Data Retention and Deletion for AI Tools: What to Ask a Vendor

Storage questions fail when they are vague. "Where is data hosted?" invites "in the cloud." Ask instead:

1. In which countries and regions is data at rest for each data type in the table above?
2. Which cloud infrastructure providers host production, disaster recovery, and backup environments, and in which regions?
3. Provide the current subprocessor list, including model providers, speech and OCR services, vector databases, and support tooling.
4. For each subprocessor, state what data it receives and under which flow-down terms.
5. Does any data leave the region of origin, and under which transfer mechanism?
6. If the model is third-party, is your data sent to that provider's API, and under what retention terms?

The last question matters more than buyers expect. Many AI products are wrappers around someone else's foundation model, so your data may reach an organization you never negotiated with. DataGrail's analysis of 2,400 popular business software providers found that 63.6 percent of vendors advertising AI capabilities do not disclose a third-party AI subprocessor anywhere in their legal documentation (Parseur). From the outside you cannot tell the vendors with no subprocessor apart from the ones that simply did not name theirs.

Fourth-party risk is where healthcare reviews break down first, because an AI vendor may depend on a model provider, cloud platform, speech-to-text service, or vector database your team never picked (Censinet). HHS has stated that a cloud service provider can be a business associate even when it cannot view encrypted ePHI or does not hold the decryption key, which is why the subcontractor list belongs in the contract rather than the sales deck (Censinet).

Retention answers are where a single word hides four clocks. Ask for a number, in days, for prompts, outputs, logs, embeddings, and backups, and ask what happens at the end of each period: deletion, anonymization, or indefinite retention in aggregate form.

Public vendor documentation shows how varied the defaults are. OpenAI states that business customers control how long their data is retained in ChatGPT Enterprise, ChatGPT for Healthcare, and ChatGPT Edu, and that business data is not used for training by default (OpenAI enterprise privacy). On another provider's account tiers, standard retention for abuse monitoring is documented as 30 days even when training is disabled, and temporary chat prevents history and training use but still retains content for 30 days for abuse detection (Secure Privacy). GitHub, for its part, told the community that individual Copilot users would receive 30 days of advance notice before interaction data could be used for model training, while agreements with Business and Enterprise customers prohibit that use (GitHub Community).

A worked example shows why the longest clock matters. Suppose your deletion obligation to a customer is 30 days. The prompt is deleted from the primary store on day 30, the log entry is deleted on day 90, and the backup containing both rotates on day 180. Your practical deletion date is day 180, not day 30. If your contract with your own customer promises 30 days, you have a gap you cannot close by asking the vendor to "delete promptly."

Boil every answer down to three fields you can compare across bidders: the longest retention period in days, the data types attached to it, and the mechanism that shortens it (an admin setting, a contractual term, or a support request). If the vendor cannot name the mechanism, assume the default applies to you.

Access questions usually get answered with a list of security certifications, which says nothing about who opens your prompts. Ask:

• Which roles inside the vendor can view customer content, and under what approval?
• Are support engineers able to view content, and is that access gated, logged, and time-limited?
• Do human reviewers read prompts for safety or quality, and can that be disabled?
• Is content used for evaluation, benchmarking, or fine-tuning, including by affiliates?
• Which third parties receive content, and is any of it sold?

Vendors differ on human review, and the differences are contractual. OpenAI documents that business data may pass through automated content classifiers and safety tools, and that human review applies on a service-by-service basis (OpenAI enterprise privacy). Other providers describe prompts as potentially reviewed by human reviewers for safety reasons, with no way to opt out when content triggers their safety systems (Tiamat on dev.to). GitHub says its own and Microsoft personnel working on model development may access interaction data collected for training, and that service providers may assist under contractual limits (GitHub Community).

The insight most reviews miss is that zero data retention does not mean zero data access. Every provider can see your prompt in transit, because it must filter it and respond to it (Tiamat on dev.to). Design your controls around that reality. If a workload cannot tolerate any human or automated inspection of content, scrub identifiers before the request leaves your network:

scrubbed, entity_map = pii_scrubber.scrub(user_input_with_pii)
response = client.chat.completions.create(
    messages=[{"role": "user", "content": scrubbed}]
)

The model sees a placeholder, not an account number, and the mapping stays in your environment (Tiamat on dev.to). Harvard's security guidance makes the same point from the policy side: understand what protections apply to the specific tool, model, workspace, and feature in use, and remove unnecessary personal or proprietary information before sharing content with an AI system (Harvard Information Security).

Deletion questions have a short version and a useful version. The short version ("do you delete data on request?") gets a yes. The useful version asks how:

1. Can we delete prompts, outputs, and files ourselves from an admin console, or does deletion require a support ticket?
2. What is the stated completion time for a deletion request, and is it in the contract?
3. Does deletion propagate to backups and disaster recovery copies, and on what schedule?
4. Are derived artifacts (embeddings, indexes, cached responses, fine-tuned adapters) deleted or rebuilt from remaining data?
5. What proof do we receive: a confirmation record, a certificate, or a log entry?
6. How do legal holds interact with deletion, so the vendor does not keep extra data forever to satisfy them?
7. What happens to our data if the contract ends, and how long does export access last?

Ask for default retention, backup retention, and deletion attestations as separate answers, because vendors often publish the first and skip the other two (CTO Input). The rule to repeat to your legal team is that if a commitment is not in the contract, it does not exist (CTO Input).

Score answers against evidence, not adjectives. A vendor that says "we retain data only as long as necessary" has given you nothing you can put in a risk register; the sentence has no scope, names no subprocessors, quotes no retention number, and carries nobody's signature (Parseur).

Use four tests on every reply:

• Specific or general. Days, regions, and named entities count. "Industry standard" and "as required" do not.
• Document or assurance. A DPA clause, a subprocessor list with dates, or a SOC 2 report scope counts. A marketing page does not. Ask for the security report and the bridge letter, not a summary (CTO Input).
• Default or negotiated. Ask what applies to your account under your contract, not what is available in some tier.
• Silence or refusal. A vendor that will not answer in writing has answered. Hold the deal (Censinet).

Two documents do the heavy lifting. A data processing addendum carries the GDPR obligations, and vendors such as OpenAI will execute one for business and API use (OpenAI enterprise privacy). For health data, a business associate agreement plus a written no-training term is the floor, not the ceiling (Censinet). Fold the answers into one scoring sheet that covers data inputs and outputs, retention and training use, security posture, subprocessors, and exit, so procurement, security, and legal read the same artifact (Initialize AI).

Run a two-week proof before you scale: send one real workflow through the tool with scrubbed data, check the admin console for the retention settings you were promised, submit one deletion request and time it, and read the logs to confirm what was actually recorded. Evidence from your own tenant beats any questionnaire.

If you need a single endpoint to test several model types under one contract before committing your production data, Quanta Inference provides text, image, video, audio, and embedding models through one OpenAI-compatible API key, prepaid and priced in US dollars, which keeps the data-handling review to one vendor instead of five: https://quantaintelligence.ai/inference. For teams that want the retention questions answered alongside a working prototype, a free consulting call can map your obligations to a specific architecture: https://quantaintelligence.ai/calendar.