Do Cloud AI Providers Train on Your Business Data?

The same Claude model can be covered by two different sets of rules. In August 2025 Anthropic told users of its consumer Free, Pro and Max plans that they would choose whether their chats are used for model training, and that choosing yes extends retention from 30 days to five years. The same announcement said the change does not apply to anything under its Commercial Terms: the API, Claude for Work, and access through Amazon Bedrock or Google Cloud's Vertex AI. So the honest answer to "do AI providers train on your data" is that it depends on which door the data walked through, and on a few clauses most people never read.

This guide is a reading method. It shows which five questions to put to any provider's data-use terms, with examples taken from terms published by OpenAI, Anthropic, Google and Microsoft as of October 2026. Terms change, so check the live pages before relying on any example. This is general information, not legal advice.

The tier decides more than the vendor

Large providers sell two kinds of service. Consumer apps are bought by individuals on personal accounts. Commercial services (API access, team and enterprise plans, cloud marketplace access) are bought by an organization under a separate agreement, usually with a data processing addendum.

The training rules tend to split along that line:

Service	What the published terms say about training
Anthropic consumer plans (Free, Pro, Max)	User chooses; if training is allowed, retention is five years
Anthropic API and commercial plans	Not covered by the consumer training change
OpenAI API	Not used to train or improve OpenAI models unless the customer opts in
Gemini API, unpaid tier	Content used to provide, improve and develop Google products; human reviewers may read it
Gemini API, paid tier	Prompts and responses not used to improve Google products
Models sold by Azure in Microsoft Foundry	Not used to train foundation models without the customer's permission or instruction

Sources for the rows: OpenAI's data controls guide, the Gemini API terms (last updated April 2026), and Microsoft's Foundry data privacy page listed in this article's sources.

A staff member on a personal account is under consumer rules even when the work is company work. A business plan bought for the team does nothing for a prompt typed into someone's own free account, which is why the quiet use of personal chatbots, covered in the article on staff pasting company data into chatbots, is mostly a training-terms problem.

Five questions to put to any data-use terms

Read the provider's privacy page, its API or enterprise data page, and the data processing addendum, then answer these five questions in writing. If a question has no answer on any page, that gap is itself an answer.

1. Is training off by default, and who can turn it on?

"Opt-in" means nothing is used until someone acts. "Opt-out" means data is used until someone acts, and the person who must act may be each individual user rather than an administrator.

OpenAI's API guide says API data is not used for training unless the customer explicitly opts in to share it. Anthropic's consumer change put the choice on each individual user. For a company, that model means training exposure depends on what dozens of people clicked, which is hard to audit.

2. How long is data kept, and what extends the clock?

Retention decides how much sits on someone else's disk on any given day. Find the default window, then every exception.

Anthropic's page on organization data shows why the exceptions matter. API inputs and outputs are deleted within 30 days by default. Content flagged under the Usage Policy is kept for up to 2 years, trust and safety classification scores for up to 7 years, and data attached to a feedback submission for 5 years. Almost every provider adds "or as required by law", which means a court order or legal hold can override the stated window.

A rolling window turns into a standing inventory, and the arithmetic is simple. Take a 25-person firm whose integration sends 400 requests a day to an API with a 30-day retention window. On any given day, up to 400 x 30 = 12,000 requests are held by the provider. If each request averages 3,000 characters of contract text, that is 12,000 x 3,000 = 36 million characters of client material stored outside the building at all times. A zero-retention agreement would cut that to near zero; a 7-day window would cut it to 2,800 requests.

3. Who can read prompts for abuse monitoring?

"Not used for training" does not mean "never seen by a person." Most commercial services scan prompts for misuse, and some send flagged samples to human reviewers.

Microsoft's page for models sold through Azure is unusually specific. Automated review runs by default; human reviewers, described as authorized Microsoft employees, can access prompts and completions only when they have been flagged or form part of a potentially abusive pattern. Customers who are approved for modified abuse monitoring do not get the human review data store, although automated review may still run. Microsoft documents how to confirm the change: a ContentLogging capability set to false appears on the resource.

On the unpaid Gemini API tier, Google's terms say human reviewers may read, annotate and process API input and output, after the data is disconnected from the account and project. OpenAI's guide says abuse monitoring logs are kept for up to 30 days by default, and that both Zero Data Retention and Modified Abuse Monitoring require prior approval.

The questions to write down: is there human review, what triggers it, where are the reviewers located, and is there a documented way to switch it off and verify the switch?

4. Which subprocessors touch the data?

A subprocessor is any third party the provider uses to process customer data: cloud hosting, content delivery, support tooling, billing. The published list tells two things. It shows which other companies' infrastructure the prompts may pass through, and, by comparing versions over time, how often that set changes.

Read the list next to the data processing addendum, which normally says how customers learn of a new subprocessor and whether they can object.

5. Which features carry their own rules?

The headline policy usually covers plain request and response. Features that store things often sit outside it.

OpenAI's guide lists endpoints that are not eligible for Zero Data Retention, including Files, Vector stores, Batches, fine-tuning jobs, Assistants and Threads, and Conversations. Files and vector stores are kept until deleted, and the Responses API stores application state for 30 days by default unless store is set to false. On the Gemini side, Grounding with Google Search stores prompts, context and output for thirty days on either tier. A team that signed up for zero retention and then built a document search on uploaded files may have quietly moved its most sensitive content into the category that is kept indefinitely.

A worked reading, start to finish

Suppose an accounting office of 15 people is choosing between letting staff use a consumer chat app and building a small tool on a commercial API. Walking the five questions for the API option might produce notes like these:

1. Training: off by default for the API, no per-user switch to worry about.
2. Retention: 30 days by default; flagged content kept longer if the provider's terms say so (Anthropic's say up to 2 years); legal holds can extend either.
3. Abuse monitoring: logs kept up to 30 days; whether a person can read flagged traffic answered in writing; reduced monitoring only with approval.
4. Subprocessors: published list, notice terms in the DPA, a named person checks it quarterly.
5. Features: plan uses file uploads for client documents, which fall outside zero retention and persist until deleted, so the tool must delete files after each job.

The consumer option fails at question 1 for the reason described above: the training setting belongs to each person, not to the office. The notes also expose the risk no setting removes: client records still leave the building for up to 30 days, and a legal order the office never hears about can extend that.

Where good terms stop helping

Terms are promises from one party, and they can be revised. The Anthropic consumer change is a reminder that a default can move from one month to the next, with a deadline to respond. A contract also does not cover a feature enabled later, or a personal account on a work laptop.

That is the line between a well-governed cloud service and running the model yourself, explained in the definition of what private AI means. For data classes that cannot carry any of the residual risk above, the usual answer is to keep them off cloud services entirely and route only the rest outward, the approach set out in the guide to splitting work between local and cloud models. A practical rule: if a data class would be a problem in a 12,000-request inventory held elsewhere for 30 days, it should not go to a cloud model under any setting.

Frequently asked questions

If a conversation is deleted, can it still end up in training?

Anthropic's consumer announcement says a deleted conversation will not be used for future model training. That covers future runs; it says nothing about a model already trained before the deletion, and it does not shorten any separate retention for flagged content. Check each provider's wording for "future" and for exceptions.

Does reaching a model through Amazon Bedrock, Vertex AI or Azure change the terms?

Usually yes, because the contract is then with the cloud platform. Anthropic lists Bedrock and Vertex AI access as commercial services, and Microsoft states that prompts sent to models sold by Azure are not available to OpenAI or other model providers. The platform's own abuse monitoring and retention terms then become the ones to read.

Does Zero Data Retention mean nothing is stored at all?

Not necessarily. Deletion itself can lag: OpenAI's guide says vector store objects deleted through the API or dashboard are removed 30 days later, while files can be set to expire automatically with expires_after. Safety records can also outlive the content, as with Anthropic's stated retention of classification scores for up to 7 years.

Is a paid personal subscription the same as a business plan?

No. Paying for a personal plan buys more usage and features but generally keeps the consumer terms, including any training setting the individual controls. Business, enterprise and API offerings are sold under separate commercial terms, and the difference is spelled out in the provider's own privacy pages.