Your team pastes contracts, patient notes, financials, and trade secrets into AI tools every day. Seven questions, 30 seconds — find out whether you actually know where that data goes, or whether you're just hoping.
Key figure: 63% of organizations in IBM's 2025 breach study had no AI governance policy, and 97% of AI-breach victims had no proper AI access controls (IBM, Cost of a Data Breach Report 2025).
Vendor data reuse is when an AI provider trains models on, analyzes, or retains your prompts and uploads beyond serving your request. Free tiers commonly default to reuse; paid tiers may let you opt out — if you ask in writing.
Short answer: most teams can't name where their AI vendor stores data, whether it trains on their inputs, or who else touches it. October 2026 gave us a live cautionary tale: DeepSeek is under German regulatory investigation for exactly these questions. Answer honestly — "not sure" counts as a miss.
One vendor, four red flags, one month. Now: does your vendor pass the same seven questions regulators are asking DeepSeek?
Answer honestly. A wrong guess is worse than an honest miss — at least a miss tells you what to fix.
Then come back and retake the check. Seven green answers is the goal.
It depends on the vendor's terms. At minimum, assume your prompts, chat logs, metadata, and usage patterns are retained; many vendors also use inputs for training.
Often yes, unless something forbids it. Consumer and free-tier tools commonly default to using your inputs for training.
That is what German data protection authorities are investigating — Rhineland-Palatinate's DPO is probing DeepSeek's data collection.
A vulnerability published on October 13, 2026, rated CVSS 9.1 (Critical), in which DeepSeek V4 allowed unauthorized actions through crafted input.
Run the seven checks on this page: confirm where data is stored, get a written no-training promise, read the sub-processor list, test deletion.
It depends on the vendor's terms and contracts. At minimum, assume your prompts, chat logs, metadata, and usage patterns are retained; many vendors also use inputs for model training unless a contract, enterprise agreement, or opt-out says otherwise. Read the privacy policy's data-use and training clauses, check the sub-processor list, and confirm how deletion works before trusting any vendor with sensitive data.
Often yes, unless something forbids it. Consumer and free-tier AI tools commonly default to using your inputs for training, while paid or enterprise tiers may offer opt-outs or contractual no-training guarantees. If your vendor's policy does not explicitly promise not to train on your data, assume it can.
That is exactly what German data protection authorities are investigating. Rhineland-Palatinate DPO Dieter Kugelmann is probing DeepSeek's data collection (including IP addresses, chat logs, and keystroke rhythms) and GDPR compliance, and DeepSeek reportedly has no EU legal representative. The investigation is ongoing — compliance has not been established.
A vulnerability published on October 13, 2026, rated CVSS 9.1 (Critical), in which DeepSeek V4 allowed unauthorized actions through crafted input due to incorrect access control. It is a reminder that AI vendors are software vendors too — their products can carry the same classes of critical flaws as any other platform you trust with data.
Run the seven checks on this page: confirm where data is stored, get a written no-training promise, read the sub-processor list, test the deletion process, research their breach and CVE history, ban free-tier tools for work data, and confirm they have a legal representative in your jurisdiction. Then keep watching the terms — they change.
Because your prompts are their training data until proven otherwise. Free and consumer AI tiers commonly default to training on user inputs; retention windows stretch for months; subprocessors multiply the exposure. Seven questions, thirty seconds: this checker maps where your data goes, who else sees it, and what rights you actually have. Assume retention, verify deletion.
Keep auditing what your vendors get away with: