If you cannot answer this clearly, you should not sign yet
Ask the supplier whether your specific product and settings use customer inputs for training or fine-tuning, and require the answer in the contract or data-processing terms. Check retention and access separately.
Do not infer the answer from general security language. Ask what data is stored, what is used for model improvement, what is excluded and which controls apply to the specific product, environment and contract.
For professional services and regulated firms, the answer needs to address client confidentiality, audit records and responsibility for the data.
Do not assume customer data is excluded from training by default
Obtain the current terms for the intended feature, tier and configuration. Ask separately about training, tuning, evaluation, improvement, retention and access, and record the evidence supporting the approval decision rather than generalising across vendors.
Check the contract, technical settings and data flow design against the vendor's marketing claims.
Before adopting a tool, firms should confirm:
- whether prompts, uploads, outputs, and metadata are retained
- whether any of that data is used for model training or product improvement
- whether opt-out is available and already enabled
- whether different rules apply to free, standard, and enterprise tiers
- whether subprocessors or external model providers can access the data
- whether deletion, retention, and regional handling terms are clearly defined
If the vendor cannot answer those questions, keep the unresolved data handling in the procurement review.
Check data handling risk before AI rollout
What the right answer should look like in practice
Ask for a written answer that legal, technical and commercial teams can check against the same product and contract.
It should explain:
- what categories of customer data enter the system
- whether that data is ever used to train, fine tune, or evaluate models beyond the customer's own service instance
- what controls the customer has over retention and usage
- what logging and audit evidence exist
- what happens if a user enters confidential or restricted information by mistake
A vague answer such as we take privacy seriously is not enough. Neither is a link to a general policy page that avoids the operational detail.
Why this matters beyond privacy language
Data reuse can affect confidentiality, client contracts and the firm's ability to account for what happened to the data.
If customer data is used in ways the firm does not understand, several risks appear quickly:
- Confidentiality risk: sensitive client or internal information may be processed beyond intended boundaries.
- Regulatory risk: firms may fail to meet sector-specific obligations on data handling, record keeping, or oversight.
- Contract risk: client agreements may prohibit certain downstream uses of information.
- Reputational risk: even technically lawful use can damage trust if clients believe their data was handled carelessly.
- Governance risk: teams may deploy tools without knowing where accountability actually sits.
Include the question in procurement, legal and security reviews, and implementation planning.
Build AI governance around confidentiality and control
The vendor questions firms should ask directly
Ask the supplier:
- Is customer data ever used to train, fine tune, evaluate, or improve any shared model?
- If not, where is that commitment written in the contract or product terms?
- If yes, what data types are included and what controls exist?
- Can the setting be changed by administrators, users, or the vendor?
- Are there different data handling rules across API, workspace, and consumer products?
- What evidence can you provide for retention, deletion, and access controls?
Compare the answers with the product terms and settings; note anything that remains unclear.
How firms should handle this in implementation
Even when a vendor gives the right assurances, firms still need internal controls. Contract terms alone do not prevent risky usage patterns.
Before implementation, firms should decide:
- what kinds of customer data are allowed into the tool
- which teams can use it and under what conditions
- when anonymisation or redaction is required
- what review steps apply to sensitive use cases
- how logs and exceptions will be monitored
- what alternative path exists when data cannot be shared safely
Document how staff will apply those limits in the workflow.
A simple decision rule for buyers
If the vendor cannot clearly show that customer data handling matches your confidentiality, contractual, and governance requirements, pause procurement. A fast answer matters less than a precise answer you can defend later.
Record unanswered questions and resolve them before making the procurement decision.
Turn vendor answers into workable internal controls
Conclusion
Before adoption, obtain written answers about training use, retention, access and customer controls. Check that the contract terms, settings and data handling model support those answers.
If you cannot explain how customer data is handled, keep deployment on hold while you resolve the gap.
Need a safer AI route for your firm?
If this article reflects a live decision in your practice, the useful next step is to map the workflows, confidentiality risks, supplier controls and governance gaps before tools spread informally.
