Vendors · questionnaire

Eighteen of twenty-one AI vendors state their business-data training terms

Nine questions a buyer asks of an AI vendor, each tied to the NIST text that asks it, and each answered in the vendor’s own words from a kept copy of its page or feed. Read 4 Nov 2026.

questionnaire.csv pages read 4 Nov 2026

Embed

The frame credits each vendor’s own pages and NIST and links back to its page. Preview it.

Cite
questionnaire.csv Post on X

Each vendor, each question

a vendor’s row opens its answers, each with the words it is read from
Vendor Trains on business dataTrains on free useHow long data is keptKeeps nothing, on requestWhere data is heldSub-processorsAudits namedPublishes incidentsPublishes retirements
Model makers
OpenAI StatedNot readStatedStatedStatedStatedNot in pages keptStatedStated
Anthropic StatedNot readStatedStatedStatedNot in pages keptNot in pages keptStatedStated
Mistral AI StatedStatedNot in pages keptStatedNot in pages keptNot in pages keptNot in pages keptNot keptStated
Cohere StatedNot readStatedStatedNot in pages keptStatedStatedStatedStated
DeepSeek Not in pages keptStatedStatedNot in pages keptStatedStatedNot in pages keptStatedNot kept
xAI StatedStatedStatedStatedStatedStatedStatedStatedNot kept
Alibaba Cloud StatedNot readStatedStatedNot in pages keptNot in pages keptStatedNot keptNot read
Z.ai Not in pages keptNot readStatedStatedStatedStatedNot in pages keptNot keptNot read
Moonshot AI StatedNot readStatedNot in pages keptStatedStatedNot in pages keptNot keptNot read
Meta StatedStatedStatedStatedNot in pages keptStatedNot in pages keptNot keptNot read
Tencent Not in pages keptNot readStatedNot in pages keptStatedStatedNot in pages keptNot keptNot read
Xiaomi StatedNot readStatedNot in pages keptStatedStatedNot in pages keptNot keptNot read
StepFun StatedNot readStatedNot in pages keptStatedStatedNot in pages keptNot keptNot read
Clouds
Google StatedStatedStatedStatedStatedStatedNot in pages keptStatedStated
Microsoft StatedNot readNot in pages keptStatedStatedNot in pages keptNot in pages keptNot keptStated
AWS StatedNot readStatedStatedStatedStatedStatedNot keptStated
AI applications
Perplexity StatedNot readNot in pages keptStatedNot in pages keptStatedStatedStatedNot read
Microsoft Copilot StatedNot readStatedNot in pages keptStatedStatedStatedNot keptNot read
GitHub Copilot StatedStatedStatedNot in pages keptStatedStatedNot in pages keptStatedNot read
Cursor StatedNot readNot in pages keptStatedStatedStatedStatedStatedNot read
Gemini Apps StatedNot readStatedNot in pages keptNot in pages keptStatedNot in pages keptNot keptNot read

Does the vendor train its models on business and API customers’ data?

Q1 · 18 of 21 answer it

NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”

NIST AI RMF 1.0, MEASURE 2.10. Also asked by EU AI Act annex-iv/2/d, EU AI Act annex-xi/s1/2/c, ISO/IEC 42001 A.7.3, ISO/IEC 42001 A.7.5

  • OpenAI Not by default
  • Anthropic Not by default
  • Google Not used to improve products, on paid use
  • Microsoft Not without permission
  • AWS No, for Amazon Nova, Amazon Titan and third-party models
  • Mistral AI Opt-out offered on Mistral Studio pay-as-you-go; Vibe Enterprise is opted out by default
  • Cohere Opt-out offered
  • DeepSeek Not published in the pages kept
  • xAI Not without permission
  • Alibaba Cloud No
  • Z.ai Not published in the pages kept
  • Moonshot AI Yes, unless agreed otherwise in writing
  • Perplexity Not by default
  • Microsoft Copilot Not used to train foundation LLMs
  • GitHub Copilot No
  • Cursor Not with Privacy Mode on
  • Meta No on Standard Services; Contributor (Discounted) Services content may train Meta models
  • Tencent Not published in the pages kept
  • Xiaomi No for the text content a user gives, unless the user gives prior consent
  • StepFun May train: the terms license prompts, outputs and API call logs to StepFun for any purpose
  • Gemini Apps Yes while Keep Activity is on; not in temporary chats, or with it off unless you send feedback

Does the vendor train its models on free and consumer use of its products?

Q2 · 6 of 21 answer it

NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”

NIST AI RMF 1.0, MEASURE 2.10

How long does the vendor keep the data that customers send?

Q3 · 17 of 21 answer it

NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”

NIST AI RMF 1.0, MEASURE 2.10. Also asked by ISO/IEC 42001 A.7.3

  • OpenAI Up to 30 days in abuse monitoring logs, with listed exceptions
  • Anthropic Anthropic API: deleted within 30 days, with listed exceptions
  • Google A limited period, for abuse detection and legal disclosures, on paid use
  • Microsoft Not published in the pages kept
  • AWS Set by the model and the account's retention mode
  • Mistral AI Not published in the pages kept
  • Cohere Deleted after 30 days, with listed exceptions
  • DeepSeek As long as necessary; inputs are kept for as long as you have an account
  • xAI 30 days
  • Alibaba Cloud Up to 30 days, with listed exceptions
  • Z.ai API content not stored; other customer data kept until the terms end, with listed exceptions
  • Moonshot AI While the account is active, with listed exceptions
  • Perplexity Not published in the pages kept
  • Microsoft Copilot Stored with the organization’s Microsoft 365 content; admins set retention
  • GitHub Copilot Not kept in the IDE; 28 days for other use, with listed exceptions
  • Cursor Not published in the pages kept
  • Meta No fixed period; kept as needed for the Services, law, Meta’s use rights, and safety review
  • Tencent Generally up to 7 days for the HY module’s listed data, longer for billing; varies with settings
  • Xiaomi No fixed period: kept as long as its purposes need or law requires, with exceptions
  • StepFun Customer Data is deleted within 30 days after the agreement ends, with exceptions
  • Gemini Apps Activity auto-deletes after 18 months by default (3, 36 months or indefinite); some chats kept longer

Can a customer have the vendor keep none of its data?

Q4 · 13 of 21 answer it

NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”

NIST AI RMF 1.0, MEASURE 2.10

  • OpenAI Zero Data Retention, on approval
  • Anthropic Zero data retention, by agreement
  • Google Zero data retention on Google Cloud, with customer actions; not possible with some features
  • Microsoft Modified abuse monitoring, by application
  • AWS Zero data retention mode, for models that allow it; for other models, eligibility is evaluated per account and model
  • Mistral AI Zero Data Retention, pay-as-you-go stateless API calls, on approved request
  • Cohere Zero data retention, on request, for enterprise customers who make additional usage commitments
  • DeepSeek Not published in the pages kept
  • xAI Zero Data Retention, a team setting where self-serve is available
  • Alibaba Cloud Zero Data Retention, for enterprise customers on assessment
  • Z.ai API content is not stored, the addendum says
  • Moonshot AI Not published in the pages kept
  • Perplexity Zero Data Retention, for eligible customers by written agreement
  • Microsoft Copilot Not published in the pages kept
  • GitHub Copilot Not published in the pages kept
  • Cursor With Privacy Mode on, ZDR agreements with all providers; non-ZDR models are marked or need an admin; flagged data may be kept for investigation
  • Meta ZDR is named for Muse Voice Transcribe, priced the same as Standard mode
  • Tencent Not published in the pages kept
  • Xiaomi Not published in the pages kept
  • StepFun Not published in the pages kept
  • Gemini Apps Not published in the pages kept

Where does the vendor process and store customer data?

Q5 · 15 of 21 answer it

NIST AI 600-1, action GV-6.1-009: “Update and integrate due diligence processes for GAI acquisition and procurement vendor assessments to include intellectual property, data privacy …”

NIST AI RMF 1.0, GOVERN 6.1

  • OpenAI Data residency controls, for eligible customers
  • Anthropic API inference: global by default (any geography) or US-only via inference_geo on Claude 4.6 and later, on the first-party API (except the OpenAI SDK compatibility endpoint) and some partner platforms; workspace data at rest: US only
  • Google On Google Cloud: at rest in the chosen location; global endpoints carry no guarantee
  • Microsoft In the customer’s chosen geography, except Global and DataZone deployments
  • AWS Stored at rest in the AWS Region in use
  • Mistral AI Not published in the pages kept
  • Cohere Not published in the pages kept
  • DeepSeek Personal data collected, processed and stored in the People’s Republic of China
  • xAI US only on the US regional endpoint, for two models, with listed exclusions
  • Alibaba Cloud Not published in the pages kept
  • Z.ai Generally processed in Singapore
  • Moonshot AI Stored in Singapore
  • Perplexity Not published in the pages kept
  • Microsoft Copilot EU traffic stays in the EU Data Boundary, except on Anthropic models
  • GitHub Copilot Listed for each sub-processor; AI inference in the US and other countries
  • Cursor No infrastructure in China
  • Meta Not published in the pages kept
  • Tencent Personal Data processed in the Service Region the customer selects, with exceptions
  • Xiaomi Personal information is stored in China, for use of the service within China
  • StepFun Privacy policy: servers in the United States; affiliates and providers elsewhere may access data
  • Gemini Apps Not published in the pages kept

Which other companies process customer data for the vendor?

Q6 · 17 of 21 answer it

NIST AI 600-1, action GV-6.1-007: “Inventory all third-party entities with access to organizational content and establish approved GAI technology and service provider lists.”

NIST AI RMF 1.0, GOVERN 6.1; NIST AI RMF 1.0, MANAGE 3.1. Also asked by ISO/IEC 42001 A.10.2, ISO/IEC 42001 A.10.3, DORA register B_05.02

  • OpenAI Uses sub-processors; names Cloudflare for the US and EU endpoints
  • Anthropic Not published in the pages kept
  • Google A published list for Google Cloud, AI services included
  • Microsoft Not published in the pages kept
  • AWS A published list, by Region and service
  • Mistral AI Not published in the pages kept
  • Cohere Listed on its Trust Center
  • DeepSeek Service providers by category; no list in the kept pages
  • xAI A published list; new names 15 days in advance
  • Alibaba Cloud Not published in the pages kept
  • Z.ai Group companies and service providers, typically in Singapore; no list
  • Moonshot AI Service providers by category; no list
  • Perplexity Listed on its Trust Center
  • Microsoft Copilot Names Anthropic and OpenAI as subprocessors for their models
  • GitHub Copilot A published list; new names 30 days in advance
  • Cursor Listed on its trust portal; none headquartered in China
  • Meta On Standard Services, Meta may engage subprocessors from a linked list it may update
  • Tencent Listed on a Third Party Information page; 14 days to object to changes, where law requires notice
  • Xiaomi Some services use third-party service providers that get some personal information; none named here
  • StepFun The customer gives StepFun general authorization to engage subprocessors
  • Gemini Apps Service providers' reviewers see some chats, disconnected from the account; none are named

Which independent audits or certifications does the vendor name?

Q7 · 7 of 21 answer it

NIST AI 600-1, Appendix A.1.3: “statement on standards for attestation engagement (SSAE) reports to help with third-party transparency and risk management for GAI systems”

NIST AI RMF 1.0, GOVERN 6.1

  • OpenAI Not published in the pages kept
  • Anthropic Not published in the pages kept
  • Google Not published in the pages kept
  • Microsoft Not published in the pages kept
  • AWS In scope for FedRAMP Moderate, SOC, ISO and HIPAA eligibility
  • Mistral AI Not published in the pages kept
  • Cohere ISO 27001, ISO 42001 and a SOC 2 Type II report, on request
  • DeepSeek Not published in the pages kept
  • xAI SOC 2 Type 2
  • Alibaba Cloud SOC 2
  • Z.ai Not published in the pages kept
  • Moonshot AI Not published in the pages kept
  • Perplexity SOC 2 Type II
  • Microsoft Copilot ISO 27001 and ISO 42001, listed beside GDPR and HIPAA
  • GitHub Copilot Not published in the pages kept
  • Cursor SOC 2 Type II; ISO 27001, ISO 42001 and AIUC-1
  • Meta Not published in the pages kept
  • Tencent Not published in the pages kept
  • Xiaomi Not published in the pages kept
  • StepFun Not published in the pages kept
  • Gemini Apps Not published in the pages kept

Does the vendor publish a history of its service incidents?

Q8 · 9 of 21 answer it

NIST AI 600-1, action GV-6.2-007: “Service Level Agreements (SLAs) in vendor contracts that address incident response, response times, and availability of critical support.”

NIST AI RMF 1.0, GOVERN 6.2

  • OpenAI Yes: a status history feed, with 106 incidents kept since 2026-07-28
  • Anthropic Yes: a status history feed, with 29 incidents kept since 2026-09-01
  • Google Yes: a status history feed, with 1 incident kept since 2026-02-27
  • Microsoft No answer kept
  • AWS No answer kept
  • Mistral AI No answer kept
  • Cohere Yes: a status history feed, with 2 incidents kept since 2026-08-05
  • DeepSeek Yes: a status history feed, with 36 incidents kept since 2026-07-28
  • xAI Yes: a status history feed, with 97 incidents kept since 2026-08-17
  • Alibaba Cloud No answer kept
  • Z.ai No answer kept
  • Moonshot AI No answer kept
  • Perplexity Yes: a status history feed, with 10 incidents kept since 2026-08-06
  • Microsoft Copilot No answer kept
  • GitHub Copilot Yes: a status history feed, with 32 incidents kept since 2026-09-18
  • Cursor Yes: a status history feed, with 25 incidents kept since 2026-09-29
  • Meta No answer kept
  • Tencent No answer kept
  • Xiaomi No answer kept
  • StepFun No answer kept
  • Gemini Apps No answer kept

Does the vendor publish the dates on which it retires its models?

Q9 · 7 of 21 answer it

NIST AI 600-1, action GV-6.2-007: “Review vendor contracts and avoid arbitrary or capricious termination of critical GAI technologies or vendor services …”

NIST AI RMF 1.0, GOVERN 6.2

  • OpenAI Yes: OpenAI (“Deprecations”), with 171 dated retirements kept
  • Anthropic Yes: Anthropic (“Model deprecations”), with 20 dated retirements kept
  • Google Yes: Google’s Gemini API (“Gemini deprecations”) and Google’s Vertex AI (“Model versions and lifecycle”), with 94 dated retirements kept
  • Microsoft Yes: Azure AI Foundry (“Model retirement schedule”), with 166 dated retirements kept
  • AWS Yes: Amazon Bedrock (“Model lifecycle (Legacy)”), with 48 dated retirements kept
  • Mistral AI Yes: Mistral AI (“Models: deprecated and retired”), with 44 dated retirements kept
  • Cohere Yes: Cohere (“Deprecations”), with 2 dated retirements kept
  • DeepSeek No answer kept
  • xAI No answer kept
  • Alibaba Cloud Not read
  • Z.ai Not read
  • Moonshot AI Not read
  • Perplexity Not read
  • Microsoft Copilot Not read
  • GitHub Copilot Not read
  • Cursor Not read
  • Meta Not read
  • Tencent Not read
  • Xiaomi Not read
  • StepFun Not read
  • Gemini Apps Not read

Why the questions cite NIST, not CAIQ or SIG Lite

checked 26 Oct 2026
  • CSA AI Controls Matrix v1.1 and its AI-CAIQ. Its terms: “The free versions of CCM and AICM are for internal reference only. If your needs extend to commercial applications, a license is required. Additionally, without a license, you are restricted from altering CCM or AICM or creating any derivatives of them.” Its download needs a sign-in at CSA, and this site makes no account.
  • Shared Assessments SIG Lite. Its page sent this site to a sign-in, and this site makes no account, so no SIG question was read.
  • NIST AI 600-1 and Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1 are works of the US government, free to reprint. Republished courtesy of the National Institute of Standards and Technology.

Sources

questionnaire.csv Every dataset → Status → Glossary →