Demonstration • Public-source evidence, not a client assessment • October 8, 2026

Example: AI provider data-retention boundary

What can a buyer verify from primary-source vendor documentation, and what still requires an account-specific review? These are illustrative findings, not an audit of any customer organization.

Source-backed observations

OpenAI API: OpenAI states API inputs and outputs are not used for training by default. Standard abuse-monitoring logs may persist for up to 30 days, with feature-specific application-state handling and zero-data-retention eligibility subject to conditions. Primary source: OpenAI API data controls.
Anthropic API: Anthropic states standard API inputs and outputs are deleted within 30 days, subject to exceptions. Approved zero-data-retention terms do not automatically cover all Anthropic products or Files API use. Retention source and ZDR scope source.
Google Cloud Vertex AI: Google states it does not use customer data to train managed AI models without permission or instruction. Its documented feature-specific exceptions include certain grounding retention and optional session resumption. Primary source: Vertex AI retention.

Evidence classification

DOCUMENTED: The vendors published the statements linked above. UNKNOWN: Which exact product, endpoint, feature, region and negotiated terms a customer uses. UNVERIFIED: Whether the customer configured logs, caching and tool subprocessors as intended. A vendor statement is not proof of a particular customers runtime behavior.

Five customer-specific validation questions

Which API route, product tier, model and optional features actually execute?
What contract, data-processing addendum, and provider/subprocessor version apply?
Where do requests, results, logs, caching and tool outputs travel and persist?
Which retention and exception settings are actually enabled in the customer account?
What operator, source record, configuration snapshot or provider confirmation proves the claimed boundary?

Inspect live-retrieved source URL and SHA-256 capture metadata. This is a limited public-source sample, not the complete paid report. A paid review additionally maps the actual customer workflow, tests evidence completeness, records owner-assigned remediation, and independently validates conclusions. Request a fixed-scope review.