AI-researched, reviewed by derio Labs. Not legal advice. Vendor terms change, so check the primary page as of your contract date.
When a vendor says "we don't train on your data," buyers often hear three other promises: nothing is kept, nothing can be read later, and we have a GDPR processing agreement. Those are different knobs. Collapsing them is how teams paste client text into a chat that still stores history for months.
A clean split, using only what the big providers publish:
1. Training off
May our prompts improve the public model?
For business ChatGPT plans, OpenAI's enterprise privacy page says that by default it does not use business data to train models; training happens only with an explicit opt-in (OpenAI, Enterprise privacy, updated 2026-01-08). That is a training promise. It does not say how long chats sit on disk.
2. Retention
How long does the provider keep conversation content after the reply?
OpenAI's admin academy resource states that for ChatGPT Business and Enterprise, chats are saved indefinitely by default until deleted, and Enterprise owners can set a custom retention policy with a minimum of 90 days (OpenAI Academy, Data governance, updated 2026-09-17). Anthropic's Enterprise help centre says the same shape for Claude Enterprise: retained indefinitely by default unless a custom period is set, with a 30-day minimum when you do (Claude Help Center, custom retention).
"No training" and "still kept for a long time" routinely sit together. History and compliance features need the content to exist.
3. Zero data retention (ZDR)
After the API response returns, does the provider store prompts/outputs at rest?
OpenAI describes ZDR as an eligible-API arrangement: prompts and responses are not retained after processing (OpenAI on ZDR, 2026-08-19; also Enterprise privacy). Anthropic's docs are blunt about surface scope: under a Claude API ZDR arrangement, Claude Teams and Claude Enterprise product interfaces are not ZDR-eligible (Claude Code on Enterprise has its own ZDR offering, enabled separately by Anthropic) (Anthropic ZDR docs).
If colleagues use the browser chat, ZDR on an API key elsewhere does not cover that window.
One sentence for reviews
Ask three separate questions: train?, retain how long?, which surface is ZDR? Then read the exceptions (abuse logs, flagged content, storage-requiring tools) on the same page. A DPA is a fourth document — contractual roles and subprocessors, not a substitute for those three answers.
I track what AI services actually promise on this, with dated sources, at Ostrafile; there's a free sample on my profile.
