You ask an AI vendor a simple question — "what happens to our data?" — and you get a warm, confident answer: "Don't worry, we don't train on your data." Everyone nods. The meeting moves on. And you've just learned almost nothing about what actually happens to your information.
This usually isn't dishonesty. "We don't train on your data" is often perfectly true. The problem is that it answers one narrow question while leaving the ones that actually matter untouched. For anyone handling client files, patient records, or privileged material, the gap between that reassurance and the full truth is exactly where the risk lives.
The Reassurance That Isn't One
Training is only one of many things that can happen to the data you type into an AI tool. A vendor that never trains on your inputs might still store them, log them, keep them for months, route them through other companies, or let employees read them to "monitor quality." None of that is training. All of it is your data, sitting somewhere you can't see.
So when the whole data answer is "we don't train on it," the honest translation is: they've told you the one thing that sounds most reassuring and skipped the rest. Often that's not sinister — it's just the line that makes the conversation end.
Where Your Data Actually Goes
When you paste something into a typical AI assistant, here's the journey most people never picture: your text leaves your device, travels to the vendor's servers, and very often gets passed onward again — to the company that makes the underlying AI model. It may be written to logs, held in temporary storage for a stretch of time, and in some products, sampled by human reviewers checking for quality or abuse. Along the way it can pass through a handful of subcontractors, and depending on the vendor, cross into another country's servers entirely.
Every one of those steps can be handled responsibly. But each is a place your data exists outside your control — and "we don't train on it" describes none of them.
The One Question to Ask
You don't need to become a security expert to cut through this. One question does most of the work:
"Where does our data physically live, who can access it, does any of it leave our environment — and will you put that in writing?"
Then watch what happens. A vendor who has thought this through can answer plainly: here's where it's stored, here's how long, here's who touches it, here's the border it never crosses — and yes, it's in the contract. A vendor who gets vague, redirects back to "well, we don't train on it," or offers to "check with the team" has just told you something important. The willingness to put data handling in writing is the difference between a policy and a hope.
What Good Looks Like
The strongest answer of all is the simplest: your data never leaves your environment in the first place. When an AI system runs inside your own cloud or on your own hardware — grounded in your data without shipping it off to someone else's servers — most of those worrying intermediate steps simply don't exist. There's no third-party model quietly logging your inputs, because there's no round trip out of your walls.
That's the standard we build to at EMDELLE: AI where your data stays yours, in your environment, by design rather than by promise. It's the reason "data never leaves the room" is our first principle and not a footnote. (One mention, as always — this post is here to be useful, not to pitch.)
So the next time a vendor reassures you they don't train on your data, take the reassurance — then ask the real question. Where does it live, who can see it, and will you sign your name to that answer? What they say next will tell you far more than the line they led with.
See you next Friday — one more thing to learn.
— Tia Lake, Founder & First Steward