Trust and compliance · 2026-09-08

No Training on Inputs: How to Read That Commitment

Understand what a no-training commitment covers, where it carries exceptions, and why prompt retention and training use are separate questions for developers to assess.

Explanatory diagram separating the training commitment, prompt retention period and abuse monitoring clauses in an LLM API data policy.

Three separate questions, not one sentence

Whether inputs are used for training and whether they are retained are different questions, and most discussions blur them. A provider may not train on your data while still keeping it for a period for abuse monitoring.

A third question joins them: is there human review, and under what conditions does it engage? Keep all three on separate lines in your assessment; one checkbox does not answer them.

Look at the scope of the commitment

The scope of a sentence matters more than the sentence. Does the commitment cover API traffic only, or also the trial interface and playground use? Does the same policy apply on the enterprise plan and the free tier?

Different policies on free or trial tiers are common and are not a sign of bad faith; they are a reason to read the tier you are actually on. Record which tier you use alongside that tier's policy.

What you can verify

This commitment is not something you can verify technically from outside. There is no test that shows your data did not enter a training set. The assessment therefore rests entirely on the contract text and on what follows if the provider breaks it.

For the models in this category, processing inside the European Union is what the provider states; LLMTR has not independently verified it. The same logic applies to the training commitment: the provider states it, you contract for it, and you do not claim to have verified it.

Practical habits that reduce the risk

However solid the contract, there is nothing to worry about in data you never sent. The most effective control is reducing what enters the request to the minimum the task requires.

The cost is usually lower than teams expect: masking personal fields, sending only the relevant passage of a document and pseudonymising identifiers rarely hurt output quality. The habit also reduces token cost.

  • Reduce personal data in the request to what the task actually needs.
  • Send pseudonyms instead of real identifiers.
  • Send the relevant passage of a long document rather than the whole file.
  • Record which tier you are on and that tier's data policy.

Frequently asked questions

Does a no-training commitment mean nothing is retained?

No. These are separate clauses. A provider may not train on your data while still retaining it for a period for abuse monitoring or a legal obligation. Ask about the retention period separately.

Can I verify this commitment by testing?

No. There is no reliable external method that shows your data did not enter a training set. The assessment rests on the contract text and the consequences of a breach.

Why can the policy differ on a free tier?

Providers often apply different data policies to paid and free tiers. That is common practice; what matters is knowing which tier you are on and reading that tier's text.

Related posts