Claim vs. evidence
- Claim
- “Your data is never used to train models.”
- Evidence reviewed
- Master agreement, DPA, provider sub-processor terms, logging configuration walkthrough
- Finding
- The commitment holds for the vendor's own training but the underlying provider tier in use does not carry the same term for a subset of traffic.
- Confidence
- Moderate
- Investment impact
- The assurance your risk committee relied on is narrower than stated. Require the enterprise provider tier in writing and a named sub-processor list before execution.