Will a large-model provider retain or train on our application's data?
An external model provider necessarily processes the prompts, retrieved passages, files, and tool arguments sent to its API. Whether that content is used for training, how long it is retained, where it is processed, and who can access it depend on the exact product, endpoint, account settings, and contract. RAG may keep the full source repository under company control, but the passages selected for an answer still enter the model request. Minimize and de-identify sensitive data; if no original content may leave the controlled environment, evaluate a local or dedicated deployment.
| Mode | Main advantage | Main risk | Default position |
|---|---|---|---|
| Consumer chat account | Immediate access | Enterprise retention, audit, and training choices may be unsuitable | Do not submit client data, secrets, or sensitive operations |
| Enterprise API/workspace | Contract account, administration, integration, and clearer data controls | Endpoint state, region, tools, and subprocessors still need review | Starting point for most enterprise applications |
| Local or dedicated model | Content need not go to a public API | Compute, quality, vulnerabilities, supply chain, and operations shift to the enterprise | Use for a proven non-egress requirement and viable operations |
When translating compliance duties into evidence and controls, also compare How should a privacy-intensive app operating internationally protect its users? and What compliance support can a software development provider deliver?; the linked guidance adds context that should be considered in the same decision.
Local deployment is not automatically secure: model updates, telemetry, operators, external tools, logs, and backups can still create paths outward. A governed enterprise API may be safer than employees independently using several free chat tools. Decide from data classification, contractual restrictions, measured task quality, and total cost.
In a typical RAG flow, documents remain in controlled storage, the application retrieves a few passages, and those passages and the user's question go to the model. Uploading files to a provider's file or vector-storage feature may instead create persisted application state with separate deletion rules. Remove unneeded names, contacts, identifiers, accounts, medical details, and trade secrets before sending. Apply user authorization before retrieval, not after showing the model company-wide data. Include caches, observability, error reporting, moderation, remote MCP servers, search, and tools in the same recipient register.
OpenAI's official API data controls, rechecked on 26 August 2026, state that API data is not used to train or improve models by default unless the customer opts in. Default abuse-monitoring logs may contain prompts and responses and are generally retained for up to 30 days; eligible customers can apply for Modified Abuse Monitoring or Zero Data Retention. Some endpoint features—such as conversations, files, and vector stores—can retain application state until deletion, while Responses storage also depends on endpoint behavior, parameters, and account controls.
Those statements apply to current OpenAI API controls, not every ChatGPT product or another vendor. Even a zero-retention approval requires checking feature support, file or image exceptions, third-party tools, processing region, and legal retention. Wavesteam records training use, retention, persistent state, deletion, region, subprocessors, human access, encryption, incident terms, data-subject assistance, termination handling, and extra tool/log flows against official evidence, product version, and review date.
For personal information processed in China, the real data flow determines controller/processor roles, disclosure to other processors, and any cross-border path under the Personal Information Protection Law. “Not used for training” is not complete compliance; qualified advisers and the client confirm legal conclusions.
Acceptance captures outbound requests to verify fields, endpoint, domain/region, and tools; checks where prompts, responses, embeddings, files, caches, logs, and backups persist; and tests role isolation and deletion using synthetic identifiers and secrets. Wavesteam delivers the data-flow map, endpoint and supplier register, retention settings, de-identification rules, and unresolved assumptions. The provider remains responsible for its platform and terms, and no developer can promise absolute non-disclosure beyond those controls.