Turn a vendor answer into a usable record.
- 01AskName the exact product and plan.
- 02LocateSave the source, setting, and date.
- 03ResolveAssign each unanswered question.
AI vendor data questions should leave you with a dated record of how one product handles your files and chats. Ask about training, storage and who can see the data. Check what changes when you delete it or turn on a feature. Give each open question an owner to follow up.
This worksheet helps a team gather sources and pass questions to the right person. It does not certify a vendor or tell you if a tool meets the law. It does not approve sensitive data use. Follow your team’s process for those choices. The sample task is a draft based on public product pages.
Identify the exact product and workflow
Record the vendor, product name and plan. Note the account type and region, if there is a choice. List the features switched on. Then add the task and the data it needs. “Draft a summary of public product pages in our team’s managed chat account” gives a clear scope. “Use AI for work” does not.
Give a chat app and an API setup their own records, even if they share a brand. Make rows for add-ons and tools that connect to other apps too. An answer for one service should not fill a row for a different service unless the source covers both.
Anthropic’s commercial data-retention page sets out different rules for API data and chats saved for later use. It also notes exceptions and rules for feedback. This is why the exact service matters. We checked that page on October 23, 2026. We have not tested whether the service works as described.
Record separate answers to separate questions
Use one row per question. Link to the source section, note when you read it, and name the product it covers. If a vendor replies by email, keep the actual reply in your team’s record. Mark the parts it answers and the parts that still need a reply.
| Question to ask | What a useful answer identifies |
|---|---|
| What material enters the service? | Prompts, uploaded files, retrieved content, outputs and any other task data |
| Is any of it used to train or improve models? | Covered data, stated defaults, exceptions and available controls |
| What is stored, and for how long? | Each relevant data category, retention period or condition, and exceptions |
| Who can view or retrieve it? | User, workspace administrator, support and other documented access paths |
| What changes when we delete it? | User-visible removal, backend handling and stated exclusions |
| Which optional features send material elsewhere? | Search, connectors, agents, external services and their separate terms |
| What happens when we submit feedback or seek support? | Included content and any different handling or retention |
| What happens when the account or service ends? | Export options, offboarding steps and the documented deletion process |
These prompts help you gather facts. They are not a full security review. Give each row a state: “source found,” “asked vendor” or “does not apply, with reason.” A blank cell means no answer is on file. It must not be read as a good answer by default.
Name both the person who gathers the source and the person who can approve the data use. They may have different roles. A sheet full of links does not prove that the right person has reviewed the plan. Add a field for that step so no one has to guess.
Distinguish model training from storage
A no-training claim answers one question about model use. By itself, it does not say if the service saves chats. It does not say who can view them or how long they stay. Ask those questions too, even if you find the answers on the same page.
Microsoft’s Copilot data page for organizations says prompts, responses and Microsoft Graph data do not train foundation models. The page also describes saved chat history and retention controls for admins. Both can be true. Do not turn “not used for training” into “nothing is saved.”
Keep each retention period with its scope and exceptions. One period might cover a saved chat. Another might cover a file or a feedback report. Name the data type next to the number. If the source gives a condition instead of a fixed time, keep that wording and ask how it fits your task.
Follow the data through optional features
Draw the data path. Start with what the user types or uploads. Show which app receives it and which other services read or get data. End with the person who gets the output. Put a source link beside each service. A missing link is a question for the vendor or your team’s owner.
Microsoft’s same Copilot page says agents can have their own privacy statements and terms. It also describes web queries sent to Bing. Check the features you plan to use. An answer about the main app does not cover each linked service by default.
For a public-FAQ draft, note whether web search is on. Record any file uploads and whether a linked app can read private files. Ask the owner to check the actual settings. A vendor page says how a product works. It does not prove which settings your account uses today.
Turn vague answers into follow-up questions
Suppose a vendor replies, “We do not train on business data.” This is a made-up reply for this example, not a vendor quote. Put it in the training row. Ask which plan it covers if that is unclear. Leave the retention row open; the reply has not answered it.
A follow-up could ask: “For this plan and chat feature, what prompts, files and outputs do you keep after the chat? For how long? Where can we read the rules and exceptions?” Include the service name and feature list. This helps the vendor answer the case you plan to use.
Keep a reply as a source for review. If it conflicts with a published page, retain both and ask the owner to resolve the gap. Do not choose the answer you prefer. The workflow handoff template helps you pass on the question with its sources and the next step.
Close the record without pretending it is a certification
Close the fact-gathering task when each row has a source or an owner for the open question. Note who reviewed the record and what limits they set on the task. An open question stays open if the team drops the feature for now. It may matter when someone wants to turn that feature on later.
Keep this record where the task owner can find it. Recheck the rows that change when you switch plans, add a feature or see new terms. Before a trial grows, use the AI pilot scorecard to review its results. Good task results and clear data answers are two checks with different purposes.
No comments yet