“We do not train on business data” is an important statement but does not answer how a vendor processes prompts, stores files, handles feedback or deals with exceptions.
Split the lifecycle into separate claims
Ask about training reuse, inference processing, content filtering, misuse monitoring, logging, backup retention, support access, connectors, and fine-tuning assets. A vendor can refrain from model training while still temporarily storing content to operate the service. A true procurement matrix gives each activity an answer and exact applicable contract version.
A dated first-party illustration
OpenAI’s January 8, 2026 enterprise privacy statement describes no model training on covered enterprise and API inputs or outputs by default and outlines API retention and eligible zero-data-retention options. That is a provider claim for specified offerings, not evidence that every OpenAI consumer feature or third-party connector follows identical controls.
Use a matrix, not a single checkbox
For each service, create columns for product, tier, endpoint, geography, training default, optional sharing, standard retention, negotiated retention, employee review, subprocessor disclosures and evidence URL. Enter “unknown” where official product-specific material is absent. Consumer subscriptions, enterprise agreements and API terms are not interchangeable.
How to test configuration and contracts
A buyer should inspect contract exhibits, admin settings and available audit controls for the precise account. Test approved dummy-data deletion and export workflows; do not upload sensitive production records merely to evaluate a privacy promise. Record the review date and designate a person to reassess changes to the contract or deployment topology.
Alternatives and limitations
If a team cannot prove required data controls in an external service, use offline data minimization, locally hosted models or non-AI workflows. This article contains one dated vendor example and a decision method, not an independently tested market-wide ranking or permanent pricing and retention comparison.
Sources & Further Reading
Jurisdiction/scope: Global procurement; OpenAI documented January 2026 example. This is educational information, not legal, medical or other professional advice. No hands-on product testing is claimed.