Learn · AI for leaders
Where does your data go when you ask AI?
A contract pasted into an assistant can train a public model, sit in a vendor’s review log for 30 days, or stay inside your building. Switch how the model is reached and see where each file goes.
Free lesson, about five minutes. Updated
Stops your document reaches
- Your audit log
- Outside your building
- Vendor memory
- 30-day vendor log
- Model training
Six files a team pastes into AI
- Public press release draftSafe to use here
- Internal sales notes and meeting recapSafe to use here
- Board deck and unannounced M&A numbersKept 30 days at vendor
- Client tax return or contract under NDAKept 30 days at vendor
- Patient chart under HIPAANeeds zero retention and BAA
- Defense drawings under ITAR or CMMCLeaves your building
- Setup
- Business planvendor’s cloud
- Vendor keeps it
- 30 daysdoes not train model
- Safe to paste
- 2 of 6of these files
- Your audit log
- YesIT sees who asked
-
1 PredictWhat happens on a standard business plan?
Your company buys a standard business plan for an AI assistant. Someone pastes a client contract under a strict non-disclosure agreement into a chat. What happens to that file on the vendor’s side?
Pick one first. A guess that turns out wrong teaches the most.
Locked in. Now test it.
-
2 TrySwitch how your team reaches the model
Move between the four setups below and watch which stops light up and which files become safe to paste.
How the model is reached
- Vendor keeps it
- 30 days
- Safe to paste
- 2 of 6
-
3 ObserveWere you right?
Commit to a prediction first.
-
4 ExplainWhy does it come out this way?
NoTraining and Zero Data Retention are two different settings. Buying a standard business plan turns off model training, yet the vendor still keeps prompts and file attachments for up to 30 days in safety and abuse logs by default.
For client contracts, board decks and patient records, you need Zero Data Retention enabled on the account or an instance running in your own cloud VPC so prompts are wiped as soon as the answer returns. For defense drawings or air-gapped work that cannot leave your network at all, the model weights run on hardware inside your building.
-
5 ApplyA new case
A law firm wants an assistant to search and summarize client litigation files. Their engagement letters promise that client files are never stored on third-party servers after a session ends. Which setup is the lightest one that keeps that promise?
Turning off training is not enough when the engagement letter forbids third-party storage. A standard business plan still holds prompts for up to 30 days unless zero retention is turned on.
Right. Under a Zero Data Retention agreement or inside the firm’s own cloud account, the model reads the file in memory to write the summary and discards it the moment the answer is sent.
Hardware in their building works too, though it costs more to run. Unless the firm has a strict rule that files cannot cross a wire at all, Zero Data Retention in their cloud meets the promise.
The rules behind the figure
- Personal accounts on free or consumer plans reserve the right to review conversations and train future models on them unless the user opts out, and give your company no audit log.
- Standard business plans turn off training on your prompts and add single sign-on and an admin log, while keeping prompts up to 30 days for abuse monitoring by default.
- Zero Data Retention (ZDR) is a separate contractual setting on enterprise accounts, API endpoints and cloud VPC deployments (such as AWS Bedrock, Azure OpenAI and Vertex AI) that deletes prompts from vendor memory as soon as the response is returned.
- Your own building runs open-weight models on servers inside your facility or air-gapped enclave so nothing crosses an external network.
- Read the full comparison of vendor retention terms in our research note on Zero Data Retention and enterprise AI governance.
AI for leaders
Five lessons on what AI is, where the money is, and what has to be true first.
- 1Why does the same question get different answers?5 minutes
- 2What is one workflow worth?5 minutes
- 3Why can’t AI answer questions about your own business?5 minutes
- 4Where does your data go when you ask AI?This lesson
- 5What does AI cost to run?5 minutes