wdmpgWhere Do My Prompts Go?
121 sources checked · 0 fetch errors last check data v2026-10-26 · sha256 00e98854 data.jsondata.csvllms.txt

What happens to your prompts after you hit enter

Training, retention, ZDR and residency for 25 AI tools, quoted from each vendor.

Browse 25 tools
Export data
data.jsonfull dataset data.csvone row per tool llms.txtplain text for agents

Email alertsFollow on XGitHub

trains by default12/25don't train on your data by default10 depend · 3 unverified · 0 yes
zero data retention15/21offer ZDR in some form4 observability tools: n/a
default retention6/25keep nothing by default2 keep data until deleted
sg / apac region2/25offer a Singapore region; 5 offer APAC4 region unverified
unverified fields26/200no official page said it clearlyWARN lines in the event stream
source monitor121/121pages fetched OK on 2026-10-260 fetch errors · 0 cited pages not indexed yet

Field status heatmap

  • Favourable
  • Caution
  • Unfavourable
  • Unverified
  • Neutral / n/a
  • rules
25 × 8 cells
Status of 8 policy fields for 25 tools200 cells: 80 favourable, 53 caution, 7 unfavourable, 29 unverified, 31 neutral / n/a. The comparison table below has the same data as text.TrainsRetentionZDRAbuse mon.SG/APACSOC2/ISOHIPAA BAASelf-hostMODEL APISOpenAI APIOpenAI API: Trains on your data by default = no (Favourable)✓OpenAI API: Default retention = 30 days (Caution)!OpenAI API: Zero data retention = on approval (Favourable)✓OpenAI API: Abuse-monitoring exception = can override ZDR (Caution)!OpenAI API: Data residency / regions = US, EU, AU, CA, JP, IN, SG, KR, UK, UAE (Favourable)✓OpenAI API: SOC 2 / ISO 27001 = SOC 2 Type 2 (Favourable)✓OpenAI API: HIPAA BAA = yes (Favourable)✓OpenAI API: Self-host option = partial (open-weight gpt-oss only) (Caution)!Anthropic APIAnthropic API (Claude): Trains on your data by default = no (Favourable)✓Anthropic API (Claude): Default retention = 30 days (Caution)!Anthropic API (Claude): Zero data retention = on request (Favourable)✓Anthropic API (Claude): Abuse-monitoring exception = 2 years if flagged (Caution)!Anthropic API (Claude): Data residency / regions = US or global (Neutral / n/a)–Anthropic API (Claude): SOC 2 / ISO 27001 = SOC 2 Type I & II; ISO 27001; ISO 42001 (Favourable)✓Anthropic API (Claude): HIPAA BAA = yes (Favourable)✓Anthropic API (Claude): Self-host option = no (hosted only) (Neutral / n/a)–Google Gemini APIGoogle Gemini API: Trains on your data by default = depends (Caution)!Google Gemini API: Default retention = 'limited period' (not specified) (Caution)!Google Gemini API: Zero data retention = no (use Vertex AI) (Unfavourable)×Google Gemini API: Abuse-monitoring exception = always on (paid) (Caution)!Google Gemini API: Data residency / regions = none (Neutral / n/a)–Google Gemini API: SOC 2 / ISO 27001 = unverified (Unverified)?Google Gemini API: HIPAA BAA = no (PHI barred without Google's written consent) (Unfavourable)×Google Gemini API: Self-host option = separate product (Gemini on GDC) (Caution)!Mistral AIMistral AI (Studio / API): Trains on your data by default = depends (Caution)!Mistral AI (Studio / API): Default retention = 30 days (API, rolling) (Caution)!Mistral AI (Studio / API): Zero data retention = on request (PAYG only) (Favourable)✓Mistral AI (Studio / API): Abuse-monitoring exception = yes, 30 days (off with ZDR) (Caution)!Mistral AI (Studio / API): Data residency / regions = EU (default) or US (Neutral / n/a)–Mistral AI (Studio / API): SOC 2 / ISO 27001 = SOC 2 Type II; ISO 27001/27701 (Favourable)✓Mistral AI (Studio / API): HIPAA BAA = unverified (Unverified)?Mistral AI (Studio / API): Self-host option = yes (open models) (Favourable)✓CohereCohere: Trains on your data by default = depends (Caution)!Cohere: Default retention = 30 days (Caution)!Cohere: Zero data retention = on request (enterprise) (Favourable)✓Cohere: Abuse-monitoring exception = flagged data reviewed (Caution)!Cohere: Data residency / regions = US only (Google Cloud US-Central) (Neutral / n/a)–Cohere: SOC 2 / ISO 27001 = SOC 2 Type II; ISO 27001; ISO 42001 (Favourable)✓Cohere: HIPAA BAA = yes (custom model development) (Favourable)✓Cohere: Self-host option = yes (private deployment) (Favourable)✓xAI APIxAI API (Grok): Trains on your data by default = no (Favourable)✓xAI API (Grok): Default retention = 30 days (Caution)!xAI API (Grok): Zero data retention = yes (ZDR-enabled API) (Favourable)✓xAI API (Grok): Abuse-monitoring exception = extends retention (non-ZDR) (Caution)!xAI API (Grok): Data residency / regions = global or US (Neutral / n/a)–xAI API (Grok): SOC 2 / ISO 27001 = SOC 2 Type 2 (Favourable)✓xAI API (Grok): HIPAA BAA = yes (referenced) (Favourable)✓xAI API (Grok): Self-host option = partial (older open weights) (Caution)!DeepSeek APIDeepSeek API: Trains on your data by default = unverified (Unverified)?DeepSeek API: Default retention = not fixed (prompt cache: hours to days) (Caution)!DeepSeek API: Zero data retention = unverified (Unverified)?DeepSeek API: Abuse-monitoring exception = unverified (Unverified)?DeepSeek API: Data residency / regions = PRC only (Neutral / n/a)–DeepSeek API: SOC 2 / ISO 27001 = unverified (Unverified)?DeepSeek API: HIPAA BAA = unverified (Unverified)?DeepSeek API: Self-host option = yes (open weights) (Favourable)✓GroqGroq: Trains on your data by default = no (Favourable)✓Groq: Default retention = none by default (Favourable)✓Groq: Zero data retention = yes (self-serve) (Favourable)✓Groq: Abuse-monitoring exception = up to 30 days, opt-out (Caution)!Groq: Data residency / regions = US only (Neutral / n/a)–Groq: SOC 2 / ISO 27001 = SOC 2 Type II (Favourable)✓Groq: HIPAA BAA = yes (BAA addendum) (Favourable)✓Groq: Self-host option = unverified (Unverified)?CODING TOOLSCursorCursor: Trains on your data by default = depends (Caution)!Cursor: Default retention = Privacy Mode: transient; off: stored (Caution)!Cursor: Zero data retention = yes (Privacy Mode) (Favourable)✓Cursor: Abuse-monitoring exception = exception applies (Caution)!Cursor: Data residency / regions = US-only (Enterprise); EU+UK inference on request (Neutral / n/a)–Cursor: SOC 2 / ISO 27001 = SOC 2 Type II; ISO 27001; ISO 42001; AIUC-1 (Favourable)✓Cursor: HIPAA BAA = yes (Enterprise) (Favourable)✓Cursor: Self-host option = partial (agent tool execution only) (Caution)!GitHub CopilotGitHub Copilot: Trains on your data by default = depends (Caution)!GitHub Copilot: Default retention = 0 days (IDE) / 28 days (other) (Caution)!GitHub Copilot: Zero data retention = partial (Caution)!GitHub Copilot: Abuse-monitoring exception = provider ZDR, except Claude Fable 5 / 5.1 (Anthropic retains) (Caution)!GitHub Copilot: Data residency / regions = EU, Australia, US, Japan (GHE.com) (Caution)!GitHub Copilot: SOC 2 / ISO 27001 = SOC 2 Type II; ISO 27001 (Favourable)✓GitHub Copilot: HIPAA BAA = no (DPA bars PHI without consent) (Unfavourable)×GitHub Copilot: Self-host option = partial (CLI air-gapped, preview) (Caution)!Claude CodeClaude Code: Trains on your data by default = depends (Caution)!Claude Code: Default retention = 30 days (commercial) (Caution)!Claude Code: Zero data retention = Enterprise, on request (Favourable)✓Claude Code: Abuse-monitoring exception = 2 years if flagged (Caution)!Claude Code: Data residency / regions = US or global (Neutral / n/a)–Claude Code: SOC 2 / ISO 27001 = SOC 2 Type I & II; ISO 27001; ISO 42001 (Favourable)✓Claude Code: HIPAA BAA = yes (Favourable)✓Claude Code: Self-host option = partial (session runners, beta) (Caution)!OpenAI CodexOpenAI Codex: Trains on your data by default = depends (Caution)!OpenAI Codex: Default retention = follows workspace / API org settings (Neutral / n/a)–OpenAI Codex: Zero data retention = unverified (Unverified)?OpenAI Codex: Abuse-monitoring exception = unverified (Unverified)?OpenAI Codex: Data residency / regions = follows ChatGPT Enterprise settings (Unverified)?OpenAI Codex: SOC 2 / ISO 27001 = unverified (Unverified)?OpenAI Codex: HIPAA BAA = yes (local Codex only) (Favourable)✓OpenAI Codex: Self-host option = partial (local OSS models) (Caution)!WindsurfWindsurf (Devin Desktop): Trains on your data by default = depends (Caution)!Windsurf (Devin Desktop): Default retention = deleted after output (MSA customers) (Favourable)✓Windsurf (Devin Desktop): Zero data retention = on opt-out (paid) (Favourable)✓Windsurf (Devin Desktop): Abuse-monitoring exception = 30 days for opt-in models (Caution)!Windsurf (Devin Desktop): Data residency / regions = US (core); EU cluster for Enterprise (Neutral / n/a)–Windsurf (Devin Desktop): SOC 2 / ISO 27001 = SOC 2 Type II (Favourable)✓Windsurf (Devin Desktop): HIPAA BAA = no (MSA bars PHI) (Unfavourable)×Windsurf (Devin Desktop): Self-host option = no for new customers (Hybrid instead) (Neutral / n/a)–JetBrains AIJetBrains AI: Trains on your data by default = depends (Caution)!JetBrains AI: Default retention = 1 year (if shared) (Caution)!JetBrains AI: Zero data retention = unverified (Unverified)?JetBrains AI: Abuse-monitoring exception = yes, limited period (unspecified) (Caution)!JetBrains AI: Data residency / regions = provider-dependent, mostly US (Neutral / n/a)–JetBrains AI: SOC 2 / ISO 27001 = SOC 2 Type II (Favourable)✓JetBrains AI: HIPAA BAA = unverified (Unverified)?JetBrains AI: Self-host option = yes (AI Enterprise on-prem) (Favourable)✓INFERENCE HOSTS & ROUTERSOpenRouterOpenRouter: Trains on your data by default = depends on provider (Caution)!OpenRouter: Default retention = not logged by default (Favourable)✓OpenRouter: Zero data retention = yes (routing filter) (Favourable)✓OpenRouter: Abuse-monitoring exception = depends on provider (Caution)!OpenRouter: Data residency / regions = EU or US (Business/Enterprise) (Neutral / n/a)–OpenRouter: SOC 2 / ISO 27001 = SOC 2 Type II (Favourable)✓OpenRouter: HIPAA BAA = unverified (Unverified)?OpenRouter: Self-host option = unverified (Unverified)?Together AITogether AI: Trains on your data by default = no (Favourable)✓Together AI: Default retention = stored until deleted (default) (Unfavourable)×Together AI: Zero data retention = yes (opt-in, org setting) (Favourable)✓Together AI: Abuse-monitoring exception = none stated for content (uses metadata) (Favourable)✓Together AI: Data residency / regions = unverified (Unverified)?Together AI: SOC 2 / ISO 27001 = SOC 2 Type 2 (Favourable)✓Together AI: HIPAA BAA = no (standard terms bar medical data) (Unfavourable)×Together AI: Self-host option = yes (Enterprise Platform) (Favourable)✓Fireworks AIFireworks AI: Trains on your data by default = no (Favourable)✓Fireworks AI: Default retention = none by default (open models) (Favourable)✓Fireworks AI: Zero data retention = default (Favourable)✓Fireworks AI: Abuse-monitoring exception = none stated (no prompt logging for open models) (Favourable)✓Fireworks AI: Data residency / regions = US-only option (Enterprise enforcement) (Neutral / n/a)–Fireworks AI: SOC 2 / ISO 27001 = SOC 2 Type II; ISO 27001, 27701, 42001 (Favourable)✓Fireworks AI: HIPAA BAA = unverified (Unverified)?Fireworks AI: Self-host option = partial (BYOC, private preview) (Caution)!Ollama CloudOllama Cloud: Trains on your data by default = no (Favourable)✓Ollama Cloud: Default retention = transient (Favourable)✓Ollama Cloud: Zero data retention = default (Favourable)✓Ollama Cloud: Abuse-monitoring exception = none stated (prompts never logged) (Favourable)✓Ollama Cloud: Data residency / regions = US (may route to Europe) (Neutral / n/a)–Ollama Cloud: SOC 2 / ISO 27001 = unverified (Unverified)?Ollama Cloud: HIPAA BAA = unverified (Unverified)?Ollama Cloud: Self-host option = yes (local Ollama) (Favourable)✓AWS BedrockAWS Bedrock: Trains on your data by default = no (Favourable)✓AWS Bedrock: Default retention = none by default, with model-specific exceptions (Favourable)✓AWS Bedrock: Zero data retention = default (most models) (Favourable)✓AWS Bedrock: Abuse-monitoring exception = model-specific (Caution)!AWS Bedrock: Data residency / regions = per AWS Region incl. Singapore (Favourable)✓AWS Bedrock: SOC 2 / ISO 27001 = SOC 1/2/3; ISO 27001 (+27017/27018/27701); FedRAMP Moderate; CSA STAR L2 (Favourable)✓AWS Bedrock: HIPAA BAA = yes (HIPAA eligible) (Favourable)✓AWS Bedrock: Self-host option = no (AWS-managed) (Neutral / n/a)–Azure OpenAIAzure OpenAI (Microsoft Foundry): Trains on your data by default = no (Favourable)✓Azure OpenAI (Microsoft Foundry): Default retention = stateless; flagged samples stored (Caution)!Azure OpenAI (Microsoft Foundry): Zero data retention = on approval (modified abuse monitoring) (Favourable)✓Azure OpenAI (Microsoft Foundry): Abuse-monitoring exception = human review of flagged samples (Caution)!Azure OpenAI (Microsoft Foundry): Data residency / regions = resource geography (unless Global/DataZone) (Unverified)?Azure OpenAI (Microsoft Foundry): SOC 2 / ISO 27001 = unverified (Unverified)?Azure OpenAI (Microsoft Foundry): HIPAA BAA = unverified (Unverified)?Azure OpenAI (Microsoft Foundry): Self-host option = no (Azure-hosted) (Neutral / n/a)–EVAL & MONITORINGLangfuseLangfuse: Trains on your data by default = no (Favourable)✓Langfuse: Default retention = indefinite unless configured (Unfavourable)×Langfuse: Zero data retention = n/a (Neutral / n/a)–Langfuse: Abuse-monitoring exception = n/a (Neutral / n/a)–Langfuse: Data residency / regions = US, EU, Japan, HIPAA (US) (Caution)!Langfuse: SOC 2 / ISO 27001 = SOC 2 Type II; ISO 27001 (Favourable)✓Langfuse: HIPAA BAA = yes (HIPAA region, Pro+) (Favourable)✓Langfuse: Self-host option = yes (open source) (Favourable)✓LangSmithLangSmith: Trains on your data by default = no (Favourable)✓LangSmith: Default retention = 14 days (base) / 180 days (extended) (Caution)!LangSmith: Zero data retention = n/a (Neutral / n/a)–LangSmith: Abuse-monitoring exception = n/a (Neutral / n/a)–LangSmith: Data residency / regions = US, EU, APAC (Sydney) (Caution)!LangSmith: SOC 2 / ISO 27001 = SOC 2 Type 2 (Favourable)✓LangSmith: HIPAA BAA = unverified (Unverified)?LangSmith: Self-host option = yes (Enterprise add-on) (Favourable)✓BraintrustBraintrust: Trains on your data by default = no (Favourable)✓Braintrust: Default retention = configurable (Neutral / n/a)–Braintrust: Zero data retention = n/a (built-in model endpoints are ZDR) (Neutral / n/a)–Braintrust: Abuse-monitoring exception = n/a (Neutral / n/a)–Braintrust: Data residency / regions = US or EU (Pro); self-host for others (Neutral / n/a)–Braintrust: SOC 2 / ISO 27001 = SOC 2 Type II (Favourable)✓Braintrust: HIPAA BAA = yes (Favourable)✓Braintrust: Self-host option = yes (self-host or BYOC) (Favourable)✓ArizeArize (AX / Phoenix): Trains on your data by default = unverified (Unverified)?Arize (AX / Phoenix): Default retention = 15 days (Free) / 30 days (Pro) / custom (Caution)!Arize (AX / Phoenix): Zero data retention = n/a (Neutral / n/a)–Arize (AX / Phoenix): Abuse-monitoring exception = n/a (Neutral / n/a)–Arize (AX / Phoenix): Data residency / regions = EU data residency offered (Unverified)?Arize (AX / Phoenix): SOC 2 / ISO 27001 = SOC 2; ISO 27001; PCI DSS (Favourable)✓Arize (AX / Phoenix): HIPAA BAA = unverified (Unverified)?Arize (AX / Phoenix): Self-host option = yes (Phoenix, free) (Favourable)✓HeliconeHelicone: Trains on your data by default = unverified (Unverified)?Helicone: Default retention = 7 days / 1 month / 3 months / forever by plan (Caution)!Helicone: Zero data retention = partial (Omit Logs) (Caution)!Helicone: Abuse-monitoring exception = n/a (Neutral / n/a)–Helicone: Data residency / regions = US or EU (Neutral / n/a)–Helicone: SOC 2 / ISO 27001 = SOC 2 (Type II per pricing page) (Favourable)✓Helicone: HIPAA BAA = unverified (Unverified)?Helicone: Self-host option = yes (open source) (Favourable)✓
Hover or focus a cell for the exact value. Each cell links to its evidence.

Default retention

21 with a stated period
Default retention for the 21 tools that state a period, log scale from 0 days to until deleted01d7d30d90d1y∞AWS Bedrock: none by default, with model-specific exceptionsAWS Bedrock0dFireworks AI: none by default (open models)Fireworks AI0dGroq: none by defaultGroq0dOllama Cloud: transientOllama Cloud0dOpenRouter: not logged by defaultOpenRouter0dWindsurf (Devin Desktop): deleted after output (MSA customers)Windsurf0dGitHub Copilot: 0 days (IDE) / 28 days (other)GitHub Copilot0d–28dAzure OpenAI (Microsoft Foundry): stateless; flagged samples storedAzure OpenAI0d–∞Cursor: Privacy Mode: transient; off: storedCursor0d–∞Helicone: 7 days / 1 month / 3 months / forever by planHelicone7d–∞LangSmith: 14 days (base) / 180 days (extended)LangSmith14d–180dArize (AX / Phoenix): 15 days (Free) / 30 days (Pro) / customArize15d–30dAnthropic API (Claude): 30 daysAnthropic API30dClaude Code: 30 days (commercial)Claude Code30dCohere: 30 daysCohere30dMistral AI (Studio / API): 30 days (API, rolling)Mistral AI30dOpenAI API: 30 daysOpenAI API30dxAI API (Grok): 30 daysxAI API30dJetBrains AI: 1 year (if shared)JetBrains AI1yLangfuse: indefinite unless configuredLangfuse∞Together AI: stored until deleted (default)Together AI∞

Log scale. Bars span the shortest to longest period in the value; ∞ = until you delete it. No fixed number: Google Gemini API “'limited period' (not specified)”; DeepSeek API “not fixed (prompt cache: hours to days)”; OpenAI Codex “follows workspace / API org settings”; Braintrust “configurable”.

Field split

25 tools per field
TrainsTrains on your data by default: 12 of 25 favourable12Trains on your data by default: 10 of 25 caution10Trains on your data by default: 3 of 25 unverified3Default retentionDefault retention: 6 of 25 favourable6Default retention: 15 of 25 caution15Default retention: 2 of 25 neutral / n/a2Default retention: 2 of 25 unfavourable2Zero data retentionZero data retention: 15 of 25 favourable15Zero data retention: 2 of 25 caution2Zero data retention: 4 of 25 neutral / n/a4Zero data retention: 1 of 25 unfavourable1Zero data retention: 3 of 25 unverified3Abuse mon.Abuse-monitoring exception: 3 of 25 favourable3Abuse-monitoring exception: 15 of 25 caution15Abuse-monitoring exception: 5 of 25 neutral / n/a5Abuse-monitoring exception: 2 of 25 unverified2SG/APACData residency / regions: 2 of 25 favourable2Data residency / regions: 3 of 25 caution3Data residency / regions: 16 of 25 neutral / n/a16Data residency / regions: 4 of 25 unverified4SOC 2 / ISO 27001SOC 2 / ISO 27001: 20 of 25 favourable20SOC 2 / ISO 27001: 5 of 25 unverified5HIPAA BAAHIPAA BAA: 11 of 25 favourable11HIPAA BAA: 4 of 25 unfavourable4HIPAA BAA: 10 of 25 unverified10Self-host optionSelf-host option: 11 of 25 favourable11Self-host option: 8 of 25 caution8Self-host option: 4 of 25 neutral / n/a4Self-host option: 2 of 25 unverified2

Policy event stream

40 events
  1. INFOcheckerrun121 sources fetched and diffed: 121 ok, 0 failed
  2. CHANGEopenai-apiresidencyAdded UK (gb.api.openai.com) to data residency regions. Storage only: no regional processing in the UK.
  3. INFOcheckerrun116 sources fetched and diffed: 116 ok, 0 failed
  4. INFOopenai-apiresidencyfield re-checked against source: "US, EU, AU, CA, JP, IN, SG, KR, UK, UAE"
  5. INFOcheckerrun116 sources fetched and diffed: 116 ok, 0 failed
  6. ERRORgemini-apifetchonly 0 chars of text (likely JavaScript-rendered); previous snapshot keptcloud.google.com
  7. INFOcheckerrun115 sources fetched and diffed: 114 ok, 1 failed
  8. INFOgithub-copilotabuse_monitoringfield re-checked against source: "provider ZDR, except Claude Fable 5 / 5.1 (Anthropic retains)"
  9. INFOcheckerrun116 sources fetched and diffed: 116 ok, 0 failed
  10. ERRORopenai-apifetchHTTP 403; previous snapshot keptopenai.com
  11. ERRORopenai-apifetchHTTP 403; previous snapshot keptopenai.com
  12. ERRORcheckerfetchonly 0 chars of text (likely JavaScript-rendered); previous snapshot kept (no current field cites this URL)trust.mistral.ai
  13. WARNgemini-apicertificationsunverified: no official page stated this clearly
  14. WARNmistralhipaa_baaunverified: no official page stated this clearly
  15. WARNdeepseektrains_by_defaultunverified: no official page stated this clearly
  16. WARNdeepseekzdrunverified: no official page stated this clearly
  17. WARNdeepseekabuse_monitoringunverified: no official page stated this clearly
  18. WARNdeepseekcertificationsunverified: no official page stated this clearly
  19. WARNdeepseekhipaa_baaunverified: no official page stated this clearly
  20. WARNgroqself_hostunverified: no official page stated this clearly
  21. WARNopenai-codexzdrunverified: no official page stated this clearly
  22. WARNopenai-codexabuse_monitoringunverified: no official page stated this clearly
  23. WARNopenai-codexcertificationsunverified: no official page stated this clearly
  24. WARNjetbrains-aizdrunverified: no official page stated this clearly
  25. WARNjetbrains-aihipaa_baaunverified: no official page stated this clearly
  26. WARNopenrouterhipaa_baaunverified: no official page stated this clearly
  27. WARNopenrouterself_hostunverified: no official page stated this clearly
  28. WARNtogether-airesidencyunverified: no official page stated this clearly
  29. WARNfireworks-aihipaa_baaunverified: no official page stated this clearly
  30. WARNollama-cloudcertificationsunverified: no official page stated this clearly
  31. WARNollama-cloudhipaa_baaunverified: no official page stated this clearly
  32. WARNazure-openaicertificationsunverified: no official page stated this clearly
  33. WARNazure-openaihipaa_baaunverified: no official page stated this clearly
  34. WARNlangsmithhipaa_baaunverified: no official page stated this clearly
  35. WARNarizetrains_by_defaultunverified: no official page stated this clearly
  36. WARNarizehipaa_baaunverified: no official page stated this clearly
  37. WARNheliconetrains_by_defaultunverified: no official page stated this clearly
  38. WARNheliconehipaa_baaunverified: no official page stated this clearly
  39. INFOcheckerrun108 sources fetched and diffed: 105 ok, 3 failed
  40. INFOdatasetbaselinebaseline recorded: 25 tools, 200 fields, 113 cited pages

Every line comes from a file in the repo (changelog.json · snapshots/index.json · vendors.json). Dates only: the checker records the day, not the time. Last full check 2026-10-26: 121 sources fetched, 0 failed.

Source checks by tool

25 tools · 6 runs
  • OpenAI API2026-10-21: some sources failed2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched3/3–
  • Anthropic API (Claude)2026-10-21: all sources fetched2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched6/6–
  • Google Gemini API2026-10-21: all sources fetched2026-10-22: all sources fetched2026-10-23: some sources failed2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched4/4–
  • Mistral AI (Studio / API)2026-10-21: all sources fetched2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched7/7–
  • Cohere2026-10-21: all sources fetched2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched5/5–
  • xAI API (Grok)2026-10-21: all sources fetched2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched5/5–
  • DeepSeek API2026-10-21: all sources fetched2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched5/5–
  • Groq2026-10-21: all sources fetched2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched5/5–
  • Cursor2026-10-21: all sources fetched2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched5/5–
  • GitHub Copilot2026-10-21: all sources fetched2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched6/6–
  • Claude Code2026-10-21: all sources fetched2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched5/5–
  • OpenAI Codex2026-10-21: all sources fetched2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched4/4–
  • Windsurf (Devin Desktop)2026-10-21: all sources fetched2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched6/6–
  • JetBrains AI2026-10-21: all sources fetched2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched6/6–
  • OpenRouter2026-10-21: all sources fetched2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched4/4–
  • Together AI2026-10-21: all sources fetched2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched6/6–
  • Fireworks AI2026-10-21: all sources fetched2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched5/5–
  • Ollama Cloud2026-10-21: all sources fetched2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched3/3–
  • AWS Bedrock2026-10-21: no source in the checker index2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched3/3–
  • Azure OpenAI (Microsoft Foundry)2026-10-21: all sources fetched2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched4/4–
  • Langfuse2026-10-21: all sources fetched2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched6/6–
  • LangSmith2026-10-21: all sources fetched2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched5/5–
  • Braintrust2026-10-21: all sources fetched2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched4/4–
  • Arize (AX / Phoenix)2026-10-21: all sources fetched2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched4/4–
  • Helicone2026-10-21: all sources fetched2026-10-22: all sources fetched2026-10-23: all sources fetched2026-10-24: all sources fetched2026-10-25: all sources fetched2026-10-26: all sources fetched4/4–

history starts 2026-10-21 · 6 runs on record

One cell per nightly run, read from snapshots/index.json and its git history. Older runs are not reconstructed. “not idx” = pages a field cites that the checker has not fetched yet.

all sources fetched · some sources failed · all sources failed · no source in the checker index

Services

25 AI tools compared on 8 data-policy fields
OpenAI APIOpenAI · Model APIsno (Favourable)30 days (Caution)on approval (Favourable)can override ZDR (Caution)Singapore option (Favourable)SOC 2 Type 2 (Favourable)yes (Favourable)partial (open-weight gpt-oss only) (Caution)
Anthropic API (Claude)Anthropic · Model APIsno (Favourable)30 days (Caution)on request (Favourable)2 years if flagged (Caution)No APAC option (Neutral / n/a)SOC 2 Type I & II; ISO 27001; ISO 42001 (Favourable)yes (Favourable)no (hosted only) (Neutral / n/a)
Google Gemini APIGoogle · Model APIsdepends (Caution)'limited period' (not specified) (Caution)no (use Vertex AI) (Unfavourable)always on (paid) (Caution)No APAC option (Neutral / n/a)unverified (Unverified)no (PHI barred without Google's written consent) (Unfavourable)separate product (Gemini on GDC) (Caution)
Mistral AI (Studio / API)Mistral AI · Model APIsdepends (Caution)30 days (API, rolling) (Caution)on request (PAYG only) (Favourable)yes, 30 days (off with ZDR) (Caution)No APAC option (Neutral / n/a)SOC 2 Type II; ISO 27001/27701 (Favourable)unverified (Unverified)yes (open models) (Favourable)
CohereCohere · Model APIsdepends (Caution)30 days (Caution)on request (enterprise) (Favourable)flagged data reviewed (Caution)No APAC option (Neutral / n/a)SOC 2 Type II; ISO 27001; ISO 42001 (Favourable)yes (custom model development) (Favourable)yes (private deployment) (Favourable)
xAI API (Grok)xAI (pages now branded “SpaceXSI”) · Model APIsno (Favourable)30 days (Caution)yes (ZDR-enabled API) (Favourable)extends retention (non-ZDR) (Caution)No APAC option (Neutral / n/a)SOC 2 Type 2 (Favourable)yes (referenced) (Favourable)partial (older open weights) (Caution)
DeepSeek APIHangzhou DeepSeek Artificial Intelligence Co., Ltd. · Model APIsunverified (Unverified)not fixed (prompt cache: hours to days) (Caution)unverified (Unverified)unverified (Unverified)No APAC option (Neutral / n/a)unverified (Unverified)unverified (Unverified)yes (open weights) (Favourable)
GroqGroq · Model APIsno (Favourable)none by default (Favourable)yes (self-serve) (Favourable)up to 30 days, opt-out (Caution)No APAC option (Neutral / n/a)SOC 2 Type II (Favourable)yes (BAA addendum) (Favourable)unverified (Unverified)
CursorAnysphere (Cursor) · Coding toolsdepends (Caution)Privacy Mode: transient; off: stored (Caution)yes (Privacy Mode) (Favourable)exception applies (Caution)No APAC option (Neutral / n/a)SOC 2 Type II; ISO 27001; ISO 42001; AIUC-1 (Favourable)yes (Enterprise) (Favourable)partial (agent tool execution only) (Caution)
GitHub CopilotGitHub (Microsoft) · Coding toolsdepends (Caution)0 days (IDE) / 28 days (other) (Caution)partial (Caution)provider ZDR, except Claude Fable 5 / 5.1 (Anthropic retains) (Caution)APAC, not Singapore (Caution)SOC 2 Type II; ISO 27001 (Favourable)no (DPA bars PHI without consent) (Unfavourable)partial (CLI air-gapped, preview) (Caution)
Claude CodeAnthropic · Coding toolsdepends (Caution)30 days (commercial) (Caution)Enterprise, on request (Favourable)2 years if flagged (Caution)No APAC option (Neutral / n/a)SOC 2 Type I & II; ISO 27001; ISO 42001 (Favourable)yes (Favourable)partial (session runners, beta) (Caution)
OpenAI CodexOpenAI · Coding toolsdepends (Caution)follows workspace / API org settings (Neutral / n/a)unverified (Unverified)unverified (Unverified)Unverified (Unverified)unverified (Unverified)yes (local Codex only) (Favourable)partial (local OSS models) (Caution)
Windsurf (Devin Desktop)Cognition · Coding toolsdepends (Caution)deleted after output (MSA customers) (Favourable)on opt-out (paid) (Favourable)30 days for opt-in models (Caution)No APAC option (Neutral / n/a)SOC 2 Type II (Favourable)no (MSA bars PHI) (Unfavourable)no for new customers (Hybrid instead) (Neutral / n/a)
JetBrains AIJetBrains · Coding toolsdepends (Caution)1 year (if shared) (Caution)unverified (Unverified)yes, limited period (unspecified) (Caution)No APAC option (Neutral / n/a)SOC 2 Type II (Favourable)unverified (Unverified)yes (AI Enterprise on-prem) (Favourable)
OpenRouterOpenRouter · Inference hosts & routersdepends on provider (Caution)not logged by default (Favourable)yes (routing filter) (Favourable)depends on provider (Caution)No APAC option (Neutral / n/a)SOC 2 Type II (Favourable)unverified (Unverified)unverified (Unverified)
Together AITogether Computer · Inference hosts & routersno (Favourable)stored until deleted (default) (Unfavourable)yes (opt-in, org setting) (Favourable)none stated for content (uses metadata) (Favourable)Unverified (Unverified)SOC 2 Type 2 (Favourable)no (standard terms bar medical data) (Unfavourable)yes (Enterprise Platform) (Favourable)
Fireworks AIFireworks AI · Inference hosts & routersno (Favourable)none by default (open models) (Favourable)default (Favourable)none stated (no prompt logging for open models) (Favourable)No APAC option (Neutral / n/a)SOC 2 Type II; ISO 27001, 27701, 42001 (Favourable)unverified (Unverified)partial (BYOC, private preview) (Caution)
Ollama CloudOllama · Inference hosts & routersno (Favourable)transient (Favourable)default (Favourable)none stated (prompts never logged) (Favourable)No APAC option (Neutral / n/a)unverified (Unverified)unverified (Unverified)yes (local Ollama) (Favourable)
AWS BedrockAmazon Web Services · Inference hosts & routersno (Favourable)none by default, with model-specific exceptions (Favourable)default (most models) (Favourable)model-specific (Caution)Singapore option (Favourable)SOC 1/2/3; ISO 27001 (+27017/27018/27701); FedRAMP Moderate; CSA STAR L2 (Favourable)yes (HIPAA eligible) (Favourable)no (AWS-managed) (Neutral / n/a)
Azure OpenAI (Microsoft Foundry)Microsoft · Inference hosts & routersno (Favourable)stateless; flagged samples stored (Caution)on approval (modified abuse monitoring) (Favourable)human review of flagged samples (Caution)Unverified (Unverified)unverified (Unverified)unverified (Unverified)no (Azure-hosted) (Neutral / n/a)
LangfuseLangfuse · Eval & monitoringno (Favourable)indefinite unless configured (Unfavourable)n/a (Neutral / n/a)n/a (Neutral / n/a)APAC, not Singapore (Caution)SOC 2 Type II; ISO 27001 (Favourable)yes (HIPAA region, Pro+) (Favourable)yes (open source) (Favourable)
LangSmithLangChain · Eval & monitoringno (Favourable)14 days (base) / 180 days (extended) (Caution)n/a (Neutral / n/a)n/a (Neutral / n/a)APAC, not Singapore (Caution)SOC 2 Type 2 (Favourable)unverified (Unverified)yes (Enterprise add-on) (Favourable)
BraintrustBraintrust · Eval & monitoringno (Favourable)configurable (Neutral / n/a)n/a (built-in model endpoints are ZDR) (Neutral / n/a)n/a (Neutral / n/a)No APAC option (Neutral / n/a)SOC 2 Type II (Favourable)yes (Favourable)yes (self-host or BYOC) (Favourable)
Arize (AX / Phoenix)Arize AI · Eval & monitoringunverified (Unverified)15 days (Free) / 30 days (Pro) / custom (Caution)n/a (Neutral / n/a)n/a (Neutral / n/a)Unverified (Unverified)SOC 2; ISO 27001; PCI DSS (Favourable)unverified (Unverified)yes (Phoenix, free) (Favourable)
HeliconeHelicone · Eval & monitoringunverified (Unverified)7 days / 1 month / 3 months / forever by plan (Caution)partial (Omit Logs) (Caution)n/a (Neutral / n/a)No APAC option (Neutral / n/a)SOC 2 (Type II per pricing page) (Favourable)unverified (Unverified)yes (open source) (Favourable)

Data endpoints

free to reuse
$ curl -s https://rebuildlab.github.io/where-do-my-prompts-go/data.json | jq '.vendors[] | select(.slug=="openai-api") | .fields.trains_by_default'
{
  "value": "no",
  "quote": "As of March 1, 2023, data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us).",
  "source": "https://platform.openai.com/docs/guides/your-data",
  "checked": "2026-10-21"
}

Contribute

issues

Weekly policy changes. Confirm by email. Unsubscribe anytime.

Powered by Buttondown