What to write when they ask if customer data trains a model

What the row is asking

Reviewers ask whether customer data is used to train a model. They also ask about fine-tuning and evaluation, and whether that use is opt-in, opt-out, or excluded in the contract. A direct no, or a described exception, is the answer. If you say you redact, the miss still needs its own sentence.

This row is about your own product. Whether a model company belongs on the vendor list is a different row. That row is whether you send them customer data, and what their terms say. This row is whether your product uses customer data to train, fine-tune, or evaluate a model.

Onplana, on a page dated October 7, 2026, asks "Is customer data used to train AI models?" A good answer on that page is "A direct no or a described exception." Onplana writes vendor-review questions. This is their list, not a founder asking for help.

AuditXYZ, on a page that says Last updated: 2026-07-23, asks "Is customer data used to train, fine-tune, or evaluate any model", shared or customer-specific, and "Is this opt-in, opt-out, or contractually excluded?" The same page says "If the vendor trains shared models on customer data with no contractual opt-out, nothing else in the assessment matters". No person byline is on the page. Treat it as that vendor's questionnaire, not as a founder asking for help.

A post on r/SaaS, July 14, 2026, is written as the person selling an AI agent product. A new section asked "what stops pii reaching the model provider." They said they would get back to the reviewer, and "the deal sat in procurement for six weeks." The same day they said the review moved once they had a written answer for "what happens when redaction misses." The same section also asked for a per-action audit trail and proof one customer's agent cannot touch another's data. That stall is this post. It is not a count from other reviews, and it is not a stall on training alone. Company and headcount are not stated.

A Hacker News comment on August 6, 2026, on a tool the writer already used, says "For countries outside the EU, Claude was turned on by default as a subprocessor. It appears that choosing Claude may be sending your prompts outside the M365 tenancy to Anthropic in the US." The same comment says "It is not clear from any of Microsoft's documentation whether leaving chats on "Auto" may be funneling to the Claude subprocessor". Employer is not stated. Once you confirm that tool sends customer data, that model company belongs on the vendor list. The training sentence for your own product is still yours.

What data a vendor can see is a different row. How long prompts are kept is the retention sentence. How one customer's data stays out of another's is a different row. Which company you chose to list is a different row.

What reviewers accept

Write a direct no only when customer data is not used to train, fine-tune, or evaluate a model, shared or only for one customer. If one of those three is true, name that one. A blanket no that skips fine-tune or evaluate is the answer that fails.

A yes names the exception. Say which of train, fine-tune, or evaluate, whether the model is shared or only for that customer, and whether the customer opted in or the contract excludes everyone else. Opt-out is not a direct no.

If you have not chosen, say not yet or still deciding, and leave the exception out until you have chosen it.

If you remove personal data before it reaches a model provider, say what you remove, and what happens when that removal misses. We redact, with nothing after it, is not the answer.

A model company you send data to belongs on the vendor list once you confirm the data is sent. Read that company's terms for whether they train on what you send. That reading is not your product's training sentence. Keep your sentence in the answer you control.

A tool you already pay for may send prompts to a model company unless a setting is off. Check the setting. If data is sent, that company goes on the list. Your training sentence stays in the answer you keep.

An honest gap is a complete answer. The answer that fails is a no that hides a fine-tune, an evaluation, or an opt-out, or we redact with no sentence for a miss.

What not to write

Do not write a no that skips fine-tune or evaluate.

Do not write yes with no exception.

Do not treat opt-out as a no.

Do not write we redact without what happens when redaction misses.

Do not answer how long prompts are kept here. That sentence is how long you keep customer data.

Do not answer what data a vendor can see here. That is a different row.

Do not answer how one customer stays off another's data here. A shared model that can return another customer's data is that row.

Do not put the training answer on the vendor row. There is no field for it.

Do not copy a model company's training terms as your product's answer.

Do not leave a model company off the list after you confirm a tool you already pay sends them customer data.

Do not invent a no, an exception, a redaction step, or a deal that stalled.

Where this answer lives

Keep these sentences in the questionnaire answer you control.

The public page shows your company name, a short summary, and a contact email. Each row shows the company, what it does, the processing location, the agreement link, and the date you saved it.

You can name a model company as a vendor row once you type it. The purpose line is text you write. You can mention that the company receives prompts. The page does not store whether that data trains a model.

There is no field for a training answer, a redaction claim, or a fine-tuning exception. The page does not fill this row.

If the editor already knows a company, a suggestion can offer a location or a public agreement link, and only after you use it. That suggestion does not write a training answer.

If you want the longer notes

Naming a model company on the vendor list, and reading that company's terms, is a different row from whether your product trains on customer data. What to check is in the AI provider guide.

What data each vendor can see is a different row from whether that data trains a model. What to write is in the data access guide.

How long prompts are kept is the retention sentence. What to write is in the data retention guide.

List the model company you chose once you confirm it receives customer data. How to tell the roles apart is in the controller and processor guide.

How your product keeps one customer's data out of another's, including a shared model, is a different row from whether customer data trains a model. What to write is in the customer data isolation guide.

The short packet for a questionnaire, including where this sentence stays, is in the security questionnaire guide.

What the agent is allowed to do is a different row from whether customer data trains a model. What to write is in the agent permissions guide.