Where Your Prompt Actually Goes

The short version

“We don’t train on your data” is the cheapest sentence in enterprise AI. It is also true, and incomplete. The questions that actually separate vendors are: where does the prompt go, who can read it, for how long, and what does the vendor do when one of its own claims turns out to be bigger than the mechanism behind it?

If you are the person who has to answer your security team’s questions about an AI tool, you have probably noticed that every vendor’s trust page says roughly the same four things. Here is what we publish instead, including the parts that are less flattering.

Where the prompt actually goes

When a WinIQ agent processes your document, the text of that prompt leaves our infrastructure and reaches a model provider. That hop is the part most trust pages describe last, or not at all, so we will start there: model calls go to Microsoft Azure OpenAI Service, on EU Data Zone deployments, in Sweden Central. There is no hop to a US API endpoint in that path.

We publish the provider list rather than describing it in general terms, because “enterprise-grade AI infrastructure” is a phrase that survives a change of provider and a sub-processor list does not. If the provider changes, the list changes, and that is the point of having one.

What “not used for training” leaves out

Customer content is not used to train foundation models. That commitment is real and contractual. It also does not cover the thing a data protection officer will ask about second, which is abuse monitoring.

Microsoft retains prompts and completions for up to 30 days for abuse monitoring, unless a modified-abuse-monitoring exemption has been granted. Ours is pending, so the standard regime applies today: that content is stored in the EU and is reachable by EEA-located human reviewers. Both facts are true of every customer on the platform right now.

Why this is on the upload screen and not only in a policy

The transparency obligation attaches at the moment content is collected, not at the bottom of a page nobody scrolls to. Our upload consent screen used to say only “document content is not used for model training” — true, and partial in the direction that flattered us. It now carries the retention window too. If a vendor’s disclosure lives exclusively in a PDF you have to request, that is worth noticing.

Isolation: which layers enforce, and which one only watches

Tenant isolation is usually presented as a single yes. In practice it is layers, and they do not all reach production at the same time. Ours:

Row-level security — enforcing

Postgres row-level security, with policies enabled and forced on the tenant tables, and the application connecting as a non-privileged role rather than as a superuser. That last detail is the one that makes the rest of it real; without it the policies are decoration.

AI guardrails — enforcing

Input and output checks run in enforce mode on the live environment, not in report-only.

Query-scope guard — monitoring mode

A third layer that checks every query carries the right organisation scope. It is deployed and watching, but it logs rather than blocks while it completes a clean observation window. We describe it as monitoring mode because that is what it is doing.

Audit trail — enforcing

AI completions are recorded with their classification and their provenance, which is what makes any of the above auditable after the fact rather than merely asserted.

We could describe all four as “tenant isolation” and be technically defensible. Naming the one that is still in monitoring mode costs us a tidier sentence and buys the only thing that matters in a security review, which is that the other three claims can be trusted.

The claim we deleted from our own product

A recent internal review turned up a sentence on our own upload screen: documents marked confidential would have a restricted retention policy applied. It read well. Nothing implemented it — the cleanup job deletes orphaned documents on one global schedule and reads no per-document policy, and two database columns existed to support the promise. One of them had never been written to or read from in its entire life; the other was written in five places and read in none.

There were two ways to fix that. Invent a retention period so the sentence becomes true, or delete the sentence and the dead columns. Inventing the period would have been a policy decision dressed up as an engineering one, so we removed the claim and said what is actually true: the classification is stored, and it does not currently change how long a document is kept.

The rule behind it

Sales and security material may only assert a control that traces to a deployed, tested mechanism. It is a boring rule that costs us a paragraph of marketing every few months, and it is the reason the four statements above are worth reading.

Five questions worth asking any AI vendor

Which provider receives the prompt, in which region? Not “where is data stored” — storage and inference are different questions and vendors routinely answer the easier one.
What is the abuse-monitoring or safety-retention window, and who can read that content? Almost every provider has one. A vendor that says there is none has either negotiated an exemption they can evidence, or has not read their own provider’s terms.
Which isolation controls are enforcing today, and which are in monitoring mode? The second half of that question is the one that produces useful answers.
Show me a claim you have removed. Any vendor operating honestly for more than a year has had to retract something. A vendor with no examples is either very new or not looking.
What happens to derived data — embeddings, indexes, caches — when I delete a document? Deletion stories that cover the original and not its derivatives are the most common gap in the category.

Transparency is a mechanism, not a tone

None of the above is a promise about intentions. Each item is either a deployed control or a published fact, and the ones that are not yet enforcing are labelled. If you want the detail rather than the summary, the no-training commitment, the data residency page and the trust centre carry it, sub-processor list included.

This is the same principle as how we talk about hallucinations: a system you can check beats a system that sounds confident.

Bring your security team to the demo

The questions above are the ones we would rather answer early. Ask them on the call, with your DPO in the room.

Request a Demo