What actually happens to your files in an AI-assisted workflow: retention, training use, NDA coverage, and the questions to ask any vendor.
View references (1) ↓The risk is the tool, not the concept
Security depends on the specific service, account settings, features and agreement. A consumer chat account and an enterprise API may have different controls; neither label alone proves that a particular file is suitable to upload.
Separate model-training use from retention, access and transfer location. A no-training policy is not a zero-retention policy. For example, OpenAI documents default API abuse-monitoring retention and separate eligibility for reduced-retention controls; verify the endpoint and configuration actually proposed for your project.
The questions that actually distinguish vendors
Does content get used to train models? Where is it stored, and for how long? Does NDA coverage extend to the linguists and reviewers, or only to the company you contract with? What happens to the files at project end?
That third question separates providers more than any other. A vendor whose NDA covers only the corporate entity, while work is distributed to freelancers under no equivalent obligation, has a gap where it matters most.
Record the service and endpoint, subprocessors, transfer and storage locations, retention of files and logs, deletion exceptions, permitted users and evidence of the selected settings. An NDA does not itself configure these controls or establish compliance with privacy law.
How we handle it
Our published confidentiality policy describes need-to-know access and confidentiality obligations for the people handling the work. If your project requires no training use, tell us before sharing files so the processing route and terms can be confirmed.
Before sending sensitive files, agree any client NDA and special requirements for AI use, personal data, location, retention or destruction. ISO 17100 and ISO 9001 are not information-security certifications and do not establish a particular data residency or zero-retention configuration.
Before files change hands
For regulated or sensitive data, confirm the processing route first. If the proposed controls do not meet your requirements, resolve the gap before sharing the files.
| Ask for | Evidence to record |
|---|---|
| Training use | Policy, contractual terms and relevant opt-in settings. |
| Retention and location | Endpoint-specific storage and log rules, locations and deletion exceptions. |
| Access and confidentiality | Named roles, subcontractor obligations and signed special terms. |
Questions
Will our documents be used to train an AI model?
Does your NDA cover the individual translators?
Can you work under our NDA rather than yours?
What happens to our files after delivery?
Sources
- OpenAI — API data controlsExample of a provider distinguishing training use, abuse-monitoring logs and feature-specific storage. This does not verify Angel’s account settings.