Methodology
Not legal advice. AI Terms Tracker summarizes vendors' own public pages. It is not legal, compliance or security advice and does not replace reading your contract, DPA or the vendor's current documentation. Terms vary by plan, region and negotiated agreement, and they change.
What we record
For each of the 53 tools we record these fields for the vendor's business or enterprise offering:
- Trains on your data by default: Does the vendor (or its AI providers) use business-plan customer content to train or improve models without you opting in?
- Data retention: How long prompts, outputs or content are kept, as stated by the vendor.
- SOC 2 Type II: An independent SOC 2 Type II report is claimed on a vendor page.
- ISO/IEC 27001: Information security management certification.
- ISO/IEC 42001: AI management system certification.
- DPA available: A data processing addendum/agreement is offered.
- BAA / HIPAA: A HIPAA Business Associate Agreement or HIPAA support is offered.
- Data residency options: Customers can choose where data is stored or processed.
- Zero-retention option: Zero data retention is available (from the vendor or enforced with its model providers).
Rules
- Vendor sources only. We use the vendor's own trust center, security, privacy, help-center and terms pages. We don't use third-party reviews or news articles.
- Every field is sourced. Each answer links to the page it came from and the date we checked it.
- Unknown means unknown. If the pages we checked don't state something, we mark it Unknown and list the pages we read. We never infer or guess. Unknown does not mean the vendor lacks it.
- Training by default covers business plans. “Yes, opt-out” means the vendor says it may use business customer data for training or model improvement unless an admin opts out. “Depends on plan” means the default differs by tier or purchase channel. Notes explain any nuances, such as non-generative models or de-identified data.
- SOC 2 (type not stated) means the vendor claims SOC 2 but the page we checked doesn't say Type II.
Change monitoring
On every check we store a SHA-256 fingerprint of each source page's visible text. A later check that produces a different fingerprint flags the page for human review, and confirmed changes go in What changed.
Corrections
Vendors and readers can request a correction by pointing us to a vendor-published source. (A corrections inbox is coming soon.)