The governance wedge · Article 3 of 7
Where the prompt goes
Training, retention, and human review are three different risks that firms collapse into one fear. Pulling them apart is most of the literacy this subject requires.
1 · The question behind the question
Sooner or later a client asks it. In a questionnaire, in a security review, or in a hallway: is our information inside one of these AI models now?
The firms that struggle with that moment are not the ones using AI. They are the ones who cannot say what happens to a prompt after somebody hits enter. And that is a knowable thing. Every serious vendor writes it down, in documents shorter and clearer than most people expect. The reason so few firms can answer is not that the answer is buried. It is that the question arrived before anyone assigned themselves to read.
So this article is the reading, condensed, plus a map of which distinctions actually decide cases.
One framing note before the plumbing. The bad outcomes here are not exotic. They are an employee pasting a client’s financials into a personal chatbot account, on consumer terms, from a couch on a Sunday. Everything below exists to make that particular act impossible to perform innocently.
2 · Three mechanisms, three different questions
When people worry about AI and confidentiality, they usually fold three separate mechanisms into one fear.
Training is the headline. Your content used to improve the vendor’s models, feared rightly, because it is the least reversible thing on the list. You cannot recall what a model has already learned from. It is also the risk vendors moved fastest to fence, because enterprise buyers refused to sign without it. On business tiers, training on your content is now off by default at every major vendor. On consumer tiers the defaults vary and shift over time, which is the actual problem: the default is a setting somebody else controls.
Retention is quieter and far more common. Your content sits on the vendor’s servers for a window running from days to indefinitely, subject to the vendor’s security, the vendor’s subpoenas, and the vendor’s mistakes. That is not hypothetical exposure. It is your client’s clause-by-clause negotiating position living on infrastructure you do not control, for as long as the terms allow. Business tiers usually let an administrator bound the window. Consumer tiers usually do not, in any way the firm can see.
Human review is the one nobody prices in. Most vendors reserve the right to have people, employees or contractors, read flagged conversations for safety and abuse purposes. This is legitimate, disclosed, and completely incompatible with the assumption that a prompt is a private conversation with a machine. If a person at a vendor reading the paragraph you pasted would be a breach, the paragraph should not have been pasted.
Three mechanisms means three questions for every tool on your inventory. Is training off. How long is retention and who controls it. Who can read this. A tool can be fine on one axis and unacceptable on another, and firms that ask only the first question keep discovering the other two late.
3 · One logo, two products
Here is the distinction that settles most real cases. The consumer product and the business product of the same vendor are different arrangements sold under one name, and the interface will not tell you which one you are in.
The specifics move, so treat what follows as a snapshot we took in August 2026, with links below, and as a template for the check you should run on your own tools rather than a replacement for it.
OpenAI states plainly that consumer ChatGPT content, on Free, Plus, and Pro plans, may be used to train its models by default, with an opt-out in the privacy settings. Its business products are the mirror image: “By default, we do not train on any inputs or outputs from our products for business users,” with administrator-controlled retention and a data protection agreement on offer, and API traffic retained up to 30 days with a zero-retention option for eligible uses. Anthropic, as of the same reading, does not train on consumer Claude conversations unless the user opts in, and excludes commercial-product data by default as well. Two reputable vendors, two different consumer defaults, one shared pattern. The business tier is where the firm-grade commitments live.
Take one sentence from this article to your next partner meeting and let it be this one. The question is never whether a tool is safe. It is whose account this is, on which tier, under which terms. The same product name can be a governed workspace or an ungoverned couch, and only the account knows which.
4 · The button that undoes your settings
A small mechanism deserves its own section, because it quietly reverses careful configuration.
On several platforms, clicking thumbs-up or thumbs-down on a response does more than register an opinion. It can submit the surrounding conversation to the vendor for review and model improvement, under separate feedback terms, even where training is otherwise switched off. OpenAI’s documentation says a rated conversation may be used for training despite an opt-out. Anthropic’s says feedback is retained for up to five years, de-linked from identity.
Nobody in your firm knows this, and why would they. The button looks like a courtesy. The policy fix is one line at tier two and above: do not rate responses in tools carrying client material. The deeper lesson is this article in miniature. The risky acts in this domain do not look risky. They look like buttons.
5 · What a DPA actually buys
Move sensitive work onto a business tier and part of what you are buying is a data protection agreement, so be precise about what that document does. It makes the vendor your processor. It obligates them contractually on retention, deletion, security measures, subprocessor disclosure, and breach notification, and it gives you standing when they fail. It converts marketing claims into terms.
Here is what it does not do. It does not make an unwise paste wise. It does not satisfy a client contract that forbids third-party disclosure outright, and some of yours may, which is the subject of the next article. And it does not review outputs, supervise staff, or answer the client questionnaire. A DPA is a floor under the vendor. The floor under your own practice is your policy and your people, and no vendor sells that.
Where this fits
Data and confidentiality is the third of eight domains in our AI Governance Readiness Checklist. Its four boxes compress everything above:
☐ We know whether our AI tools retain or train on the data we enter.
☐ Staff know never to put client-confidential or regulated data into consumer AI tools.
☐ Sensitive work runs only on business-tier tools with real data-protection terms.
☐ We could show a client that their data has not ended up in a public model.
The fourth box is the demanding one, and it is the point of the entire domain. “Show” means the inventory, the account tiers, the settings, and the dates somebody checked them, assembled into an answer a client can be handed. A firm that can produce that page in an hour has converted a vulnerability into a selling point, because almost none of its competitors can.
Next: from the vendor’s terms to yours, and the AI restrictions already living inside the confidentiality, subprocessor, and intellectual property clauses your firm signed years ago.
The usual candor to close. Vendor terms change, ours is a snapshot with dates on it, and reading your specific agreements is work we would do with your documents on the table rather than from a blog post. That reading takes about a day, and it settles the question for a year.