Do AI providers train on your company data?

The question comes up in every security review, usually in exactly these words: “Does our data end up in the training?” It is a fair question, and it can be answered, always for one individual product at a time.

What OpenAI, Microsoft, Google, Anthropic, Amazon and Mistral say about their offerings, where the traps are and which questions should be settled before an approval is covered below. Every statement comes from the providers’ own pages, as of October 2026.

Why the product is what matters

OpenAI offers ChatGPT as a free personal account, as a business plan with a contract and as an API for your own applications. Different rules apply to all three, and in exactly one of them inputs feed the training by default. Microsoft, Google, Anthropic and Mistral look the same.

So anyone who wants to know whether company data goes into training starts by establishing which product is used with which account. The logo alone never settles it.

Which offerings train on your data by default?

The overview covers inputs, uploaded files and answers.

As of October 2026, based on the providers’ privacy and contract pages, including OpenAI Enterprise Privacy, Microsoft Learn, Azure OpenAI, Microsoft Learn, Microsoft 365 Copilot, Gemini API Terms, Anthropic Privacy Center, Amazon Bedrock FAQ and Mistral Help Center. Providers change their rules regularly.

There is a pattern in the table: wherever a company signs a contract, training is off, and wherever an individual opens a free account, it is on. That is the providers’ business model: business customers pay, among other things, for their data staying protected.

The biggest exposure sits inside the company

An employee has to review a 40-page tender. It is due on Friday. Since the approved tool cannot read a PDF and their personal ChatGPT can, the file goes there. Whether that text ends up in training now depends on a single switch in their personal settings, and the IT department stays outside the loop.

A ban holds only while the approved tool does the job just as well. What works is a business account on the same level, together with clear rules on which data may go into which tool. Our AI workshops cover this too, including what should never go into a public AI tool.

What providers store even without training

Even where nobody trains, something stays behind. Three points matter, and all three sit away from the product page.

Abuse monitoring

Providers have to detect when their models are being misused, which is why they keep inputs and outputs for a limited time, up to 30 days at the OpenAI API and at Anthropic. When a case is flagged, people look at it. If you have to do without it, for example in legal services or healthcare, you can apply for zero data retention at OpenAI and Anthropic and for modified abuse monitoring at Azure OpenAI; both come after a review. Amazon Bedrock skips the storage by default.

Exceptions for the newest models

Since June 2026, Anthropic has retained inputs and outputs from its strongest models for 30 days, even for customers with zero data retention. That applies wherever those models run, including through Amazon Bedrock, Google Cloud and Microsoft Foundry. An agreement signed a year ago can be out of date for the new model, which makes a look at the terms worthwhile with every model switch.

Thumbs up or thumbs down

Rating an answer usually releases the conversation for improvement, and at OpenAI the entire thread then goes into training, even with training switched off elsewhere. Anthropic lets you disable the function in Claude Team and Enterprise. Where confidential content is involved, that is worth considering.

Where the data is processed

Training and place of processing are two separate questions. A provider can credibly commit to leaving training aside and still process the data in the US.

Azure OpenAI processes in the region you choose. With the “Data Zone EU” setting processing stays inside the EU, with “Global” it can happen anywhere. Google Vertex AI offers an EU endpoint and endpoints in individual countries, such as Frankfurt. OpenAI offers European data storage for the API, but only once it has been approved and a separate amendment is in place. Amazon Bedrock stores data in the region where you use it. Microsoft Copilot is part of the EU Data Boundary, although Anthropic’s models, which Microsoft uses as a subprocessor, are currently excluded. The Anthropic API stores data in the US only, according to Anthropic.

What should be settled before you approve a tool

Four points should be settled before an approval.

• Which product and which account does the team actually use, and not just on paper?
• Is the exclusion from training written into the contract, or does it rest on a setting that every user can change?
• How long is data kept, who sees flagged cases, and does that still apply to the model you switch to next year?
• In which region does processing run, and what happens with the “global” setting?

The rating function is easily missed in security questionnaires, even though a seemingly harmless rating can change the data rules that apply.

How we handle this in projects

Most of our projects run in Azure, inside the customer’s own cloud environment. That is where we train and run the model on your data, and the data stays in that environment. Microsoft does not use it to train its own models. Less often a model runs on your own servers, in the cases where data must not leave the company at all, as in the data extraction for Fr. Meyer’s Sohn. What suits that setup and what it costs is covered in our article Local LLMs in practice and on the LLM development page.

Whether a provider trains is written in its terms and can be settled by contract. The harder question is which data your people put into a tool that someone else picked.

Frequently asked questions