Guides › AI provider data policies
What AI Providers Do With Your Data: OpenAI, Anthropic, Microsoft and Google Compared
Every vendor review of an AI platform asks the same five questions: is our data used for training, how long is it kept, can we get zero retention, where does it live, and what can our administrators see and control. The answers are spread across privacy pages, help articles, trust portals and the contract, they differ by plan tier, and they change. This page collects them for ChatGPT, Claude, Microsoft 365 Copilot and Gemini for Google Workspace from each provider's own documentation as of October 2026, side by side, with the caveats the documentation itself carries. It ends with the three things none of these policies change, which is where the actual exposure sits.
How to read a provider's data policy
Each policy answers the five questions for a specific tier, and the tier is the first thing to establish. Consumer plans are governed by consumer terms, under which training on conversations may be the default or an opt-in that extends retention; nothing in this comparison applies to them. Business, Team, Enterprise and Edu plans and the APIs are governed by commercial terms and a data processing addendum, and those are what the table describes. Within the commercial tiers, several commitments are gated by eligibility (“qualifying organizations,” “eligible customers”) or by a sales conversation, which means the policy page describes what is available and the contract describes what you have.
Two questions the policies do not answer are the ones that matter most. A policy governs what the provider does after data arrives; it says nothing about what your users and connectors send, which is the subject of the third-party platforms guide. And a policy that says the assistant respects your permissions is describing your permissions, which in most tenants grant more than intended, as the data silos guide covers.
The comparison
Rows are the five questions plus two that reviews often miss. Each cell is a paraphrase of the provider's published statement, with the source linked at the end of the page. Where a provider's documentation is silent, the cell says so rather than guessing.
Provider notes the table can't hold
OpenAI
Training exclusion covers Business, Enterprise, Edu, Healthcare and the API by default, with an opt-in available through the API dashboard. Deleted chats are scheduled for permanent deletion within 30 days unless already de-identified or held for security or legal reasons, and temporary chats may be kept for up to 30 days for safety purposes. Project files and custom GPT knowledge files persist until deleted or removed by a workspace retention policy. Residency at rest is available to eligible Enterprise, Edu, Healthcare and API customers in ten regions, with in-region inference in the U.S. and Europe. A BAA is offered for ChatGPT for Healthcare and API healthcare customers. The Compliance Platform, which exposes conversation and app-activity records, is limited to eligible Enterprise and Edu workspaces.
Anthropic
Commercial terms exclude customer content from training, and the API documentation adds that retained data is never used for training without express permission. On the API, conversation content is not retained by default with one exception: the Covered Models (Fable 5.1, Mythos 5.1, Fable 5 and Mythos 5) require 30-day retention and are not available under zero data retention unless expressly authorized. ZDR is arranged per organization through sales and covers the Messages and Token Counting APIs; batch processing, code execution, the Files API, the MCP connector, Managed Agents and the consumer and Team and Enterprise product interfaces are outside it, with a separate ZDR offering for Claude Code on Enterprise. Flagged content can be retained up to two years. On Claude Enterprise, retention is indefinite unless an Owner sets a custom period of at least 30 days, and projects are retained indefinitely by default.
Microsoft
Microsoft 365 Copilot and Copilot Chat, as used by organizations, fall under the Data Protection Addendum and Product Terms with Microsoft as processor. Prompts, responses and data accessed through Microsoft Graph are not used to train foundation models. Copilot inherits sensitivity labels, applies Purview retention policies, supports audit of interactions and respects the tenant's identity model, with the specific controls varying by subscription. Two exclusions are stated plainly: the EU Data Boundary does not apply to web search queries, which go to Bing as a separate service with identifiers removed, and Anthropic models available inside Copilot are excluded from the EU Data Boundary and in-country processing commitments. Agents built on Copilot carry their own privacy terms.
Workspace does not use customer data to train models without the customer's permission or instruction, and Gemini retrieves only Workspace content the user has access to. Retention for Gemini in Workspace is 90 days to indefinite as administrators decide; the Gemini app allows 3, 18 or 36 months with 18 as the default, and 72 hours with history off. The documentation does not describe data residency for Gemini in Workspace. Gemini Notebook, formerly NotebookLM, is the outlier: it copies Drive files into its own storage, is not covered by the organization's sharing or data region settings, is not integrated with Workspace DLP, and sits outside Google's ISO, SOC, FedRAMP and HIPAA BAA coverage.
What to ask for in the contract
The policy pages describe the ceiling. The contract fixes the floor, and the gap between them is where eligibility language lives. Five clauses are worth securing in writing for any platform that will touch regulated data: the training exclusion as a term rather than a default setting; the retention window and the deletion schedule, including for files held in projects, libraries and knowledge features; zero data retention scoped to the specific endpoints and features you will use, since several are excluded by every provider; residency for storage and, separately, for inference, since the two are offered separately; and the audit and compliance export you will rely on, named by feature and tier. The data sovereignty guide explains why even all five together are a floor and not a control.
Keeping this current
Every row in the table has changed at least once in the last two years and several will change again. The reliable routine is a quarterly read of the four source documents linked below against the contract, and a note in the acceptable use policy that names the tier each approved tool is on. When a provider changes a default, the change usually lands first in a help article and later in the terms; the help articles are the ones to watch.
Where Hardshell sits
Hardshell governs the side of the boundary the policies don't. It connects to the systems where data already lives without migrating them, inherits their permissions and limits each retrieval to what the requesting user is entitled to see, substitutes stand-ins for real identifiers before content reaches ChatGPT, Claude, Copilot, Gemini or any other provider, and records every retrieval under opaque IDs. With substitution in place, the training, retention and residency questions still matter and stop being the whole risk, because the provider never held the identifiers. It deploys as a cloud service, in a private cloud or as an offline bundle for disconnected environments.
Frequently asked questions
Does OpenAI train on ChatGPT Enterprise data?
OpenAI states that it does not train on the data of Business, Enterprise, Edu, Healthcare and API organizations by default, with an opt-in available. Consumer plans are governed separately and depend on the account's training setting.
Does Anthropic retain API data?
Conversation content is not retained by default on the API, except for the Covered Models, which require 30-day retention. Zero data retention is available per organization through sales for the Messages and Token Counting APIs, with several features excluded. Claude Enterprise retains indefinitely unless an Owner sets a custom period of 30 days or more.
Does Microsoft 365 Copilot keep data inside the EU?
Microsoft lists the EU Data Boundary among Copilot's commitments, with two stated exclusions: web search queries, which go to Bing, and Anthropic models offered inside Copilot. Confirm the boundary's scope for your subscription and the models you enable.
Does Gemini train on Google Workspace data?
Google states that Workspace does not use customer data to train models without the customer's prior permission or instruction, and that Gemini app chats and uploads are not reviewed by humans or used for training without permission. Gemini Notebook data is likewise excluded from training, with the separate caveats about its storage and certification scope.
Is zero data retention the same as the data never being processed?
No. Zero data retention means the provider does not store prompts and responses at rest after the response is returned. The data still crosses the boundary, is processed by the provider's systems and is visible to them at inference time, and several features are excluded from ZDR on every provider. It narrows persistence, which is useful; substitution narrows what crosses.