Training, chat history and data retention
OpenAI does not train on ChatGPT Business, Enterprise or API data by default. Chat history and file retention follow separate rules. For the OpenAI API, Zero Data Retention (ZDR) requires approval and applies subject to feature and endpoint limits. Standard API abuse-monitoring logs may retain content for up to 30 days, with exceptions.
Anthropic publishes separate retention rules for its commercial chat products and API. For Microsoft 365 Copilot, Microsoft says it does not train foundation models on prompts or responses. Interaction data can still be stored under the organization’s Microsoft 365 policies. Verify the terms and settings for your account.
Data Exposure Vectors in Everyday LLM Usage
Three vectors dominate risk: pasting confidential records into prompts, uploading files with embedded metadata, and indirect prompt injection. Developers occasionally upload stack traces containing active database credentials, while sales reps upload lead spreadsheets with phone numbers and identity records.
Indirect prompt injection occurs when an agent evaluates external emails or web pages. Embedded adversarial instructions cause the model to read internal documentation and transmit extracts to an external attacker system.
Where to apply data sharing rules
Give employees approved work accounts and document the data they may use. Check what controls your plan actually supports, including access management and connected apps.
Data loss prevention (DLP) can flag recognizable patterns such as API keys and payment card numbers where the product or gateway supports inspection. Test file uploads and connected apps separately. Pattern matching can miss sensitive information.
What to verify before sharing company data
| Product | Model training | History and retention |
|---|---|---|
| ChatGPT Business / Enterprise | Business data excluded by default | Check workspace history and available retention settings |
| OpenAI API | API data excluded by default | Check monitoring logs, endpoint storage and ZDR eligibility |
| Claude commercial products | Check commercial terms and settings | Check the chat product and API separately |
| Microsoft 365 Copilot | Prompts and responses excluded from foundation-model training | Check interaction history and Microsoft 365 retention policies |
Implementation Procedure for Secure AI Adoption
Practical setup sequence for corporate environments and employee devices.
- List the AI tools and accounts each team uses.
- Verify training, retention, file handling and connector terms for each approved product and plan.
- Define which classes of data staff can share. Keep credentials and access tokens out of prompts and attachments.
- Test the available sharing controls with synthetic data.
- Assign an owner to review settings, contracts and connected apps when they change.
