Resource · Security questionnaires
Will your AI vendor train on your data?
Security questionnaires ask it. Some vendors say no in writing. Some offer a switch you have to find.
Here’s what each one says, word for word.
AI vendors say in writing they won't train on customer data.
offer an opt-out: training happens unless you switch it off.
of the 186 vendors we watch are on neither list: we couldn't quote a position either way.
8 of the 29 commitments carry a carve-out in the same sentence: “unless,” “except,” “subject to.” Quote the whole sentence to a customer, not the first half.
A promise and a switch read differently.
One says training doesn’t happen. The other says it does unless you turn it off. Both are real, from the lists below.
A commitment · LogicMonitor
“Customer-provided data is never used to train any AI model.”
www.logicmonitor.com/legal/data-handling-supplement · read Oct 29, 2026
An opt-out · Cohere
“Opt out of model training at any time — your data stays yours.”
cohere.com/security · read Nov 2, 2026
There’s no list here of vendors that do train.
A sentence saying a vendor won’t train is explicit and quotable. A sentence saying it will is almost never written that way.
What exists instead is a broad license to “improve the Services.” Reading training into that is inference, not reporting.
So a vendor missing from both lists means one thing: nothing on the pages we read states a position we could quote. 152 of the 186 vendors we watch are in that position. Ask them directly rather than assuming either answer.
Find your vendor.
Commitments first, then opt-outs. Every sentence links to the page it came from.
Says it won't train on your data
29 vendorsAdobe
“This license does not give us permission to train generative AI models with your or your customers’ content.”
adobe.com/legal/terms · read Oct 27, 2026
AI21 Labs
“Consistent with our Terms of Service, and unless otherwise agreed in writing or required to provide the Services, we do not use your inputs or outputs to train AI21’s foundational or generally available AI models.”
ai21.com/privacy-policy · read Oct 17, 2026
AlphaSense
“We do not use customer personal data, customer-provided content, or personal data processed on behalf of customers to train generally available generative artificial intelligence models or large language models, except where expressly agreed with the customer.”
alpha-sense.com/privacy-policy · read Oct 10, 2026
Alteryx
“We do not use your personal information to train artificial intelligence models, meaning we do not collect or use your personal information for the purpose of training Artificial Intelligence Large Language Models (each, an “LLM”).”
alteryx.com/privacy · read Oct 27, 2026
Anthropic
“Anthropic may not train models on Customer Content from Services.”
www.anthropic.com/legal/commercial-terms · read Oct 27, 2026
Anysphere
“We do not use Inputs or Suggestions to train our models, or permit third parties to use them for training, unless: (1) they are flagged for security review (in which case we may analyze them to improve our ability to detect and enforce our Terms of Service), (2) you explicitly report them to us (for example, as Feedback), or (3) you’ve explicitly agreed …”
cursor.com/privacy · read Oct 20, 2026
Baseten
“Consistent with the Agreement, Baseten will not use Customer Personal Data to train, fine-tune, or otherwise develop machine learning or artificial intelligence models.”
baseten.co/dpa · read Oct 30, 2026
BigPanda
“We strictly control access and adhere to OWASP security standards for AI, including committing to never using customer data to train our models.”
www.bigpanda.io/our-product/bigpanda-security/ · read Sep 2, 2026
Chroma
“Unless expressly permitted by Customer, Chroma will not use Customer Data to train the artificial intelligence or machine learning models.”
trychroma.com/terms · read Aug 31, 2026
Cohere
“The data remains within the enterprise customer’s or the third-party cloud provider’s controlled environment and is never accessible to or used by Cohere (for example, we do not train our models on it).”
cohere.com/privacy · read Nov 2, 2026
Cyera
“We do not use Google User Data, whether raw, aggregated, anonymized or derived, to create, train or improve foundational or generalized artificial intelligence or machine learning models.”
cyera.io/privacy · read Oct 30, 2026
Eightfold AI
“The Eightfold platform does not use identifiable customer data to train its models.”
eightfold.ai/security · read Nov 1, 2026
Fireflies.ai
“(ii) will not use your User Content to train, retrain, fine-tune or otherwise improve any generative artificial intelligence models.”
fireflies.ai/terms-of-service · read Sep 30, 2026
GitLab
“However, we will not use your AI-inputs to train any language models without your instruction or prior consent.”
about.gitlab.com/privacy · read Oct 28, 2026
H2O.ai
“Customer-provided input data, metadata, and model data are not used to train H2O.ai AI models, unless explicitly agreed in writing.”
h2o.ai/privacy · read Oct 17, 2026
Hebbia
“We do not use Personal Data contained in Customer Data to train or improve generalized or third-party artificial intelligence or machine learning models.”
hebbia.com/privacy · read Oct 23, 2026
Insider
“Insider One shall not use any Customer Data—including prompts, inputs, AI Outputs, or other Personal Data—for the purpose of training, fine‑tuning, or otherwise developing or improving any artificial‑intell…”
useinsider.com/legal/dpa · read Oct 12, 2026
Landing AI
“Data Usage: Customers with the ZDR Option:** Your data is never used for training or improving our models.”
landing.ai/security-at-landingai · read Oct 1, 2026
LangChain
“LangChain agrees that it will not use Customer Data to train on, develop, or otherwise improve its products, including any large language models. 4.3 Operational Metadata.”
langchain.com/terms-of-service · read Sep 11, 2026
Lindy
“Lindy and our providers do not use your data to train AI models.”
lindy.ai/security · read Oct 31, 2026
LiveKit
“We have opted out, on your behalf, of any use of Voice Samples (including any biometric data contained in them) by those inference providers for training, fine-tuning, or other improvement of their models; we likewise do not use Voice Samples to train our own models.”
livekit.io/legal/privacy-policy · read Oct 30, 2026
LogicMonitor
“Customer-provided data is never used to train any AI model.”
www.logicmonitor.com/legal/data-handling-supplement · read Oct 29, 2026
Lovable
“Lovable shall not use any Customer Personal Data for the purpose of training, retraining, fine-tuning, or otherwise developing any Artificial Intelligence (AI) or Machine Learning (ML) models.”
lovable.dev/data-processing-agreement · read Oct 30, 2026
Microsoft
“Important Your prompts (inputs) and completions (outputs), your embeddings, and your training data: - are NOT available to other customers. - are NOT available to OpenAI or other providers of Models sold by Azure. - are NOT used by providers of Models sold by Azure to improve their models or services. - are NOT used to train any generative AI foundation models without your permission or instructi…”
learn.microsoft.com/en-us/azure/foundry/responsible-ai/openai/data-privacy · read Sep 30, 2026
Modal
“Modal will not, except with Customer's prior written consent: (i) train any AI model using Customer Data, or (ii) export Customer Data into, or cause Customer Data to be ingested by, large language models.”
modal.com/legal/terms · read Nov 1, 2026
Nebius
“Nebius Token Factory does not use Customer Content to train, fine-tune or improve models for Nebius or any third party, except as directed by the Customer to perform a Customer-requested fine-tuning or post-training operation.”
docs.nebius.com/legal/dpa · read Oct 27, 2026
Notion
“No customer data for AI training User data is never used to train or influence Notion AI models.”
trust.notion.com/subprocessors · read Nov 2, 2026
Rev
“Customer Content will not be used for any generative AI model training.”
rev.com/legal/terms · read Nov 1, 2026
Speechmatics
“Speechmatics will not use Your inputs, outputs or any other data for machine learning or model training purposes unless You opt in by enabling model training within Your portal workspace.”
speechmatics.com/terms-of-service · read Oct 10, 2026
Offers a switch
8 vendorsA switch isn’t a promise. Training happens unless you turn it off, so the default matters, and so does whether anyone at your company knows the setting exists.
Anthropic
“We may use Materials to provide, maintain, and improve the Services and to develop other products and services, including training our models, unless you opt out of training through your account settings.”
anthropic.com/terms · read Oct 27, 2026
AssemblyAI
“For information on how to opt-out of AssemblyAI’s use of Customer Data for purposes of training its artificial intelligence and machine learning models (to the extent applicable to Customer’s pricing plan), please visit: [https://www.assemblyai.com/docs/faq/how-to-opt-out-of-data-sharing-for-our-model-improvement-program](https://www.assemblyai.com/docs/faq/how-to-opt-out-of-data-sharing-for-our-…”
assemblyai.com/terms · read Oct 20, 2026
Codeium
“After you opt out, your data will not be used for training and Zero Data Retention will be enabled with our model providers.”
windsurf.com/security · read Oct 28, 2026
Cohere
“Opt out of model training at any time — your data stays yours.”
cohere.com/security · read Nov 2, 2026
HubSpot
“If you opt out, we will no longer collect Customer Data to train our AI models, unless you later update your settings and opt in.”
hubspot.com/terms-of-service · read Oct 10, 2026
Lovable
“You may tell us at any time that you do not want your Customer Data used for model training or the other business purposes described above, and we will honor that request for prospective use, free of charge and regardless of your plan.”
lovable.dev/terms · read Nov 1, 2026
OpenAI
“If you do not want us to use your Content to train our models, you can opt out by following the instructions in this article.”
openai.com/terms · read Oct 29, 2026
Zapier
“Does Zapier use customer data to train AI models? Enterprise customers are automatically opted out of data training, and customers on other plans can opt out of data training by filling out this form.”
zapier.com/security-compliance · read Sep 28, 2026
Says it about other data
8 vendorsThese say no about something narrower than your data with this vendor: one kind of data, one connected app, or another company’s models. That’s why they aren’t on the first list.
Ada
“Ada does not use identifiable end-user data from Meta Platform Services to train public AI models.”
ada.cx/legal/privacy-policy · read Oct 11, 2026
Camunda
“No Model Training on Applicant Data: Your personal data is not used to train or improve the AI model.”
camunda.com/privacy · read Oct 30, 2026
Elastic
“Data collected from these marketing campaigns is not used by our third-party vendors to train their own generalized AI models.”
elastic.co/privacy · read Oct 15, 2026
Glean
“Training Data Restrictions**: While using Glean's OpenAI/Azure OpenAI key, customer data will not be used to inform or train Azure OpenAI/OpenAI's generative AI model.”
www.glean.com/website-terms · read Oct 20, 2026
Lovable
“Data made available to us by a messaging or collaboration platform you connect is used only to operate the integration and generate responses; we do not use it to train AI models.”
lovable.dev/privacy · read Oct 30, 2026
Otter.ai
“No Customer Data will be used to train or improve Anthropic’s artificial intelligence models.”
otter.ai/subprocessors · read Oct 28, 2026
Spellbook
“Customer Data transmitted to Third Party LLMs via the Spellbook AI Platform will not be used to train, improve, or develop the AI models of those Third Party LLMs.”
spellbook.legal/terms-of-service · read Oct 18, 2026
xAI
“Google Apps Using Google OAuth**: For users who opt to connect to Google Apps via Google OAuth, SpaceXSI shall not use any Google Apps content for any of its internal AI or other training purposes (such as training its machine learning models), including developing new products or services…”
x.ai/privacy-policy · read Oct 25, 2026
What to ask for at renewal.
Three things separate a commitment you can hand a customer from one you can’t.
Which data it covers.
Several of these name customer content and say nothing about prompts, outputs or metadata.Whose models it binds.
The vendor's own, its third-party model providers, or both. They're drafted separately, and a vendor can promise one and not the other.Where it's written.
In the agreement or on a trust page. A page can be edited without anyone telling you; a clause can’t.
Download the training list.
Both lists as a Word document, with every quote, source and read date. It’s generated when you download it, so it matches what the vendors’ pages say that day.
How we read these.
Quoted with its source.
Each statement comes from a page the vendor publishes, with the URL and the date we read it.One statement at a time.
Where a clip ran several statements together, only the one carrying the commitment is shown. No words changed, nothing joined.Every sentence read on its own.
Our extractor files each sentence as yes or no. That label is unreliable both ways: it filed one of the plainest refusals as yes. So this page ignores it.
Common questions.
Which AI vendors do not train on customer data?
The vendors publishing a commitment we could quote are on this page, in their own words. A vendor missing from the list hasn't been found to train on customer data. It means nothing on the pages we read states a position we could quote.
Does my AI vendor train on my data?
Check whether it has published a commitment not to, and what that covers. Vendors that do train rarely say so in those words. What appears instead is a broad license to “improve the Services,” a different sentence that shouldn't be read as one.
What is the difference between an opt-out and a commitment not to train?
A commitment says training doesn't happen. An opt-out says it happens unless you turn it off, so the default is what matters and the work is yours. Both are listed here, separately.
Do these commitments cover prompts and outputs as well as content?
Read each sentence. Several name customer content and say nothing about prompts, outputs or metadata. The ones that cover all of them say so explicitly. The wording quoted here is the vendor's own.
Does a no-training commitment cover third-party model providers?
Not automatically. A vendor's own models and the model providers it routes to are drafted separately, and a vendor can commit for one and not the other. Several of the quotes below name which they mean.
Answer a questionnaire
More for this job.
- GuideAnswering “list every AI sub-processor”What the question asks, where each answer is published, and what to say about gaps.Open it ›
- DatasetWhich certifications AI vendors claimSOC 2, ISO 27001, ISO 42001 and more, as each vendor's trust page states them.Open it ›
- DatasetHow long AI vendors keep your dataEvery retention window we can quote, grouped by vendor.Open it ›
- TemplateSecurity questionnaire answersEight AI questions customers ask: a good answer for each, and what to attach.Open it ›
- ChecklistAI supply-chain question set29 questions to put to an AI vendor about its own supply chain.Open it ›
- DatasetWhere AI vendors say they keep your dataResidency commitments and transfer disclosures, kept apart: they look alike and mean opposite things.Open it ›
This is not legal advice. The pages quoted are published documents read on the dates shown; your negotiated contract governs over anything here. Everything on this page is free to read, and corrections are free to request.