Back to the CIO and CSO starting point Security and GRC hub
Same AI Model, Different Guarantees by Access Path
An AI access path is the route a company uses to reach a model: a vendor API, a vendor seat, a cloud marketplace, or its own servers. Lightbridge.ai compares eight routes on what each vendor states about training, retention, abuse review, residency, logging, attestations and contract terms. Vendor statements are attributed to the vendor. Other readings are labelled.
Reviewed
Vendor statements change. Treat this page as a map of what each vendor said on the review date, then confirm every point in writing before you rely on it.
How Lightbridge suggests you read the comparison.
A model name tells you little about data handling. The operator, the contract and the product tier decide it. Anthropic, AWS, Google and Microsoft can each serve Claude, and each states different terms for training use, retention and review.
Every cell below is phrased as what the vendor states, with a source link. Where the documentation we reviewed is silent, the cell says so. We did not fill those gaps with inference. We do not recommend a route, and a gap is not a defect: it is a question for your account team.
On Google Vertex AI, the table describes the Google-managed route unless a cell says otherwise. On Azure, it covers Azure OpenAI and flags where Claude in Foundry differs. The Self-hosted column covers open-weight models you run yourself. A managed container service such as AWS SageMaker AI sits between that column and a hosted route, and we did not map it in full.
Lightbridge comparison: what each AI access path states, side by side.
Rows are the attributes a CIO or CSO asks about. Columns are the routes. Each cell is a vendor statement with its source, reviewed 2026-11-03.
Scroll sideways on small screens. The attribute column stays in view.
| Attribute | Anthropic API Claude, operated by Anthropic | Anthropic Team and Enterprise seats Claude apps and Claude Code | Amazon Bedrock Operated by AWS | Google Vertex AI Gemini Enterprise Agent Platform | Azure OpenAI and Foundry Operated by Microsoft | OpenAI API Operated by OpenAI | ChatGPT Enterprise Workspace product | Self-hosted You run the model |
|---|---|---|---|---|---|---|---|---|
| Training use by default | Anthropic states it does not use inputs or outputs from its commercial products, including the API, to train its models by default. It states explicit feedback or an opt-in can change this. | Anthropic states Team and Enterprise fall under commercial products, with no training by default. It states thumbs up or down feedback stores the conversation for up to 5 years and may be used for training. Owners can disable member feedback. Claude Code data usage docs · Anthropic privacy center: training | AWS states neither AWS nor third-party model providers use Bedrock inputs or outputs to train Amazon Nova, Amazon Titan or any third-party models. | Google states it will not use customer data to train or fine-tune models without the customer’s prior permission or instruction, for all managed models including GA and pre-GA. | Microsoft states prompts, completions and customer data are not used to train foundation models or improve Microsoft or third-party products without the customer’s permission, and are not available to OpenAI. For Claude in Foundry, the Microsoft page makes no statement on training use. Microsoft Azure OpenAI data privacy · Microsoft Claude in Foundry data privacy | OpenAI states API data has not been used to train or improve its models since March 1, 2023, unless the customer explicitly opts in. | OpenAI states it does not use business data for training by default and may use shared data only if the customer has explicitly opted in. | Ollama states that run locally it does not see the user’s prompts or data. The NCSC guidelines recommend being transparent with users about whether data is used for retraining. For a self-hoster, they say those decisions are made by the operator. |
| Default retention | Anthropic states it automatically deletes API inputs and outputs from its backend within 30 days, with listed exceptions: longer-retention services under customer control, an agreed arrangement such as ZDR, Usage Policy enforcement, and legal compliance. | Anthropic states deleted chats are removed from back-end storage within 30 days. It states Enterprise Owners can set a custom retention period (30-day minimum) and that data is retained indefinitely unless one is set. Anthropic privacy center: retention · Anthropic Enterprise custom retention | AWS states retention is configured per Region at account or project level, and in default mode each model’s own retention policy applies. For Claude Fable 5 and 5.1, AWS states prompts and completions are retained within the AWS boundary for up to 30 days. | Google states prompt logging for Partner and Open Models is off by default. It states published Gemini models cache data by default, deleted no later than 24 hours after writing, and that zero retention needs specific actions in each area. Google security controls page · Google zero data retention page | Microsoft states the models are stateless. Data stored for features such as Responses API, Threads, Files and Stored completions stays in the customer’s Azure tenant and resource geography, and the customer can delete it at any time. | OpenAI states abuse monitoring logs, which may contain prompts and responses, are generated for all API feature usage and retained for up to 30 days by default, unless law or protection of its services requires longer. | OpenAI states workspace admins control retention for ChatGPT Enterprise, and deleted conversations are removed within 30 days unless legally required. It states shorter retention may reduce product features. | Not stated in the documentation we reviewed for vLLM or Ollama. Retention is the operator’s decision, in Lightbridge’s reading. The NCSC guidelines recommend treating prompts and logs as sensitive assets. |
| ZDR eligibility | Anthropic states ZDR is requested through its sales team, is subject to approval, and is enabled per organization. It lists some features as not ZDR eligible, including Batch, Files API, Agent Skills and the MCP connector. It states Claude Fable and Mythos 5 and 5.1 models require 30-day retention unless expressly authorized. Anthropic API data retention docs · Anthropic ZDR products article | Anthropic states Team and Enterprise product interfaces are not ZDR eligible. The one named exception is Claude Code on Enterprise, a separate offering for qualified accounts, enabled by Anthropic after a sales request. | AWS defines mode none as zero data retention. For models that require retention, it states ZDR access is evaluated per account and per model through the AWS account manager. For Claude, it states eligibility is managed by Anthropic. It states eligible customers may request ZDR for OpenAI models other than gpt-oss. | Which Claude models are ZDR eligible is not stated in the documentation we reviewed. Google states Grounding with Google Search stores logs for up to three days with no way to disable storage, and that opting out of logging may not be possible for some Advanced AI features. Google zero data retention page · Google abuse monitoring page | The Microsoft page does not use the term zero data retention. It describes modified abuse monitoring (no abuse-monitoring storage or human review) as the opt-out, by application to customers managed by a Microsoft account team or an eligible program. Microsoft Azure OpenAI data privacy · Microsoft limited access page | OpenAI states ZDR is available to eligible customers with prior approval, handled via sales. It lists /v1/files, /v1/batches, /v1/fine_tuning/jobs, /v1/assistants, /v1/threads and /v1/vector_stores as not ZDR eligible. It reserves the right to make models ineligible for specific customers. | The sources we reviewed describe admin-controlled retention but do not offer ZDR for ChatGPT workspaces. They describe ZDR only for eligible API endpoints. | No provider program is described in the documentation we reviewed. In Lightbridge’s reading, when you run the weights entirely in your own environment with cloud features off, no model provider receives the prompts. |
| Abuse monitoring and human review | Anthropic states flagged content may be retained for up to 2 years even with ZDR. For chats flagged as violating the Usage Policy, it states classification scores may be kept up to 7 years. For Covered Models, it states human review occurs only through a controlled access path, by a small set of approved reviewers with each access logged. A customer switch-off is not stated in the documentation we reviewed. Anthropic API data retention docs · Anthropic privacy center: retention · Anthropic Covered Models retention article | Anthropic states that under Enterprise custom retention, content flagged by trust and safety systems may still be retained, and flagged chats are kept as in its commercial retention article. A customer switch-off is not stated in the documentation we reviewed. | AWS states Bedrock may use automated abuse detection and, in limited circumstances, store or review inputs and outputs. For Claude Fable 5 and 5.1, it states all traffic is retained up to 30 days and flagged traffic may get human review by AWS. Those models are unavailable unless the customer sets aws_review. | For Google’s own models not designated Frontier or Advanced AI, Google states it may log classifier-flagged prompts for up to 90 days, which authorized Google employees may assess, and that Cloud Master Agreement customers are exempt by default. Whether the 90-day logging applies to Claude on the Google-managed route is not stated in the documentation we reviewed. It lists Claude Mythos and Fable (all versions) as Advanced AI, plus Opus 4.7 and later and Sonnet 5 and later only when advanced_ai_enabled is true. For Advanced AI it states prompts and responses are logged up to 30 days, and opting out of logging may not be possible for some Advanced AI features. For Claude Fable 5 and Mythos 5, Google states prompts and responses are retained up to 30 days and that Anthropic requires the customer to enable sharing this data with Anthropic for abuse monitoring. | Microsoft states a sample of flagged prompts may be selected for review by default, reviewed by automated means with human review by authorized Microsoft employees as necessary. Approved modified abuse monitoring removes storage and human review, though automated review may continue. For Claude under Hosted on Azure, it states Anthropic personnel review content on an exceptions-only basis. Microsoft Azure OpenAI data privacy · Microsoft Claude in Foundry data privacy | OpenAI states Modified Abuse Monitoring, by approval, excludes customer content from abuse logs across API endpoints, other than image and file inputs in rare cases. It states stored data is accessible to authorized employees and to specialized third-party contractors who review for abuse. | OpenAI states authorized employees access Enterprise conversations only to resolve incidents, recover conversations with permission, or where required by law, and that business data may pass through automated classifiers. An opt-out is not stated in the documentation we reviewed. | Not stated in the documentation we reviewed for open-weight models. The Llama 3.3 license and Gemma Terms of Use, as reviewed, say nothing about licensor monitoring. The Gemma Terms reserve a Google right to restrict usage remotely or otherwise. |
| Data residency | Anthropic documents an inference_geo setting (global by default, or us) for Claude 4.6 and later at 1.1x pricing. It states us is the only workspace geo for storage at rest, and that by default it may route traffic to select countries in the US, Europe, Asia and Australia, with data stored in the US. Anthropic data residency docs · Anthropic privacy center: server locations | Anthropic states US-only inference is a setting for Enterprise organizations on usage-based plans. It does not appear on Team plans, and it does not control storage. Non-US options are not stated in the documentation we reviewed. | AWS states content is stored at rest in the Region where the customer uses Bedrock. Geographic cross-Region profiles keep processing within a geography. Global profiles may route to any supported commercial Region. | Google states data at rest stays in the customer-selected location. Multi-region endpoints keep ML processing within the stated region, such as US or EU. Global endpoints may process in any Google Cloud location and provide no residency guarantees. Per-model Claude regional support was not confirmed in our review. | Microsoft states processing stays in the customer-specified geography unless a Global or DataZone deployment is used. For both, data at rest stays in the designated geography. DataZone processes within the US, EU or APAC zone, and Microsoft can add regions to a zone without prior notice. Microsoft Azure OpenAI data privacy · Microsoft deployment types | OpenAI states data residency is a per-project setting subject to sales eligibility, storing content at rest in the selected region where an endpoint needs persistence, and not applying to system data. Regions outside the US require approval and a Modified Retention amendment. | OpenAI states data residency is available in ten regions, including Europe, the UK, Canada and Japan, for eligible new Enterprise and Edu customers. Inference residency is available for Europe, the US and the UAE, and non-GPU processing may still occur globally. | Not stated in the documentation we reviewed for vLLM or Ollama. In Lightbridge’s reading, location follows where the operator deploys. |
| Customer-visible logging | Anthropic states the Compliance API gives Enterprise and Console customers access to the Activity Feed. A per-request prompt and response log is not described on that page. | Anthropic states audit logs are Enterprise only, exportable for the past 180 days, and hold identifiers rather than chat content. It states the Compliance API covers chats, files, projects and session transcripts for Enterprise organizations. Anthropic audit logs article · Anthropic Compliance API docs | AWS documents model invocation logging of full request data, response data and metadata to the customer’s CloudWatch Logs or S3, disabled by default. It recommends CloudTrail for API activity. | Google states request-response logging to a customer BigQuery table is available for Gemini and Claude, disabled by default. For Claude it also describes logging token counts, latency and errors without storing prompts or responses. Google request-response logging page · Google Claude partner-model page | Microsoft states platform metrics and the activity log are collected automatically, and resource logs are not collected until the customer creates a diagnostic setting. Whether resource logs capture prompt content is not stated in the documentation we reviewed. | Customer-available API request logging is not stated in the documentation we reviewed. | OpenAI states the Compliance Platform for Enterprise and Edu provides immutable, append-only log events and an API for eDiscovery, DLP or SIEM tools. It states the Compliance Logs Platform retains data for 30 days. | In Lightbridge’s reading, logging is operator-owned. vLLM lists /metrics among endpoints that need no API key even when --api-key is set. The NCSC guidelines recommend logging inference requests and protecting those logs. |
| Attestation scope for this route | Anthropic’s Trust Center scope table marks “Claude via Anthropic’s API” as covered by SOC 2 Type 2, ISO 27001, ISO/IEC 42001 (Anthropic’s own attestation), CSA Star, HIPAA and NIST 800-171, and N/A for FedRAMP High, IL4 and IL5. It states HIPAA readiness is enabled per organization with a BAA. | Anthropic’s Trust Center marks Claude Enterprise as covered by the same list. It marks Claude Team as covered except HIPAA, which is N/A. FedRAMP High, IL4 and IL5 are N/A for both. | AWS states Bedrock is in scope for FedRAMP Moderate, SOC, ISO and HIPAA eligibility, and is CSA STAR Level 2 certified. This is service level. Scope for the Anthropic model route specifically was not confirmed in our review. Anthropic’s Trust Center lists separate partner-route rows; we did not map them. | Google states Google-managed Claude is covered by Google Cloud programs including FedRAMP High, IL4, IL5, SOC, ISO and HIPAA eligibility. The page names no model versions or report dates, and we did not verify it against Google’s scope pages. Anthropic’s Trust Center lists separate partner-route rows; we did not map them. Google Anthropic-managed Claude page · Anthropic Trust Center | The Microsoft page names no specific attestation for Models sold by Azure. It points to the Azure compliance offerings list, which we did not review. Anthropic’s Trust Center lists a separate Foundry row; we did not map it. Microsoft Azure OpenAI data privacy · Anthropic Trust Center | OpenAI states the API Platform has been audited and certified for SOC 2 Type 2, and that it can sign a BAA and a DPA. | OpenAI states ChatGPT Enterprise, Edu and Healthcare have each completed a SOC 2 Type 2 audit, and refers to its Trust Portal. Other attestations were not verified. | Not stated in the documentation we reviewed. Vendor and licensor statements on attestations for vLLM, Ollama, Meta or Google weights were not found. Scope depends on the environment you build. |
| Contract document carrying the commitment | Anthropic states its Commercial Terms say it may not train on Customer Content, and that data is processed under its Data Processing Addendum, incorporated by reference. | Anthropic’s privacy center points to the Commercial Terms for commercial offerings. Whether the Team and Enterprise seat agreements reference those exact Terms is not shown on the page we reviewed. | AWS states Anthropic models on Bedrock fall under the Anthropic on Bedrock Commercial Terms on the AWS third-party models page, with the Anthropic DPA incorporated. The AWS Service Terms treat third-party models as Third-Party Content. | Google cites the Training Restriction in the Service Specific Terms and the Cloud Data Processing Addendum. It states Anthropic models are governed by Anthropic’s Commercial Terms or another agreement with Anthropic. We did not fetch the underlying terms. Google zero data retention page · Google abuse monitoring page | Microsoft states its Products and Services Data Protection Addendum governs data processing for Models sold by Azure, under the customer’s Azure subscription terms and Product Terms. For Claude in Foundry, it states use is subject to Anthropic’s terms. Microsoft Azure OpenAI data privacy · Microsoft limited access page · Microsoft Claude in Foundry data privacy | OpenAI states it can execute a Data Processing Addendum for the API, and a BAA on request. The governing services agreement is not named in the documentation we reviewed. | OpenAI states it can execute a Data Processing Addendum. We did not locate the Enterprise services agreement itself. | The model license. The Llama 3.3 license and the Gemma Terms of Use (not Gemma 4, which the Terms say has its own license) carry use restrictions. The Llama 3.3 license provides the materials as-is and contains no data-handling or patching commitment. Apache 2.0 provides the work as-is and adds no data-handling commitment. Read the license of the model you deploy. |
Vendor statements are the vendors’ own, drawn from the linked pages and reviewed on 2026-11-03. NCSC guidance and readings marked as Lightbridge’s are labelled in the cells. Page dates, where shown, range from March 2025 to November 2026 (for example, Azure data privacy 2026-05-19, OpenAI enterprise privacy 2026-01-08). Some pages carry no page-level date.
What Lightbridge advises you to ask for in a contract.
These requests come from the gaps and exceptions in the table above. They apply to any route.
- Name the governing document, and confirm it covers the product you buy. Anthropic’s privacy center points to the Commercial Terms, yet the page we reviewed does not show that the Team and Enterprise seat agreements reference them. Ask the account team to confirm in writing which agreement governs which product.
- Get the training commitment in contract text, not only in a help article. Anthropic and Google each cite contract language (Commercial Terms; the Training Restriction in the Service Specific Terms). In Lightbridge’s reading, a privacy article can change without a contract amendment. Ask for the clause reference.
- Ask for retention per model, not per vendor. Anthropic states Claude Fable 5.1, Mythos 5.1, Fable 5 and Mythos 5 are Covered Models that require 30-day retention (Anthropic retention docs). AWS states Claude Fable 5 and 5.1 on Bedrock are retained up to 30 days and unavailable without aws_review (Bedrock abuse detection docs). Google states Advanced AI models log for up to 30 days (Google abuse monitoring page). A vendor-wide answer can hide a model-level exception.
- Ask what ZDR excludes. Anthropic lists features outside ZDR (Batch, Files API, Agent Skills, MCP connector; retention docs). OpenAI lists endpoints outside ZDR (files, batches, fine-tuning, assistants, threads, vector stores; API data controls). Azure describes stateful features that keep data in the tenant until deleted. Google states Anthropic-managed Claude on Google Cloud creates a separate Anthropic organization, and ZDR from an existing first-party organization does not carry over (Google Anthropic-managed Claude page).
- Ask who can see flagged content, and for how long. Flagged-only retention: Anthropic states up to 2 years with classification scores up to 7 years; Google states up to 90 days for standard models. All-traffic retention: AWS states Claude Fable 5 and 5.1 on Bedrock are retained up to 30 days, and OpenAI states abuse logs are generated for all API usage and kept up to 30 days by default. Ask whether your contract type changes the answer: Google states Cloud Master Agreement customers are exempt from standard-model prompt logging by default.
- Separate residency at rest from residency in processing. Azure and Google both distinguish the two, and both state global options give up processing guarantees. Ask for the deployment type or endpoint in writing, any price uplift (Anthropic states 1.1x for US-only inference on Claude 4.6 and later, per its data residency docs; OpenAI states a 10% uplift on data residency endpoints for models released on or after March 5, 2026, per its API data controls), and notice terms. Microsoft states it can add regions to a DataZone without prior notice (Microsoft deployment types).
- Ask which logs you get, and whether they are on. Bedrock invocation logging, Google request-response logging and Azure resource logs are each described as off until configured. Confirm who turns them on, where they land and what they contain.
- Match attestation scope to your route, by report and date. Anthropic scopes its attestations by product row. AWS states its attestations at service level. Microsoft points to a list. Ask for the report that names the service you will use, and its period.
- Ask how you will be told when terms change. AWS states ZDR for Claude Fable 5 and 5.1 under its Enterprise Frontier Safeguards program runs through December 31, 2026, after which all traffic is retained up to 30 days (Bedrock abuse detection docs). Terms carry end dates. Ask for a change-notice clause.
What Lightbridge checks before relying on a vendor statement.
A documentation page is evidence, not a guarantee. Four checks turn it into something a CIO can defend.
- Confirm the statement is about your route. Claude appears behind several operators. AWS states Claude Platform on AWS content is processed by Anthropic outside AWS, a different offering from Bedrock. Google describes an Anthropic-managed route and a Google-managed route with different operators and processors. Microsoft describes Hosted on Azure and Hosted on Anthropic Infrastructure options for Claude. A statement about one is not a statement about the others.
- Compare the ZDR-excluded feature lists. Anthropic lists Batch, Files API, Agent Skills and the MCP connector as not ZDR eligible. OpenAI lists files, batches, fine-tuning, assistants, threads and vector stores. A feature you plan to use may sit outside the commitment you are buying.
- Look for model-level and feature-level exceptions. Anthropic’s feature eligibility table marks Batch, Files API, Agent Skills and the MCP connector as not ZDR eligible. AWS states Claude Fable 5 and 5.1 are unavailable on Bedrock unless the customer accepts human review. Both are model-level or feature-level exceptions.
- Verify the setting in the product, not only the page. Anthropic states ZDR can be confirmed in Console under Settings, Privacy Controls, Data retention period (Anthropic ZDR article). Microsoft states an approved customer can verify modified abuse monitoring through a ContentLogging capability set to false (Microsoft data privacy page). AWS defines mode none as zero data retention (Bedrock data retention docs).
How Lightbridge advises on AI route selection.
Lightbridge is an independent advisory and program-management firm. For route selection it works with the CIO, CSO and counsel to classify the data the program will touch, map each class to the vendor statements above, and write the question list your account teams must answer in writing. Lightbridge then manages that review through selection, contracting and rollout. Who builds is decided per engagement, and any Lightbridge practice that would do the work is disclosed upfront.
This page recommends no vendor. It does not rate the vendors against each other. It belongs to the Lightbridge security and GRC advisory hub, and pairs with the shadow AI guide. For the wider AI program, see Lightbridge AI advisory and AI consulting. For who builds what, read AI consulting firm vs AI development shop.
Lightbridge FAQ: AI access paths and data guarantees
Is the same model identical across every access path?
The model name can be the same while the operator, contract and data handling differ. Anthropic states Claude Team and Enterprise seats are not ZDR eligible, while its API offers ZDR by approval. AWS states Claude Fable 5 and 5.1 on Bedrock are retained up to 30 days and subject to potential AWS human review. Microsoft states Claude in Foundry has Anthropic as seller, operator and independent data processor. Lightbridge advises treating each route as a separate contract and a separate risk profile.
Does a no-training statement mean my data is not retained?
No. Training and retention are separate commitments. Anthropic states it does not train on API data by default, and it also states API inputs and outputs are deleted within 30 days, with exceptions. OpenAI states API data is not used for training unless the customer opts in, and also states abuse monitoring logs are retained up to 30 days by default. Read the retention and abuse monitoring rows next to the training row.
Which routes offer zero data retention?
Vendors describe it differently. Anthropic states ZDR for its API is requested through sales and enabled per organization. AWS defines a ZDR mode and states eligibility is evaluated per account and model. OpenAI states ZDR is available to eligible customers with prior approval. Microsoft describes modified abuse monitoring rather than ZDR. For Google-managed Claude, the documentation we reviewed does not say which models are ZDR eligible. For ChatGPT Enterprise, the sources we reviewed do not offer it.
Can a customer turn off abuse monitoring or human review?
Only some vendors describe a path. Microsoft and OpenAI describe approval-based modified abuse monitoring. AWS states human review is a condition of access for Claude Fable 5 and 5.1, so it cannot be declined for those models. Google states opting out may not be possible for some Advanced AI features. For Anthropic, a customer switch-off is not stated in the documentation we reviewed. Even where an exception exists, vendors state they may still retain flagged content.
Does a data residency option mean my data never leaves the region?
Not necessarily. Vendors separate storage at rest from where processing happens. Microsoft states Global deployments may process in any Azure region where the model is deployed, while data at rest stays in the designated geography. Google states global endpoints provide no data residency guarantees. OpenAI states data residency does not apply to system data. Ask which of storage, inference, retention and abuse review each setting actually governs.
Do vendor attestations cover the specific route I use?
Not always. Anthropic scopes its attestations by product row, and marks Claude Team N/A for HIPAA while Enterprise is covered. AWS states its attestations at service level, and we did not confirm the Anthropic model route. Microsoft names no specific attestation on the page we reviewed. Treat an attestation as a lead for a document request, not as proof for your route.
Is self-hosting a way to avoid these questions?
It moves the questions to your team. When you run open weights entirely in your own environment with cloud features off, no model provider receives the prompts, in Lightbridge’s reading. You still take on retention, logging, network exposure and patching. vLLM documentation states multi-node communication is insecure by default and the --api-key flag covers only some endpoints. The Llama 3.3 license provides the materials as-is and, as reviewed, contains no data-handling or patching commitment. Lightbridge advises costing those duties before comparing a self-hosted route with a managed one.
How does Lightbridge help a CIO or CSO choose a route?
Lightbridge is an independent advisory and program-management firm. It maps your data classes and obligations to the vendor statements, builds the contract question list, and manages the review through selection and rollout. Who builds is decided per engagement, with any Lightbridge practice disclosed upfront. Lightbridge does not recommend a vendor on this page.
Talk to Lightbridge about your AI access route.
Bring the data classes and obligations. Lightbridge will map them to what each vendor states and manage the review to a decision.