Trust Rank

“Anthropic may not train models on Customer Content from Services.” (Commercial Terms §B)

“Conversation content (your prompts and Claude's outputs) is not retained by default”; Zero Data Retention (on request) stores nothing at rest after the response. Flagged or legal-hold content may be kept up to 2 years.

“Anthropic will defend Customer … alleging that Customer's paid use of the Services … or Outputs … violates any third-party intellectual property right.” (carve-outs in §K.3).

The Claude API offers a data-residency control (the `inference_geo` parameter on /v1/messages), so you pin where inference runs. Zero-retention and HIPAA eligible.

“You can opt out from your prompts and generations being used to train Cohere models … at any time.” Opt-out available, but not off by default.

“We automatically delete logged prompts and generations after 30 days …”; Zero Data Retention (“we do not log any prompts or generations”) available on request.

SaaS §11(e) Copyright Assurance: “Cohere will defend, indemnify and hold harmless the Customer … against … Claims by a third party alleging that any Output infringes … any copyright rights.”

“Deploy through your virtual private cloud (VPC), on-premises setup, or dedicated, Cohere-managed Model Vault”, so it runs on any cloud (OCI, Azure, AWS, Google) and data stays in your region. SOC 2 Type II.

Paid Gemini for Google Cloud / Vertex: “Gemini doesn't use your prompts or its responses as data to train its models.” The free consumer tier does train.

Paid logs “retained for limited periods” for security and policy enforcement; a default caching window can be disabled. No customer-set zero-retention verified this pass.

“Our indemnity obligations now also apply to allegations that generated output infringes a third party's intellectual property rights … including copyright”, conditioned on responsible-AI practices, on GA models.

“We commit to storing customer data in customer-selected locations …”; “Customers control where and how data and models are stored … preventing deployments outside specified geographic boundaries.” Regions incl. US, Canada, NL, FR, UK, DE, BE, Japan, Singapore, Korea.

“Data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in).”

Abuse logs retained ≤30 days “unless longer retention is required by law”; Zero Data Retention offered for eligible customers.

Copyright Shield: OpenAI “can defend our customers and pay the costs … around copyright infringement … both to ChatGPT Enterprise and the API”, on paid tiers only, with carve-outs and a cap of roughly the prior 12 months' fees. OpenAI's own business-terms page returns 403 to us, so this rests on Proskauer's legal analysis.

Regional storage incl. Europe/EEA, UK, Japan, Australia, Canada, India, Singapore, South Korea, UAE (some options approval-gated).

“Alibaba Cloud strictly protects data privacy and never uses your data for model training.”

Inference is transient: “transient data is not persisted … Your static data always remains in the selected region.”

The Model Studio master Terms of Service was not retrievable in quotable form, and output indemnity is not addressed on the FAQ. No receipt, so no mark.

No receipt obtained this pass

International region hosts in Singapore: “Data must not pass through the Chinese mainland” and “static data always remains in the selected region.” ⚠ Chinese-parented (Alibaba), which is a sovereignty consideration despite the documented Singapore hosting.

Structural: the open-weight license grants use, reproduce and modify, and self-hosted prompts never transit Meta at all, so provider-side training is impossible by construction.

Structural: you host it, so there is nothing for Meta to retain. Zero-retention by construction.

“AS IS … WITHOUT WARRANTIES OF ANY KIND” incl. non-infringement, and the licensee indemnifies META, which is the reverse of a vendor IP shield.

Structural: runs wherever you run it, so you alone choose the region. License gate: products over 700M monthly active users need a separate Meta licence.

Paid: “Mistral AI will not use Customer Data or Outputs to train its … models”, except free and Vibe tiers where you have not opted out (Commercial Terms §4.2). The free tier trains by default.

Default 30-day retention, deleted after; Zero Data Retention exists but only on the Scale plan and stateless endpoints, not Vibe, Chat or agents.

Indemnity covers the Products' IP (§8.1). Model Outputs are not expressly indemnified, and a carve-out excludes modified Outputs (§8.2b).

“By default, your data is hosted in the European Union.” A US endpoint is available by explicit opt-in.

“AI21 will not train AI21 Models on Customer Content.” (Terms §7.8, with an “unless agreed otherwise in writing” carve-out.)

Deletion is post-termination, after the retrieval-right period (§13.5). No fixed short window and no zero-retention option documented.

You own the Output (§7.2), and AI21 indemnifies claims that authorised use of the System or Model infringes copyright or patent (§12.1). That is not an explicit output-IP indemnity.

Content “may be hosted and processed … in Israel, the United States, the EEA, the United Kingdom, and other locations” (§7.3), with a specific region available only via Order.

DPA: “The Company do not store any of the content the Customer or its End Users provide or generate while using our Services”, and API content is not used to train.

“This information is processed in real-time … and is not saved on our servers.” Real-time only for API content.

Verified absence: the privacy policy and DPA contain no output IP indemnity, warranty, or ownership language. None offered, rather than a gap in our receipts.

“We generally provide the Services from Singapore” (entity registered in Singapore). ⚠ Chinese-parented (Zhipu), which is a PRC-sovereignty consideration despite the documented Singapore hosting.

IBM does not use client content or model outputs to train its foundation models; “Clients can develop AI applications using their own data along with the client protections.”

watsonx trust and FAQ docs render as JavaScript shells or return 403. No verbatim retention window fetched.

No receipt obtained this pass

“IBM provides an IP indemnity (contractual protection) for its foundation models”, uncapped for IBM-developed models, and IBM does not require customers to indemnify IBM.

watsonx runs on selectable IBM Cloud regions, but the product and region pages returned 403 or JavaScript only. No verbatim residency quote fetched.

No receipt obtained this pass

“xAI never trains on your API inputs or outputs without your explicit permission.”

“API requests and responses are temporarily stored on our servers for 30 days …”; Zero Data Retention available for enterprise accounts.

Enterprise terms and DPA (x.ai/legal/*) return 403 to our verifier, and the only reachable consumer ToS runs indemnity from user to xAI. No customer output indemnity fetched.

No receipt obtained this pass

x.ai/legal enterprise terms and DPA blocked (403). No verbatim API residency statement fetched this pass.

No receipt obtained this pass

Paid requests are not used for training unless you opt in. The free tier trains by default: “Reka may use Your Content to train … its machine learning models.”

“Reka has no obligation to store any of Your Content” is a convenience disclaimer, not a documented zero-retention commitment. No receipt for a retention control.

No receipt obtained this pass

“Reka does not represent or warrant that you are the legal owner of the Output … You shall be solely responsible.” No output indemnity, so the risk sits with you.

“The Services are controlled and offered by Reka from its facilities in the United States”, so it is US-hosted, with a single region disclosed and no explicit residency commitment.

Uses inputs to improve and train: “This includes training and refining our underlying technology.” No opt-out documented, so training is the default.

“Account, input, and payment information are retained while your account is active”, so no fixed window and no zero-retention option.

Verified absence: no output IP indemnity, warranty, or ownership language in the published policy. None offered, rather than a gap in our receipts.

“We store the information we collect in secure servers located in Singapore.” ⚠ Chinese-parented (Moonshot AI, Beijing), which is a sovereignty consideration despite the documented Singapore servers.

Trains by default: input used “to train and improve our technology, such as our machine learning models.” An opt-out exists, but training is the default.

“We retain Personal Data for as long as necessary…”, so no fixed window and no zero-retention control.

Verified absence: no output IP indemnity, warranty, or ownership language anywhere in the published policy. None offered, rather than a gap in our receipts.

“We directly collect, process and store your Personal Data in People's Republic of China”, regardless of where you are, with no choice offered. A hard stop for many regulated enterprises.