LLMs, GenAI, RAG, agents, evaluation · insight-1616
Record vendor data terms per endpoint, because retention differs inside one provider
- Evidence type
- practitioner heuristic
- Difficulty
- easy
- Roles
- Applied AI, ML engineer, Data scientist
- Industries
- banking, public-sector
Summary: situation, action, reason, boundary
Situation
Procurement approved a model provider, and teams now use its chat, batch, file, fine-tuning and embedding endpoints.
Action
Keep a vendor register at endpoint level: what is stored, for how long, whether it is used for training, region, zero-retention eligibility and subprocessors. Date each row with the document version checked, re-check on a schedule and on every new endpoint, and let the gateway enforce which endpoints each feature may call.
Reason
Provider pages describe different lifetimes per feature. As read on 2026-10-12, OpenAI documents abuse-monitoring logs of up to 30 days by default, some endpoints that store no application state, and others whose objects persist until deleted.
Boundary
Any team using hosted models for data that has retention, residency or confidentiality requirements.
Symptom or risk
The review assumed one retention period for everything, but some features store objects until you delete them and zero-retention eligibility can differ by endpoint.
Exceptions
Self-hosted models, where your own storage policy applies instead.
Trade-offs
Vendor terms change, so the register needs an owner and a re-check cadence.
Pitfalls
Quoting the headline number from a marketing page, and treating a contract's data processing terms as identical to the API documentation.
Lessons and concepts
Claims and their sources
OpenAI's data-controls page, as read on 2026-10-12, says API data is not used for training unless the customer opts in, abuse-monitoring logs are kept up to 30 days by default, and retention differs by endpoint with some objects stored until deleted.