Artificial intelligence7 minute read
Suppose you upload last year’s financial statements to an AI assistant and ask it to find the margin risks, or you paste in a lab report and ask what the numbers mean. The answer comes back in seconds.
Published
Suppose you upload last year’s financial statements to an AI assistant and ask it to find the margin risks, or you paste in a lab report and ask what the numbers mean. The answer comes back in seconds. What happens to the file afterwards depends on which product you used, which plan you pay for, what the vendor’s terms said on the day you uploaded it and what a court might later order that vendor to keep.
Reading those terms takes effort, and checking whether a vendor follows them is harder. Vendor marketing leans on a few phrases: enterprise grade, zero data retention, never used for training. A few of them describe controls that hold up when examined, while many describe a policy the vendor can revise or a setting someone has to remember to turn on. In 2025 one company’s commitment to delete user chats was suspended by a court order.
I build AI systems that handle this kind of data for growing companies, and the questions below are the ones I would want any business owner to ask before sending a vendor confidential material. The aim is to help you ask them precisely and judge whether the answers would hold up.
The large language models behind today’s assistants were trained on enormous collections of text, and a good share of that text was gathered without asking the people who wrote it. Web pages were scraped at scale. Books, news archives, code repositories, music and images went in, and in several documented cases the source was a piracy site.
Courts are now deciding whether that was lawful and what it will cost. A tracker run by the blog Chat GPT Is Eating the World counted 128 copyright suits against AI companies in US courts alone as of July 2026, with defendants that include OpenAI, Microsoft, Meta, Google, NVIDIA, Anthropic and Stability AI. The largest outcome so far is Bartz v. Anthropic. In June 2025 Judge William Alsup ruled that training on lawfully purchased books was fair use, but that downloading and keeping more than seven million pirated books was a separate matter. Anthropic settled for $1.5 billion, roughly $3,000 for each of about 482,000 eligible books, agreed to destroy the pirated files and received final court approval in July 2026. The New York Times’ case against OpenAI and Microsoft, filed in December 2023, was still in pretrial proceedings as of July 2026.
This history is why the first question to any AI vendor, whether your data will be used to train a model, needs a specific answer in the contract. The industry has repeatedly used data within its reach before the legal limits on doing so were settled.
Zero data retention, or ZDR, means the provider processes your request and keeps no copy of the prompt or the response once it has answered. It is usually offered to business customers who call the model through an API, often as a contract amendment that has to be applied for, and it sits alongside several weaker arrangements that sound similar: data deleted after 30 days, data kept but excluded from training, or chat history the user can switch off.
In May 2025 the difference between those arrangements was tested in court. In the New York Times litigation, Magistrate Judge Ona Wang ordered OpenAI to preserve and segregate ChatGPT output logs that would otherwise have been deleted, including chats users had deleted themselves and temporary chats designed to disappear. The order covered ChatGPT Free, Plus, Pro and Team users and API customers without a ZDR agreement. It did not touch ChatGPT Enterprise, ChatGPT Edu or API customers on ZDR endpoints, because OpenAI did not store their data and so had nothing to preserve. The broad obligation ended on September 26, 2025, though logs already preserved under it stayed preserved.
The court suspended OpenAI’s deletion commitments for consumer and standard API users and could not reach data OpenAI had never stored. The terms attached to a given product also change. In August 2025 Anthropic announced that it would train on chats from its consumer Claude plans for users who allowed it, with the option switched on in the prompt existing users were shown and up to five years of retention for those who agreed. Its business and API terms were left unchanged.
Most AI products a business buys are built on a model from one of a handful of providers, so a file you upload usually passes through at least two companies, and your contract is only with the first. The model provider’s ZDR terms, if they exist, are an agreement between your vendor and that provider. Whether your data benefits depends on what your vendor signed and how it built its product.
Along the way, a copy of your financial statement can land in any of these places:
ZDR at the model provider addresses the fourth item and, in part, the fifth. The other four are decided by your vendor, and they are where a careful buyer should spend most of their questions.
Send these in writing and ask for written answers. A vendor that handles sensitive data well will have most of the answers ready.
| Question | A useful answer | A warning sign |
|---|---|---|
| Is our data used to train or improve any model, yours or a provider’s? | No, stated in the contract and covering every provider you use, with no setting we have to change | “Not by default,” or an answer that lives only in a help article |
| Which model providers process our data, and what retention terms do you hold with each? | Named providers, the retention period or ZDR status for each, and the contract clause on request | “We use leading enterprise models” without names |
| What do you store, where, and for how long? | A list covering files, chat history, search indexes and logs, with a retention period for each | “Your data is encrypted,” offered as the whole answer |
| When we delete something, what is actually removed? | A process that reaches indexes, logs and backups, with a deadline and written confirmation | Deletion only from what we can see in the interface |
| Do your logging and monitoring tools capture the contents of our requests? | No, with the configuration to show it, or yes, kept for a stated period with restricted access | Uncertainty, or a promise to check later |
| Which people can see our data, and when? | Named roles, access recorded, human review only with our permission | “Only when necessary” |
| What happens if you receive a subpoena or court order for our data? | Notice to us unless the law forbids it, and a clear account of what data exists to be produced | No policy |
| Where is our data processed and stored? | Named regions, fixed in the contract | “In the cloud” |
| What happens to our data if you are acquired or shut down? | Return or deletion written into the contract | Nothing in the contract |
| Can you show us, rather than tell us? | Willingness to run a test with marked data and share the results (next section) | A security certificate whose scope does not include the AI system |
You cannot inspect a vendor’s servers, but you can ask for evidence that a well-run vendor can produce with little effort.
Run a marked-data test. Make up a document that looks real but contains values that exist nowhere else: an invented company name, a fictitious account number, a nonsense project code. Run it through the tool the way your team would, then delete it. A week later, and again after 30 days, ask the vendor to search its application database, search indexes, logs and monitoring tools for those values and tell you in writing where they turned up. Being able to run the search at all shows the vendor knows where your data is kept.
Read the scope of the security report. SOC 2 and ISO 27001 reports are common and worth having, but each covers a defined set of systems over a defined period. Ask whether the AI features and the model providers are inside that scope. AI features added since the last audit period will not be.
Ask for the provider’s side in writing. If the vendor says its model provider applies ZDR, ask for the clause, a letter from the provider or a screenshot of the account setting. ZDR is typically something a provider must approve for a specific account, so the vendor should be able to show it for its own account.
Check your own side. Open the admin settings of every AI tool your company pays for and confirm that training is off and retention is set to the shortest period available. Then look at what your people actually use. A business plan with strong terms protects nothing if a controller pastes the quarterly numbers into a personal account on a consumer plan, which runs under different terms.
Match the arrangement to the data. Routine marketing drafts carry little risk. Patient records, payroll, deal documents and unreleased financials justify either a provider-level ZDR arrangement you have verified or a model that runs inside your own cloud account, where no outside company sees the data at all. Sorting each workflow into one of those categories before talking to vendors tells you which of the questions above matter most.
At thinkbridge, we follow a zero data retention policy whenever we use AI, on our own work and on client projects. The details are in the Zero data retention for AI section of our security page.
Tell us what is holding your operations together. thinkbridge will show you what it looks like built right.