAI: Sub-processor list. The site refused the request (HTTP 403) on 26 Oct 2026.
- OpenAI: Data processing addendum. The site refused the request (HTTP 403) on 3 Nov 2026.
- Perplexity: Privacy policy. The site refused the request (HTTP 403) on 26 Oct 2026.
- Perplexity: Enterprise terms of service. The site refused the request (HTTP 403) on 26 Oct 2026.
- OpenAI: Data controls in the OpenAI platform, Rate limits. Kept on 24 Oct 2026.
- Anthropic: Is my data used for model training?, How long do you store my organization's data?, Commercial Terms of Service, Data residency, Rate limits. Kept on 24 Oct 2026.
- Google: Gemini API Additional Terms of Service, Gemini Enterprise Agent Platform and zero data retention, Data residency, Google Cloud Platform Subprocessors, Generative AI on Agent Platform quotas and system limits. Kept on 24 Oct 2026.
- Microsoft: Data, privacy, and security for Foundry Models sold by Azure, Abuse monitoring, Azure OpenAI in Microsoft Foundry Models quotas and limits, Microsoft Products and Services Data Protection Addendum. Kept on 24 Oct 2026.
- AWS: Amazon Bedrock FAQs, Data retention, Amazon Bedrock abuse detection, AWS Sub-processors, Quotas for Amazon Bedrock. Kept on 24 Oct 2026.
- Mistral AI: Do you use my user data to train your Artificial Intelligence models?, Can I activate Zero Data Retention (ZDR)?, Usage and limits. Kept on 24 Oct 2026.
- Cohere: Enterprise data commitments, Different Types of API Keys and Rate Limits. Kept on 24 Oct 2026.
- DeepSeek: DeepSeek Privacy Policy, DeepSeek Open Platform Terms of Service, Rate Limit & Isolation. Kept on 24 Oct 2026.
- xAI: FAQ: API security, Terms of Service - Enterprise, Privacy Policy, Rate Limits, Data Processing Addendum. Kept on 24 Oct 2026.
- Alibaba Cloud: Alibaba Cloud Model Studio Data Retention Policy, Security certifications and privacy, Rate limits. Kept on 26 Oct 2026.
- Z.ai: Privacy Policy, with the Data Processing Addendum for API Services. Kept on 26 Oct 2026.
- Moonshot AI: Terms of Service for Kimi OpenPlatform, Kimi OpenPlatform Privacy Policy, Recharge and Rate Limits. Kept on 26 Oct 2026.
- Perplexity: API Privacy & Security, Rate Limits & Usage Tiers. Kept on 26 Oct 2026.
- Microsoft Copilot: Data, Privacy, and Security for Microsoft Copilot. Kept on 26 Oct 2026.
- GitHub Copilot: GitHub Copilot, frequently asked questions, GitHub Subprocessors, Usage limits for GitHub Copilot. Kept on 26 Oct 2026.
- Cursor: Data Use & Privacy Overview, Security, Models and pricing, Data Processing Addendum. Kept on 26 Oct 2026.
- Meta: Meta Model API Data Commitments, Meta Model API Terms of Service, Pricing and rate limits. Kept on 4 Nov 2026.
- Tencent: Tencent HY 3D Global and Text Generation Privacy Policy, Privacy Policy, Data Processing and Security Agreement, Privacy FAQs. Kept on 4 Nov 2026.
- Xiaomi: Xiaomi MiMo Privacy Policy, Rate Limit. Kept on 4 Nov 2026.
- StepFun: User Privacy, Terms of Service, Data Processing Agreement, Pricing and rate limits. Kept on 4 Nov 2026.
- Gemini Apps: Gemini Apps Privacy Hub, Gemini Apps limits & feature availability. Kept on 4 Nov 2026.