How to — find out what an AI vendor keeps from your prompts

You want three plain answers about every AI tool that touches your data: does it train on what you send, how long does it keep a copy, and who inside the vendor can read it. You can get all three in an afternoon without asking a salesperson, and without trusting a badge on a marketing page.

The reason this needs its own method is that vendors answer the training question loudly and the retention question quietly, and readers merge the two. "We don't train on your data" is a statement about model weights. It says nothing about the copy of your prompt sitting in an abuse-monitoring store for a month, or the one your grounding feature logs for three days with no way to switch it off. Both can be true of the same product at the same time.

Same applies to memory: if the assistant remembers a detail from last week, something was kept. AI 101 — What is AI memory? covers the mechanics; this piece is about what you can verify on paper and in a test.

1. Split the question in two before you open anything.

Training and retention are separate decisions with separate pages, separate settings and separate defaults. Write them as two columns. The trap is accepting an answer to one as an answer to the other, which is how a review passes a tool that keeps prompts for human review because the homepage says it doesn't train.

2. Establish which tier you're actually on.

The same logo sells you four different data policies: the free consumer app, a paid consumer plan, the API, and an enterprise contract — plus a fifth if you buy the model through a cloud provider. Anthropic publishes one article for its commercial products stating that inputs and outputs from Claude for Work and the API are not used for training by default, and a different article for consumer plans describing back-end deletion within 30 days of deleting a chat and up to five years of de-identified retention if you opt in to model improvement, per Anthropic's privacy center. Reading the wrong one is the most common way an audit goes wrong: the company is compliant with a policy it never bought.

Cloud resale adds a layer. Azure's documentation for the models it sells says prompts, completions, embeddings and your fine-tuning data are not available to other customers and not available to OpenAI or the model's provider, and are not used to improve those providers' models, per Microsoft's data privacy documentation. That is a strong training answer. It is not a zero-retention answer, which is the next move.

3. Find the exceptions page — the one that admits what stays.

Every major vendor has a page listing the features that retain data even when the headline policy says otherwise, and it is usually the least-linked page in the docs. Google's is explicit: grounding with Google Search logs queries derived from your prompts for up to three days with no way to disable the storage, grounding with Google Maps keeps prompts and outputs for 30 days, request-response logging exists but is off by default, and some advanced AI features make zero data retention impossible, per Google Cloud's zero data retention documentation.

So the unit of audit is the feature, not the vendor. A vendor with a spotless model-level policy can still keep your data because someone turned on a search tool, a session-resume option, or an implicit cache. When you read the exceptions page, look for the words that mean "cannot be disabled" and write those down as accepted risk, because they are exactly the ones your contract cannot fix.

4. Ask who can read it, not only how long it sits.

Retention windows are the easy half. Human review is the exposure. Azure's abuse-monitoring store holds flagged prompts and completions, is separated per customer resource, and is readable by authorized Microsoft employees through request identifiers and just-in-time approval — and customers approved for modified monitoring skip the storage and human review entirely, per the same Microsoft documentation. That last clause is the one to put in your vendor questions: not "do you review", but "can we be approved for modified monitoring, and how do we verify in the portal that it's on".

Then turn it inward. Who on your own team can read the prompts your product logs? An AI feature's biggest audience is usually internal, and the observability tool that captures every request is a second copy nobody put in the review. If an agent has access to that data too, the permissions question is the one in deciding what an AI agent may do — same discipline, applied to a machine reader instead of a human one.

5. Test it with a canary, using fake data.

Pick a nonsense phrase — eight random letters plus today's date — and send it in a prompt on a non-production account under the same contract tier you're evaluating. Then go looking for it: the chat history and account export, the vendor's activity logs if the plan exposes them, your own tracing tool, the retrieval index if the feature retrieves, and a brand-new conversation to see whether a memory feature volunteers the phrase back.

Three outcomes, all informative. It never appears anywhere: the retention story is the short one the docs describe. It appears in your own logs: fine, that copy is yours to delete, and now you know it exists. It reappears in a fresh session days later: a memory or caching layer kept it, and no clause about "requests" covers what a memory feature stores. Never run this with real customer data — a test that leaks a real record is the incident you were auditing against.

6. Write one row per tool, with a date, and re-check on renewal.

Six fields: tool, tier and contract, training yes or no, retention window, human review status, exceptions accepted. Six tools fit on one page. The date matters because vendor terms move quietly — a new grounding feature, a memory rollout, a change in abuse monitoring — and none of them announce themselves to you. Re-read the exceptions page when you renew, and again when a tool ships something that sounds like it remembers.

Don't do this: don't treat a compliance certificate as an answer. SOC 2 and ISO reports attest that a vendor has controls and that an auditor checked them. They do not tell you that your specific prompt, sent through your specific feature on your specific tier, is deleted in 30 days. That question has one source — the data processing terms plus the exceptions page, read together — and a certificate is not it.

How you'll know it worked: you can state the retention window and the human-review status for every AI tool touching customer data without opening a browser. Your canary never came back. You have a dated one-pager someone else on the team could defend in a customer security review. If any of those three is missing, the audit isn't finished — it's a policy you assumed, which is the thing you set out to stop doing.

Which surprised you more on your own stack — the retention window you found, or the feature that made zero retention impossible? Write to us via our contact page.