Links are not yet activated.
Is this your press release? Add a link to submitpr.org on your website and verify it — activation is instant and free.
Or upgrade once for permanent activation (from $19.95, pay with crypto).
What does it mean when one of your vendors says it has a “zero data retention” policy? Thephrase describes one company, and your customers’ data may reach several others. Thisarticle will help you ask your CTO the right questions.Your CRM and your support desk hold your customers’ data, and products of both kinds now come with AIfeatures. When your team asks a vendor where that data goes, one answer is that the vendor uses its AI model”with zero data retention.”
That answer describes one setting at the company that supplies the vendor’s AI model. It does not describethe other companies that process the same data for the vendor, and the vendor’s own pages name some ofthem.
Meaning of the phrase
Zero data retention is a setting that AI model providers such as OpenAI and Anthropic offer to their customers,and here the customer is your vendor. With the setting, OpenAI leaves the customer’s content out of the logs ituses to monitor for abuse. Without it, OpenAI keeps those logs for up to 30 days, or longer where the law orthe protection of its services requires it.
The providers’ own documents list exceptions. Anthropic says that if its automated safety systems flag asession, it may keep the inputs and outputs for up to two years, even with the setting in place.
The documents we read describe the setting as one between a model provider and its customer. They do notdescribe copies of the same data that other companies hold.
Suppliers behind a vendor
HubSpot, a CRM vendor, publishes a list of the companies that process data for its AI features, and OpenAI is one of them. An archived copy of that page from June 2023 does not mention OpenAI, and a copy from December 2023 does. HubSpot offers notice of changes to customers who opt in. OpenAI in turn publishes its own list of suppliers.
Published incidents
Three published cases involve customer data exposed through an integration, a supplier or a database whose owner the report could not name.
In September 2025 Cloudflare reported that an attacker had taken data from its Salesforce system through the Salesloft Drift chat integration. Cloudflare said the data included the text of its support cases.
In November 2025 OpenAI said an attacker had exported a dataset from Mixpanel, an analytics provider it used. The information that may have been affected included names and email addresses of OpenAI’s API users. OpenAI said its own systems were not breached. Mixpanel does not appear in the archived copies of OpenAI’s supplier list that we read.
In March 2026 ExpressVPN published researcher Jeremiah Fowler’s account of “3 separate publicly exposed databases that were not password-protected nor encrypted.” The page lists 1,442,577 “audio recordings of customers and their text transcripts,” and Fowler writes that in the sample he reviewed “all of the files contained references to Sears Home Services.” He describes the data as coming from “an AI virtual assistant used for scheduling, customer support, phone calls, and online chats.” He also writes that “it is not known whether the database was owned and managed directly by them or by a third-party contractor.”
Responsibility of a regulated firm
For financial firms in the European Union, the Digital Operational Resilience Act has applied since January 17, 2025. Its scope includes insurers, payment institutions and electronic money institutions.
The regulation says a financial firm that uses outside technology services “shall, at all times, remain fullyresponsible for compliance with, and the discharge of, all obligations under this Regulation and applicablefinancial services law.” It gives the firm’s management body “the ultimate responsibility for managing thefinancial entity’s ICT risk.” It also requires the firm to keep a register of its contracts for such services. Eachcontract has to state where the data is processed and stored, and whether the provider may subcontract aservice that supports a critical or important function.
Firms outside the European Union or outside finance answer to other rules, and this article does not coverthem.
Frequency and cost of breaches
Verizon’s 2026 Data Breach Investigations Report counts breaches of every kind and reports third-partyinvolvement at 48%, which it says is “up from 30% last year.”
IBM’s 2025 Cost of a Data Breach Report covers 600 organizations and puts the global average cost of abreach at $4.44 million. In IBM’s summary, “13% of organizations reported breaches of AI models orapplications,” and “Of those compromised, 97% report not having AI access controls in place.” Both reportscount breaches in general.
Each question below has a document that answers it, and your CTO or the person who buys these tools canask for it or prepare it.
1.Which of our vendors use AI on our customers’ data, and which AI companies does each vendor name asa supplier? The document is our own list with those companies named.
2.Which vendors have shown us the model provider’s written confirmation of zero data retention, and whichexceptions apply to each?
3.Do we receive each vendor’s notice when its supplier list changes? Where a vendor offers no notices, thedocument is a dated copy of its list.
4.Which company stores the recordings and transcripts of each AI assistant that talks to our customers?
5.What have we told our own customers about where their data goes, and who rereads that statement whena vendor’s list changes?
6.For a financial firm in the European Union, does our register of technology contracts include thesevendors, and does each contract state where our data is stored and whether the vendor may subcontract?
SOURCES
OpenAI, data controls guide: https://developers.openai.com/api/docs/guides/your-data
Anthropic, API and data retention: https://platform.claude.com/docs/en/manage-claude/api-and-data-retention
Zendesk, sub-processor policy: https://support.zendesk.com/hc/en-us/articles/4408883061530
HubSpot, sub-processors page: https://legal.hubspot.com/sub-processors-page
OpenAI, sub-processor list: https://openai.com/policies/sub-processor-list/
Cloudflare, response to the Salesloft Drift incident, September 2, 2025: https://blog.cloudflare.com/response-to-salesloft-drift-incident/
OpenAI, Mixpanel security incident, November 26, 2025: https://openai.com/index/mixpanel-incident/
ExpressVPN, research page on Sears Home Services: https://www.expressvpn.com/research/searshomeservices-data-exposed
European Union, Regulation (EU) 2022/2554 on digital operational resilience for the financial sector: https://eur-lex.europa.eu/eli/reg/2022/2554/oj
Verizon, 2026 Data Breach Investigations Report: https://www.verizon.com/business/resources/T1c7/reports/2026-dbir-data-breach-investigations-report.pdf
IBM, Cost of a Data Breach Report 2025, summary of July 30, 2025: https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls
Questions? Ask our team
Alexander Milovidov alex(at)emundata.com
Vasiliy Bezlyudnyy vasiliy(at)emundata.com
Alexandre Zakharenko alexandre(at)emundata.com
EMUNDATA.COM
NOVEMBER 10, 2026