Direct sources. Clear status. Practical public information.
Reviewed November 14, 2026 · defensive use on systems and data you own or are authorized to manage.
OWASP’s current LLM02:2025 guidance recommends data sanitization, clear terms of use and retention policies, and opt-out controls for using user data in model training. An opt-out is useful evidence, but it does not answer every question about retention, human review, sharing, deletion, logs, connectors, or legal obligations.
Seven-field evidence card
| Field | Record exactly |
|---|---|
| Service and plan | Product, plan/tier, region where relevant, and account type. |
| Workspace | Personal, team, enterprise, API project, or other exact boundary. |
| Policy version | Controlling terms/privacy/data-controls page and observed date. |
| Training-use default | What the provider states for this exact service/plan/workspace. |
| Control state | Opt-out or equivalent setting, scope, saved state, and screenshot/export where permitted. |
| Owner and proof | Authorized reviewer, evidence location, and verification date. |
| Recheck trigger | Policy, plan, workspace, owner, connector, region, or product change. |
Build-first action
- Classify the data before upload; keep secrets, credentials, private keys, regulated records, and unnecessary personal data out.
- Use synthetic or redacted reproductions when possible.
- Verify the setting inside the exact authorized account/workspace.
- Record retention, sharing, deletion, connector, and access controls separately.
- Test with non-sensitive data, repair gaps, retest, and preserve evidence.
Stop point: If the data classification, provider terms, setting scope, or organizational authority is unclear, do not upload the material. Use an approved isolated environment or the responsible security/privacy review route.
This article does not certify any AI service, setting, privacy program, or compliance outcome. Provider policies and interfaces can change.
Sources
Public-information notice: This Pulse is a dated, source-linked research summary for general educational use. It reports what the cited controlling sources state as of the review date. Citation does not imply endorsement, partnership, certification, or independent confirmation of every third-party assertion. This is not individualized legal, tax, accounting, investment, cybersecurity, licensing, regulatory, procurement, employment, real-estate, medical, or other professional advice. Rules, facts, availability, settings, and eligibility can change. Reopen the controlling source, confirm the jurisdiction and effective date, and use the responsible agency or a qualified professional before a consequential decision.