Vendors · Questionnaire · Alibaba Cloud
Read Alibaba Cloud’s own answers to nine buyer questions
Alibaba Cloud Model Studio, international site. Each answer quotes Alibaba Cloud’s own page or feed as kept on the day shown. Each question cites the NIST text that asks it. The answers are not a score and not a verdict.
Alibaba Cloud in the vendor record alibaba-questionnaire.csv
Q1
Does the vendor train its models on business and API customers’ data?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
No
Alibaba Cloud strictly protects your data privacy and will never use your data for model training.
The data retention policy says it will not use business data to train, fine-tune or improve a foundation model without “separate consent”. Security certifications and privacy, kept 26 Oct 2026 · sha256 60573ba1ba19
Q2
Does the vendor train its models on free and consumer use of its products?
NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”
NIST AI RMF 1.0, MEASURE 2.10
Not read
The vendor record does not read this point for Alibaba Cloud.
Q3
How long does the vendor keep the data that customers send?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
Up to 30 days, with listed exceptions
By default, user’s prompts and responses from model inference calls are retained for no longer than 30 days, unless longer retention is required by applicable laws or is reasonably necessary to ensure the security of Alibaba Cloud Model Studio services.
The same paragraph adds: “Stateful features (conversation storage, files) are retained until deleted by users.” Alibaba Cloud Model Studio Data Retention Policy, kept 26 Oct 2026 · sha256 8e88f476d5c7
Q4
Can a customer have the vendor keep none of its data?
NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”
NIST AI RMF 1.0, MEASURE 2.10
Zero Data Retention, for enterprise customers on assessment
ZDR is available to enterprise customers with an Alibaba Cloud account manager, subject to a needs assessment.
For the international site, in regions outside mainland China, on listed models only. Content flagged by safety filters is kept for up to two years. Alibaba Cloud Model Studio Data Retention Policy, kept 26 Oct 2026 · sha256 8e88f476d5c7
Q5
Where does the vendor process and store customer data?
NIST AI 600-1, action GV-6.1-009: “Update and integrate due diligence processes for GAI acquisition and procurement vendor assessments to include intellectual property, data privacy …”
NIST AI RMF 1.0, GOVERN 6.1
Not published in the pages kept
Searched: Alibaba Cloud Model Studio Data Retention Policy; Security certifications and privacy; Rate limits.
Q6
Which other companies process customer data for the vendor?
NIST AI 600-1, action GV-6.1-007: “Inventory all third-party entities with access to organizational content and establish approved GAI technology and service provider lists.”
NIST AI RMF 1.0, GOVERN 6.1; NIST AI RMF 1.0, MANAGE 3.1
Not published in the pages kept
Searched: Alibaba Cloud Model Studio Data Retention Policy; Security certifications and privacy; Rate limits.
Q7
Which independent audits or certifications does the vendor name?
NIST AI 600-1, Appendix A.1.3: “statement on standards for attestation engagement (SSAE) reports to help with third-party transparency and risk management for GAI systems”
NIST AI RMF 1.0, GOVERN 6.1
SOC 2
Alibaba Cloud Model Studio has achieved SOC 2 compliance with an unqualified opinion, validating our rigorous controls for Security, Availability, and Confidentiality.
Security certifications and privacy, kept 26 Oct 2026 · sha256 60573ba1ba19
Q8
Does the vendor publish a history of its service incidents?
NIST AI 600-1, action GV-6.2-007: “Service Level Agreements (SLAs) in vendor contracts that address incident response, response times, and availability of critical support.”
NIST AI RMF 1.0, GOVERN 6.2
No answer kept
The status page draws its events with script and links no history feed. The page.
Q9
Does the vendor publish the dates on which it retires its models?
NIST AI 600-1, action GV-6.2-007: “Review vendor contracts and avoid arbitrary or capricious termination of critical GAI technologies or vendor services …”
NIST AI RMF 1.0, GOVERN 6.2
Not read
This site reads no retirement page for Alibaba Cloud.
- Alibaba Cloud, Security certifications and privacy, kept 26 Oct 2026.
- Alibaba Cloud, Alibaba Cloud Model Studio Data Retention Policy, kept 26 Oct 2026.
- NIST, NIST AI 600-1, 2024-07. Republished courtesy of the National Institute of Standards and Technology.