Someone on your team clicked the AI button inside a vendor’s portal this week, and the request that left the building carried more than the words they typed.
Your client will eventually ask what happened to their data in that moment, and four different companies touched it before the request came back. Your team sends the request. The software vendor assembles it, adding whatever context it has permission to reach. The model provider behind the AI button processes it. And if anything in the request trips a safety check, a fourth company, one neither you nor your client has ever heard of, reads it. When a vendor tells you it does not train on your data, and that answer is typically true, it is speaking for itself, one company out of four. 81% of vCISO service providers already use AI or automation in delivery, so this is running in your stack whether or not you went looking for it.
What Your Software Attaches to a Prompt
When someone types “summarize this thread,” the application does not forward that sentence on its own. It assembles a package that includes the question, plus material the user never wrote, retrieved from wherever the vendor has permission to look.
Slack publishes the reach of its own AI search, and the list is the plainest description any vendor has put in writing. It covers canvases, huddle notes, clip transcripts, files uploaded to Slack including PDFs and emails, linked documents from Google Drive, SharePoint, and OneDrive, and file storage such as Box. Someone asking for a summary of one channel can produce a request carrying documents from three other systems. Microsoft treats this as its own category. It lists “augmented data included with or via prompts” separately from prompts themselves, and says the service “retrieves relevant data from a configured data store and augments the prompt.”
The payload is larger than the question. When a vendor tells you it only sends what the user asks for, it is describing the typing. The request reaches whatever that person can already open. A tech with broad access to a client’s document store builds a bigger request than a colleague without it, typing the same words.
That material also outlives the conversation, because whatever got retrieved to answer one question does not disappear when the question does. OpenAI’s own platform documentation lists vector stores, the indexes built from retrieved documents, as persisting “until deleted” and as ineligible for its zero-retention control. Deleting the chat does not touch that index.
Which Companies Process the Request
Once the package is assembled, it reaches the software vendor’s own infrastructure, and then typically somewhere else. OpenAI states in its enterprise privacy commitments that it does “not train our models on your data by default” across its business and API tiers. That is a true statement made by one company about itself. It says nothing about the company whose product put the button on the screen, and nothing about anyone either of them hired.
Microsoft’s own documentation for Copilot shows how that works in practice. Anthropic has onboarded as a Microsoft sub-processor, switched on by default for most commercial cloud customers. Choose one of the models that requires retention, and Microsoft states the data “is stored by Anthropic and not subject to your Microsoft Customer Agreement including commitments in the Product Terms and DPA.” Microsoft describes Anthropic there as “an independent processor.” Microsoft publishes that company’s retention on its behalf. Most inputs and outputs are held up to 30 days, and flagged content up to two years. A classification score about your client’s material can sit for seven years with a company your client never contracted with.
Same product, same button, and a different model in the dropdown puts the data outside the agreement your client’s contract chain rests on. Carry one question into every vendor conversation: which company holds the material once the request leaves, and whose contract governs it there.
Where Flagged Content Goes
When something your team sends trips a safety classifier, a person may read it, and that person is the fourth party. OpenAI says access to business data extends to “specialized third-party contractors who are bound by confidentiality and security obligations, solely to review for abuse and misuse.” Its published sub-processor list names the firms doing that work and the countries they operate from.
Two clocks run here, one for training and one for review. The vendor answers the first, and nobody asked about the second. Abuse-monitoring logs at OpenAI run up to 30 days unless a customer has been approved for zero data retention or modified abuse monitoring, and those controls are “subject to prior approval.” Zero data retention is an arrangement you qualify for. Anthropic applies its equivalent per organization and still keeps safety classifier results.
Ask it in plain words: who sees this material when something gets flagged, and for how long. A vendor that has thought about the problem answers in numbers.
How to Read a Vendor AI Disclosure Page
Most of what you need is already published, and the work is reading it. Check four things in a couple of minutes:
| What to look for | What it tells you |
|---|---|
| A date at the top | Whether anyone still maintains the page |
| A purpose per entry written as a verb, such as “moderation of content” or “transcription services” | What each company actually does, without needing a lawyer |
| A country listed next to the company | Where the processing happens, without having to ask |
| Exceptions shown in line, the way OpenAI footnotes an entry “except where Zero Data Retention (ZDR) is used” | That the answer changes with the contract |
Atlassian gives AI providers their own section in its sub-processor table and names the legal entities behind the brands.
A page missing all four is the starting point for a short email: Does customer data train your models, and what do you retain, for how long?
Your vendor questionnaire almost certainly runs through the eight categories a vendor review already covers, from data access through subcontractors to incident history. None of them is AI. Treat this as the ninth category, and most of the scaffolding is already built. For the client-facing program rather than the mechanics, see expanding your TPRM program to cover AI vendors.
A Vendor AI Answer Expires
An answer you gather today is a claim about today. Microsoft commits to at least six months of notice before adding a sub-processor, “except for subprocessors that support artificial intelligence functionality, where Microsoft provides at least 30 days’ notice.”
Vendors also move the paperwork together, so a change to one document usually means the whole set moved with it. When HubSpot updated its terms in July 2026, the customer terms, the privacy policy, the sub-processor page, and the data processing agreement all changed at once, and customers found out from a community post. Four days later the company reversed the change and wrote “we made a mistake.” The reversal is encouraging. The surface you checked in June was still not the surface in July, and a point-in-time review does not survive a vendor shipping a new model mid-quarter.
Subscribe to the Sub-Processor Page
Start with the two or three tools in your stack that touch client evidence. Open the sub-processor page once, and subscribe to its change notifications. Atlassian, OpenAI, Slack, and Microsoft each publish a subscription on the page itself. It runs about five minutes per vendor, and it turns a review you did once into an alert that comes to you.
Nobody can warrant what a model does after the request leaves, and you should never imply otherwise to a client. What you can say is which companies are in the path, what each one keeps, and when you last checked. That is what a client’s auditor wants on the page anyway.
Service providers use Cynomi, the Security Growth Platform, to keep vendor assessments, risk, and remediation in one program across a whole book of clients instead of a spreadsheet per account. Its own AI provider detail is published on AI in Cynomi: What Happens to Your Clients’ Data. See how vendor risk runs at portfolio scale, and the AI question turns from a fire drill into one more part of the review you already run.
Table of contents
