What to ask vendors about AI training on your data

AI training data policy questions belong in writing before you paste decks, customer lists, or financial models into a third-party tool. Marketing pages often say "enterprise-grade" without stating whether prompts, files, or derived embeddings may train or improve a shared model. The FTC has warned model-as-a-service companies to honor privacy and confidentiality commitments about customer data, including promises not to use that data to train or update models, and has separately cautioned that quietly changing terms to allow new AI training uses can be unfair or deceptive. NIST's AI Risk Management Framework treats data, privacy, and governance as ongoing risk work, not a one-time checkbox. This is orientation for founders, not legal advice. Have counsel review any data processing addendum before you rely on it.

AI training data policy questions to ask before you upload

Start with a short list you send the same way every time: email to the vendor's security or sales engineer, or a ticket that returns a ticket ID. Save the reply PDF or message next to the contract. Verbal "we do not train on your data" is not enough when diligence or a customer asks what you believed on the day you enabled the integration.

Name the data classes in the email: source code, customer PII, unpublished financials, HR files, or only internal notes. Broader access needs stricter answers.

Minimum questions (send all of them):

1. Is customer content used to train, fine-tune, or otherwise improve any model that other customers can reach?
2. Is customer content used only to provide the service to our tenant, and if so, what processing is allowed?
3. How long are prompts, files, embeddings, and logs retained, and how do we request deletion?
4. Which subprocessors see the content, in which countries, and where is that list published?
5. How will you notify us if training, retention, or sharing terms change?

Illustrative send (composite only): a five-line email with those questions, a request for the current DPA and subprocessors list, and a note that enablement waits on written answers.

Separate product telemetry from model training in the reply

Vendors sometimes answer "we improve the product with usage data" while the contract still allows training on customer content. Force the distinction in plain words.

Ask them to mark each row yes or no: train foundation or shared models; train customer-specific adapters only inside our tenant; use aggregated metrics that cannot reconstruct content; use human review of prompts or outputs. If the reply mixes those ideas into one sentence, send it back for a table.

Illustrative clarification (composite only): "Confirm in one sentence whether text we paste into the chat can appear in training corpora for models served to other customers. Answer yes or no, then point to the clause."

The FTC's January 2024 note on AI privacy commitments stresses that companies must abide by promises not to use customer data for secret purposes such as training or updating models, including promises made in marketing or terms. Treat conflicts between the sales email and the DPA as unresolved until counsel picks the controlling text.

Retention, deletion, and who else can see the data

Training policy is incomplete without retention. Ask how long prompts, uploaded files, embeddings, and support transcripts stay available to the vendor, whether backups outlive the primary delete, and what happens to models or indexes built from your content if you leave.

Ask for the subprocessors list and the country of processing for each. If the vendor uses another model provider behind the API, name that provider in the answer. "Industry-standard cloud" is not a subprocessor list.

Illustrative follow-up (composite only): "If we delete a workspace, what is deleted within thirty days, what remains in backups, and do any derived embeddings remain searchable by your staff?"

When you connect outside tools into Nautis, read Connect Claude, ChatGPT and other AI tools so you know what read or write access you granted. That help page is about access into your workspace; it does not replace the other vendor's training policy for data that leaves through their product.

Watch for quiet changes to terms after you sign

A clean answer on day one can rot if the vendor later expands training rights through a browse-wrap update. The FTC's February 2024 note warns that adopting more permissive practices, such as using data for AI training, and telling users only through a surreptitious terms change can raise unfair or deceptive practice concerns under the laws the FTC enforces.

Put a calendar reminder on the contract renewal and on any "we updated our policy" mail. Ask the vendor how customers are notified, whether old content is grandfathered, and whether you can export and leave before a new training clause applies.

Illustrative contract note (composite only): "Training-on-customer-content requires prior written consent; email notice alone does not amend this addendum." Only counsel should draft enforceable language.

Compare vendors in one table

Use the same columns for every tool that will see sensitive startup data. Fill cells only from written replies or linked policy pages dated in the answer.

Illustrative decision rule (composite only): any "unclear" cell blocks production use of customer PII until the cell is yes/no with a citation. Internal brainstorms on synthetic data can wait in a weaker tool if counsel agrees.

Keep the table short. Five to eight questions beat a fifty-row questionnaire nobody finishes.

Save answers where operators already review AI

When a vendor will touch Nautis data through a connection or when your own agents act, pair the policy file with the controls you already run.

In AI Governance, Owners and Admins can read the AI Activity log (action, status, agent, model, when) and open details such as prompt, output, and outcome when recorded. Filter by Auto-ran, Approved, Rejected, or Pending. Secret values stored through Credentials Vault tools are removed from what gets logged. The log is read-only on that screen.

Under Agent Autonomy, set capabilities to Ask every time or Run without asking; deleting stays on Always asks. Pending work clears in Approvals inside Chief of Staff. Those controls govern what runs in your workspace; they do not rewrite a third-party training clause. Still, a vendor that refuses to answer training questions should not receive Run without asking on write-heavy capabilities that send content outward.

When you inspect an AI Activity row, confirm whether the model field and sources match the vendor you reviewed. If a connected app wrote through Approvals, keep the approval decision next to that vendor's policy PDF so audits can see both the human decision and the training answer that was on file.

Illustrative filing (composite only): folder vendor-ai-policies/2026-q2, one PDF reply per vendor, plus a one-line note in your security log pointing to the matching table row.

For investor or customer questionnaires, reuse the same written answers rather than inventing softer language in Slack. Precision here protects you when investor follow-ups ask how tools treat confidential materials.

What to do when a vendor will not answer

If sales forwards only a blog post, ask for the DPA section number that matches each table row. If they refuse written enterprise terms on the plan you can buy today, assume training defaults are whatever the public terms say, and keep sensitive data out.

If the product is mandatory for a customer workflow, isolate the data: synthetic examples, redacted fields, or a separate workspace with no production customers. Document who approved the exception and which data classes remain blocked.

Revisit the exception after ninety days. Temporary tools have a habit of becoming permanent homes for customer data without a second review.

Illustrative pause (composite only): disable the integration, revoke API keys on the Developers tab, and reopen only after counsel signs off on the written training answer.

AI training data policy questions are a procurement habit, not a one-time launch task. Re-ask when the vendor ships a new model tier, when you expand from notes into customer PII, and when a subprocessor list changes. The founders who keep dated answers spend less time reconstructing what they believed after a scare.

Share the finished table with whoever owns security questionnaires and with whoever can click Allow access on the Developers tab. If those people disagree about an acceptable answer, stop the rollout until they agree in writing.

NIST's AI Risk Management Framework frames privacy and data governance as risks to manage across the AI lifecycle. Your table is a lightweight way to show that work for each vendor without pretending the framework is a statute.