DEV Community

rene
rene

Posted on

Does your LLM vendor retain your prompts? A 4-check audit you can run in 60 seconds

#ai #privacy #compliance #devtools

You are building on OpenAI, Anthropic, Mistral or another LLM API. Your privacy policy says what you do with customer data. Does it say what your LLM vendor does with it?

Most small SaaS trust pages are silent on four things that GDPR/CCPA reviewers and enterprise security questionnaires now ask about:

  1. Named LLM vendor – do you name the model provider as a subprocessor?
  2. Prompt retention term – how long does the vendor keep prompts and completions (0 days? 30 days? "as needed"?)
  3. Training opt-out – are your customers' prompts excluded from model training, and is that stated in writing?
  4. Subprocessor list – is the LLM vendor on your subprocessor list, with its purpose and region?

A 60-second self-audit

Open your own privacy policy, DPA and subprocessor page and score each of the four checks pass/fail. In my own reading of public trust pages from small AI-chat SaaS vendors, the usual score is 1/4 or 2/4: the vendor is named, the subprocessor row exists, but retention and training opt-out are missing. That is the gap a customer's security review will find.

A typical scorecard looks like this:

(1) named vendor     PASS
(2) retention term   FAIL  no statement of how long prompts are stored
(3) training opt-out FAIL  no written opt-out
(4) subprocessor row PASS  listed, but silent on region
Result: FAIL - 2/4
Enter fullscreen mode Exit fullscreen mode

Why it matters

  • Compliance: Article 28 GDPR requires you to know and disclose how a processor handles personal data. An unstated retention term is an open finding.
  • Sales: enterprise buyers send questionnaires that ask exactly these four questions. A trust page that already answers them shortens the deal.
  • Lock-in: once you know the retention and training terms, switching vendors becomes a documented decision instead of a guess.

Fix it in an afternoon

For each failing check, add one sentence to your privacy policy or DPA, sourced from the vendor's own data-usage page (for example OpenAI's data controls guide; Anthropic and Google publish equivalents). Then add the vendor to your subprocessor list with purpose and region.

Re-run the four checks after every edit and keep the dated result next to your DPA, so the next questionnaire is a copy-paste instead of a scramble.

Which of the four checks does your own trust page fail today?

This article was written with AI assistance and checked by the author.

Top comments (0)