AI, data and trust
Does Your Data Train the Model? The Answer Depends on the Tier, Not the Vendor
No, if you are on a paid business or API tier. Anthropic, OpenAI, Google and all three major clouds commit by default not to train on data sent through their business products, and OpenAI has done so since March 2023. The fear almost always comes from consumer terms that do not govern what you are buying. The real trap is narrower and sharper: Google's free Gemini tier permits human review of your inputs on the same endpoint as the paid one.
We do this for clients:RAG Systems DevelopmentAI Prompt Engineering
The question is asked in the wrong units
Nearly every security review we have been through asks some version of "do you use OpenAI?" It is the wrong question, and it cannot be answered usefully, because the same company applies opposite defaults to two different products.
One OpenAI document states both halves. For consumer products: "When you use our services for individuals such as ChatGPT, Codex, and Sora, we may use your content to train our models." For business: "By default, we do not train on any inputs or outputs from our products for business users, including ChatGPT Business, ChatGPT Enterprise, and the API."
Consumer is opt-out. API is opt-in. Same vendor, opposite defaults. So the question that actually determines the answer is not which company you are using, but which product, which tier, and whether it is being billed.
Where each provider stands, by tier
Read from each provider's own terms on 11 September 2026. "Trains by default" is the question a buyer is actually asking.
| Product | Trains on your data by default? | What governs it |
|---|---|---|
| Anthropic API and Claude for Work | No | Commercial Terms, effective 17 June 2025 |
| Claude consumer (Free, Pro, Max) | User selects; not automatic | Consumer terms, updated 28 August 2025 |
| OpenAI API | No, since 1 March 2023 | API data controls documentation |
| ChatGPT consumer | Yes, unless you opt out | OpenAI data usage help article |
| ChatGPT Business and Enterprise | No | Enterprise privacy page |
| Gemini API, paid tier | No | Gemini API terms, effective 23 March 2026 |
| Gemini API, free tier | Yes, and humans may read it | Gemini API terms, effective 23 March 2026 |
| AWS Bedrock, Vertex AI, Azure OpenAI | No | Each cloud's service terms |
What "by default" is doing in those sentences
Every one of these commitments is phrased as a default, and a default implies something that is not the default. It is worth knowing what flips it, because the flip is usually something a developer does casually.
The recurring exception is feedback. OpenAI states that "if you choose to provide feedback, the entire conversation associated with that feedback may be used to train our models", and Anthropic applies the same treatment to thumbs-up and thumbs-down. A developer clicking a rating button in a console is a genuine disclosure path, and it is not covered by the opt-out.
If your application handles anything sensitive, the feedback UI is something to govern deliberately rather than to ship because the framework included it.
Training and retention are different questions
These get conflated in security reviews constantly, and they have different answers.
Nobody trains on your API data by default. Almost everybody retains it for around 30 days for abuse monitoring: Anthropic states it deletes inputs and outputs "within 30 days of receipt or generation", and OpenAI retains API data "for up to 30 days".
So a buyer who says "we need you to not keep our data" is asking the harder question. Both Anthropic and OpenAI offer zero data retention, and neither offers it as a setting. OpenAI states these controls are "subject to prior approval by OpenAI and acceptance of additional requirements"; Anthropic's is "subject to Anthropic's approval" and applied per organisation.
That matters for your timeline rather than your architecture. If a security questionnaire assumes zero retention is a checkbox, correct it early, because the approval sits on the critical path.
If you need the paperwork rather than the promise
Some buyers cannot act on a vendor help page, and need something their legal team can hold. The cloud route is usually the shortest path, because the contract is already signed.
AWS states that "AWS and the third-party model providers will not use any inputs to or outputs from Amazon Bedrock to train Amazon Nova, Amazon Titan, or any third-party models". Google Cloud's Service Specific Terms carry a Training Restriction clause: "Google will not use Customer Data to train or fine-tune any AI/ML models without Customer's prior permission or instruction." Azure states that prompts and completions "are not used to train, retrain, or improve the base models".
Azure adds something the others do not: a way to check. Microsoft documents that the content logging setting can be read back from the portal or the CLI, so the control is auditable rather than merely promised. If you are answering a questionnaire that asks how you would verify the claim, that is a real answer.
Anthropic's own consumer announcement names this boundary explicitly, stating that its consumer changes do not apply to "API use, including via third parties such as Amazon Bedrock and Google Cloud's Vertex AI".
What to actually check before you approve a build
Five questions. They take an afternoon and they replace a generalised worry with a specific answer.
- 1
Name the exact product and tier
Not "OpenAI" or "Google" but which endpoint, on which plan, billed to which account. This single question resolves most of the anxiety, because the business tiers almost all commit not to train.
- 2
Confirm every environment is billed
Production, staging and CI. A free-tier key in a test pipeline is still processing real data if your test fixtures contain any, and on Gemini the free tier is where human review lives.
- 3
Decide what happens to feedback
If the application has thumbs-up and thumbs-down, establish whether pressing it sends the conversation to the provider for training. Disable it or govern it if the content is sensitive.
- 4
Separate the retention ask from the training ask
If you genuinely need zero retention rather than no training, start that approval now. It is not a setting, it requires the provider's sign-off, and it will otherwise surface late.
- 5
Get the DPA in place
Anthropic incorporates its DPA with Standard Contractual Clauses automatically into its commercial terms. OpenAI executes one via a form. The clouds cover it under the existing agreement. None of these is a negotiation for a normal buyer.
The honest summary
If you are buying an API-based build from anyone competent, your data is not training anyone's model, and that has been true of the OpenAI API since March 2023 and is written into Anthropic's commercial contract rather than its marketing.
What deserves your attention is narrower: that free tiers on the same endpoints can carry entirely different terms, that feedback buttons are a real exception, and that retention is a separate and slower ask than training.
Those are answerable in a morning, and they are worth more than a general assurance from anyone, ourselves included.
What this does not cover
- Terms as they stood on 11 September 2026. These documents are revised regularly and each carries its own effective date, given above.
- OpenAI's pages could not be retrieved live: both openai.com and help.openai.com returned 403 to every route tried. Those quotes come from archived captures of OpenAI's own pages, which is primary content but not a live read, and worth re-checking in a browser.
- This is not legal advice, and a security review that actually matters should read the operative agreement rather than a summary of it, including this one.
- Self-hosted and open-weight models are mentioned but not compared here. That is a different post and a genuinely different trade.
Sources
Every figure above comes from one of these, read on the date shown. Prices change: if you are reading this long after that date, check before you rely on it.
- Anthropic Commercial Terms of Service
That Anthropic may not train on customer content from its commercial services.
Read 11 September 2026
- Anthropic, updates to consumer terms
The consumer training choice, and that it does not apply to API use including via Bedrock and Vertex.
Read 11 September 2026
- OpenAI API data controls
That API data is not used for training since 1 March 2023, the 30-day retention, and the zero-retention approval requirement.
Read 11 September 2026
- Google Gemini API terms of service
The different paid and unpaid tier data regimes, including human review on the unpaid tier.
Read 11 September 2026
- AWS Bedrock FAQs
That inputs and outputs are not used to train any models and are not shared with model providers.
Read 11 September 2026
- Google Cloud Service Specific Terms
The section 18 Training Restriction clause for Vertex AI.
Read 11 September 2026
- Microsoft Learn, Azure AI Foundry data privacy
That prompts and completions are not used to train base models, and the auditable content logging setting.
Read 11 September 2026
Questions
The questionspeople ask
Does OpenAI train on API data?
No. OpenAI states that "as of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us)". The opposite is true of consumer ChatGPT, where content may be used for training unless you opt out, which is the source of most of the confusion.
Is the free Gemini API tier safe for production?
No, if your data is sensitive. Google's terms state that on the unpaid tier it uses submitted content "to provide, improve, and develop Google products and services" and that "human reviewers may read, annotate, and process your API input and output". The paid tier commits the opposite way. Run production, staging and CI on a billed project.
What is the difference between not training and zero retention?
Training is whether your data improves the model. Retention is whether it is stored at all. Business tiers do not train by default but do retain for around 30 days for abuse monitoring. Zero retention is a separate arrangement requiring the provider's prior approval at both Anthropic and OpenAI.
Does using AWS Bedrock or Azure change the answer?
It mostly changes the paperwork rather than the outcome. All three major clouds state that customer data is not used to train the underlying models, and the advantage is that the data processing terms are already part of an agreement you have signed. Azure additionally documents how to verify that content logging is disabled.
Can we run a model ourselves and avoid the question entirely?
Yes, and that is the right answer for some corpora. A self-hosted open model means nothing leaves your infrastructure, at the cost of running the infrastructure and generally accepting weaker output than the frontier models. It is a real trade rather than a free win, and it should be settled before anything is indexed rather than after.
Need this answered for a specific build?
We settle the data question at the corpus review stage, before anything is indexed, because it changes the architecture rather than the paperwork. If you have a security review asking these questions, we have answered them before.