AI Vendor Governance Scorecard

API data not used for training by default. Abuse monitoring logs kept up to 30 days; zero data retention or Modified Abuse Monitoring for customers OpenAI approves. HIPAA BAA available for the API with Modified Retention. EU data residency via eu.api.openai.com; processing in Europe needs one of those approved retention controls.

API inputs and outputs deleted within 30 days by default; zero data retention by agreement, except for Covered Models (Claude Mythos 5 and 5.1, Claude Fable 5 and 5.1), which require 30-day retention. BAA available for HIPAA-ready services, including the first-party API. ISO 27001:2022 and SOC 2 Type II.

Updated Oct 24, 2026: Google now documents Vertex AI as Gemini Enterprise Agent Platform, with in-memory and durable caching on by default. On Google Cloud: no training without permission, cached data deleted within 24 hours and caching can be turned off, and prompts may be logged for abuse detection. SOC 2, HIPAA and ISO 27001 cover the Agent Platform. The unpaid Gemini API can use data to improve Google products, except for users in the EEA, Switzerland and the UK.

Data hosted in the EU by default. Studio and API data, including Free mode, can be used for training until an admin turns off Anonymous improvement data in the Admin panel. ZDR only on pay-as-you-go stateless API calls. SOC 2 Type II and ISO 27001. Models can be self-deployed. HIPAA BAA offered for qualifying services (Trust Center).

SaaS prompts and generations deleted after 30 days; zero data retention for approved customers. Prompts and generations can train Cohere models until you opt out in Data Controls. DPA on request from [email protected] for SaaS customers. BAA only for custom model development engagements. Private on-prem or VPC deployments available.

Personal data is collected, processed and stored in China. No DPA or subprocessor list published. Terms allow use of de-identified inputs and outputs to improve the service unless Improve the model for everyone is off; the API docs don't say that setting covers API accounts. Weights for models such as DeepSeek-V4.1-Flash are MIT-licensed and can be self-hosted.

Prompts and completions not available to OpenAI and not used to train foundation models. Models are stateless; optional stateful features store data as you configure. Customers approved for modified abuse monitoring get no prompt storage or human review; automated checks still run. EU DataZone keeps processing in the EU. SOC 2, ISO and HIPAA scope is listed in Microsoft's Service Trust Portal, which we could not open.

Content not used to improve base models and not shared with model providers; stored in the Region you use. Retention depends on the model unless you turn on ZDR mode. Bedrock is a HIPAA-eligible service.

Chats stay saved until you delete them; deleted chats are removed within 30 days. Turn off Improve the model for everyone to stop training on new chats. Temporary chats may be kept 30 days. Not on OpenAI's HIPAA-eligible product list.

Free, Pro and Max users choose whether chats train models. If allowed, retention is five years; otherwise 30 days. Consumer plans are outside the Commercial Terms, the DPA and the BAA.

Now named Microsoft Copilot. Prompts and Graph data not used to train foundation LLMs. Anthropic models (on by default outside EU/EFTA/UK) are excluded from the EU Data Boundary; OpenAI-operated models are included. Copilot Business covers up to 300 users.

Privacy Mode: no training by Cursor, and zero data retention agreements with model providers (flagged content may be kept). SOC 2 Type II, ISO/IEC 27001:2022 and ISO/IEC 42001:2023. HIPAA BAA on the Enterprise plan only.

Enterprise plan only for zero retention at LLM providers (other plans up to 30 days), EU data residency for stored data (LLM processing is outside residency scope), and HIPAA BAA (Beta services excluded). Not used to train models by default on any plan.

Turn off Product Improvement and Training to stop your content training models. Data may be transferred to the US under the EU-U.S. Data Privacy Framework. Legal terms now sit with Superhuman. HIPAA BAA only on Grammarly for Business Enterprise plans.

Business and Enterprise: IDE prompts and suggestions not retained, other use kept 28 days. From April 24, Free, Pro and Pro+ interactions can train GitHub models unless the user opts out.

Free, Pro and Max: AI data retention is on by default and can be turned off in Preferences; Enterprise data is never used for training. Data kept while the account is active, removed within 30 days of deletion. SOC 2 Type 2. The Enterprise page says Perplexity is HIPAA compliant, but we found no published BAA terms.

Meeting audio, video and chat never train Zoom's or third-party models. EU-hosted accounts run AI on Zoom-managed models in Amazon Bedrock or Zoom's own; the federated setup also calls Anthropic, OpenAI and Google. Zero data retention option for Meeting Summary transcripts. AI features are available under a BAA, though some may not be.