Layer 2 · Compare
The Public Grid
One row per assessed offering, one column per observation, across the whole population. A buyer looks up a supplier and reads what that supplier has published, in the same columns as everybody else. It is free, and it stays free.
Document Class: Segment Report
- Assessed
- 111 organisations, 147 offerings
- Evidence Cutoff
- 2026-07-29 to 2026-08-15 — per row, never one date for the register
- Method Generations
- v1.6 × 130 · v1.4 × 12 · v1.1 × 5
- Standards Commits
- 38 distinct, one recorded on every row
- Standard
- GLOBAL-Entity-Grid-Standard-v1.1.md
- Built
- 2026-08-15
Segment Scope
In: every offering whose fact record passed validation and carries the row class Observed — 147 rows across 111 organisations.
Out: 51 Variant rows, which are named in their own band below but carry no cells; and every Counterfactual row, which is internal and is never emitted at all.
On what basis: the row-class publication gate. A grid builder that simply iterated the source records would emit rows nobody measured — on the thirteen-entity pilot it produced nineteen rows for thirteen organisations, four of them fabricated, two of which made an organisation look better than its evidence supported. The gate is applied by the builder itself rather than inherited from the validator, because a consumer that trusts an upstream check is a consumer with no check.
What This Grid May Not Be Used For
It Is Not A Rating, A Score, A Grade Or A Ranking
Every cell is a publication state. There is no total, no average and no league position, and none may be computed from it. The rows are alphabetical for that reason, and no other ordering is offered.
It Is Not A Compliance Determination
Nothing here alleges that any organisation has breached any law. An Absent cell records that a document was not found on the public record at a stated date, by a stated method.
It Is Not A Substitute For The Deep Dive
The grid carries no limitations table, no right of reply and no evidence. A decision about a named supplier is taken on that supplier's own assessment. The grid's job is to tell a buyer which assessment to read.
No Cell May Be Quoted Without Its Date And Its Generation
A cell without its evidence cutoff and its method generation is not a fact, it is a claim. Both travel on every row here, and both are carried into the row's full reading.
How To Read A Cell
AdverseA finding on the public record.
PartialDisclosed, but incompletely.
StrongDisclosed and closed.
NeutralMeasured; the field does not apply.
Not MeasuredNever assessed. An unchecked field is not a clean one.
An Empty-Looking Answer Has Three Meanings, And They Never Render Alike
- Absent — measured; the organisation does not publish it. This is a finding.
- Never Asked — the method generation that produced the row never put the question. The cell names the generation, so a reader knows which rows compare with which. This is a fact about our coverage.
- Not Researched — the reference set does not cover the organisation on that question at all. This is a fact about the reference set.
A fourth answer is not an absence: Does Not Arise means the question was put and does not apply to the offering — there was never anything that could have been published. It bands Neutral and is a completed reading, not a gap.
Retention147
AI Input Retention
Retention Detail
None Named230 days after the end of the provision of Services (DPA §9, Deletion of Personal Data); Chat Completions API specifically holds zero retention.130 days default; 5 years de-identified if training is on; 2 years if Usage-Policy-flagged.130 days post-termination deletion/return, subject to legal/dispute/harmful-use carve-outs.130/90 days by upload type; else session-only.1365 days (Joule interaction data, default retention). Conversation-log storage is opt-in by admin consent; a conversation expires after 24 hours or 8 hours of inactivity, whichever comes first. Changeable only by SNOW ticket to component CA-Joule-CI.190 days (Free) - 30 days (Paid) - zero (Enterprise, processed exclusively in memory) - customer-controlled (Self-hosted). Sub-processor hops not stated190 days post-termination (DPA §10).1
| Organisation | Offering | AI Input Retention | Retention Detail | Retention Disclosure | As At | Reading |
|---|---|---|---|---|---|---|
| ADP | ADP | Not Addressed | Not Measured Under Method v1.4Never Asked | Absent | 2026-07-31v1.4 | |
| Airwallex | Airwallex Platform (Business Accounts, Payments, Spend, Billing, Platform APIs and Embedded Finance) | Not Addressed | None Named | Period Published | 2026-08-10v1.6 | |
| Amazon Web Services | Amazon Web Services — global commercial cloud platform, including Bedrock, Q and SageMaker | Customer-Controlled | No AI-Input-specific period; DPA Section 14 gives 90 days post-termination for Customer Data. | Criteria Only | 2026-08-13v1.6 | |
| Anthropic PBC | Claude Developer Platform / Claude for Work / Enterprise (API, Commercial Terms + DPA) | Period Published | 30 days post-termination deletion/return, subject to legal/dispute/harmful-use carve-outs. | Period Published | 2026-08-06v1.4 | |
| Anthropic PBC | Claude.ai / Claude Free, Pro, and Max (Consumer) | Period Published | 30 days default; 5 years de-identified if training is on; 2 years if Usage-Policy-flagged. | Period Published | 2026-08-06v1.4 | |
| Asana | Asana work management platform (asana.com), default configuration with Asana AI enabled | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-11v1.6 | |
| Atlassian | Atlassian Cloud (Jira, Jira Service Management, Confluence, Bitbucket, Trello, Loom, Opsgenie, Statuspage, Compass, Jira Align, Jira Product Discovery, Atlassian Intelligence and Rovo) | Period Published | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-10v1.6 | |
| Auth0 | Auth0 Customer Identity Cloud (contracted, Master Subscription Agreement plus executed Data Processing Addendum) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-07v1.6 | |
| beehiiv | beehiiv (newsletter and publishing platform, including beehiiv AI features) | Not Addressed | No retention period, and no retention criterion, is published for the beehiiv AI writing/text/image/translation features on any surface read. The privacy policy's general retention section (Section 11) is criteria-based and does not name the AI features specifically. | Criteria Only | 2026-08-13v1.6 | |
| Black Kite | Black Kite Platform (hosted third-party cyber risk intelligence, blackkite.com) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-08v1.6 | |
| Box | Box (core content and collaboration platform, including Box AI) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-13v1.6 | |
| Calendly | Calendly (scheduling platform, Notetaker and hosted MCP server) | Criteria Only | Notetaker recaps: "Recaps will stay available for as long as your account exists." No period stated for AI prompts or provider-side inputs. | Bare Restatement Of The Test | 2026-08-11v1.6 | |
| Canva | Canva Platform — Free / Pro individual account | Not Addressed | Not Measured Under Method v1.6Never Asked | Period Published | 2026-08-13v1.6 | |
| Cerebras | Cerebras Inference and Training-as-a-Service (cloud.cerebras.ai / inference.cerebras.ai / api.cerebras.ai) — Cerebras CS-3 on-premises hardware and software-for-hardware are a separate offering and are out of scope of this assessment | Criteria Only | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-13v1.6 | |
| CISO Adapt | CISO Adapt (Cyberensic Pty Ltd) | Not Addressed | Not Measured Under Method v1.1Never Asked | Bare Restatement Of The Test | 2026-07-29v1.1 | |
| ClariDuty 365 | ClariDuty 365 | Not Addressed | None Named | Absent | 2026-08-13v1.6 | |
| Clay | Clay Platform (hosted, clay.com) — data enrichment, AI research agents and outbound workflow automation | Not Addressed | Not Measured Under Method v1.6Never Asked | Not Measured Under Method v1.6Never Asked | 2026-08-11v1.6 | |
| ClickUp | ClickUp hosted platform, including ClickUp Brain, Super Agents, Ambient Agents, AI Notetaker, Enterprise Search and the first-party MCP server | Not Addressed | Zero Data Retention is defined in the AI Additional Terms, but only for healthcare workflows, and only where a Business Associate Agreement is in place and ClickUp has confirmed the account is set up for healthcare AI use. No retention position is published for AI inputs or outputs in the general case. | Criteria Only | 2026-08-10v1.6 | |
| Cloudflare | Cloudflare Platform (self-serve and Enterprise, cloudflare.com) | Customer-Controlled | AI Gateway logs are on by default and capture the user prompt and the model response. Storage is bounded by a plan-based log count, not by a published time period. The customer may disable logging in gateway settings or per request with the cf-aig-collect-log: false header. No retention period is published for Workers AI inputs. | Criteria Only | 2026-08-07v1.6 | |
| Comp AI | Comp AI Platform (compliance automation for SOC 2, ISO 27001, HIPAA and GDPR; includes a first-party MCP server) | Not Addressed | Not Measured Under Method v1.6Never Asked | Bare Restatement Of The Test | 2026-08-13v1.6 | |
| Confluent | Confluent Cloud | Not Addressed | No retention period, criterion or deletion commitment for AI inputs or outputs was found on any of the six AI documentation surfaces read. The Streaming Agents architecture page describes a 'Session Store' that 'Maintains conversation state and context' and states that 'All tool interactions are logged', with no period attached to either. | Criteria Only | 2026-08-15v1.6 | |
| CoreWeave | CoreWeave Cloud Platform (GPU/AI infrastructure-as-a-service, inclusive of CoreWeave Inference and CoreWeave AI Object Storage; Weights & Biases MLOps operates under CoreWeave's own Privacy Policy following the completed acquisition) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-13v1.6 | |
| Databricks | Databricks Data Intelligence Platform (hosted Platform Services and Support Services, all supported clouds) | Criteria Only | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-11v1.6 | |
| Datadog | Datadog (observability, security and Bits AI agent platform, datadoghq.com) | Period Published | Per docs.datadoghq.com/data_security/data_retention_periods/ (retrieved 2026-08-15, paraphrase not verbatim): Bits Chat messages retained 15 months; Bits Code source-code inputs retained 7 days; Bits Investigation retained for the duration of the account. No period specific to what is sent to the third-party AI subprocessors (Anthropic, OpenAI) themselves is stated — these are Datadog's own retention windows for the feature, not the upstream model provider's. | Period Published | 2026-08-15v1.6 | |
| DataGrail | DataGrail Platform (hosted, app.datagrail.io) | Period Published | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-08v1.6 | |
| DeepSeek | DeepSeek chat app, web app, and Open Platform API (single global service, no regional or hosting variant published) | Criteria Only | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-15v1.6 | |
| Deputy | Deputy Workforce Management Platform | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-07v1.6 | |
| Docusign | Docusign eSignature and the Intelligent Agreement Management platform (hosted, docusign.com), including the in-product AI features | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-11v1.6 | |
| Docusign | The Docusign MCP server (Open Beta, mcp.docusign.com) — 22 production tools served to an AI assistant the customer brings | Not Addressed | Not Measured Under Method v1.6Never Asked | Not Measured Under Method v1.6Never Asked | 2026-08-11v1.6 | |
| Dropbox | Dropbox Dash | Period Published | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-11v1.6 | |
| Dropbox | Dropbox For Teams | Period Published | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-11v1.6 | |
| ElevenLabs | ElevenLabs Enterprise (Business/Processor Relationship, Custom Data Residency) | Customer-Controlled | Enterprise deletion at termination: 30 days (per DPA Section 9.2, as summarised in the vendor's own compliance material). Data residency (EU, India, Singapore, or the US default) is Enterprise-selectable, subject to availability and ElevenLabs' discretion. | Period Published | 2026-08-15v1.6 | |
| ElevenLabs | ElevenLabs Self-Serve (Free, Starter, Creator, Pro, Scale, Business — Individual/Non-Enterprise) | Period Published | Voice-derived data not kept longer than 3 years after last interaction, except as required by law. Opt-out from training is prospective only — does not affect Content already used prior to the opt-out request being processed. | Period Published | 2026-08-15v1.6 | |
| Employment Hero | Employment Hero Platform (Employment OS — HR, payroll, workforce management, AI Recruitment Agent, ATS, EH Work app, EH Jobs) | Criteria Only | No published period. DPA cl 2.1.6 binds AI Service Providers not to retain 'beyond what is necessary to return the relevant output'; the AI Services Statement adds that data processed through external implementation tooling 'is deleted from those systems upon completion of your onboarding'. | Criteria Only | 2026-08-11v1.6 | |
| Fathom | Fathom AI meeting assistant (web application, desktop and mobile applications, meeting recording bot, Fathom REST API, MCP server, webhooks and customer-configured CRM integrations) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-14v1.6 | |
| Ferrox Labs | Ferrox Labs Corporate Site | Not Addressed | Not Measured Under Method v1.4Never Asked | Absent | 2026-08-03v1.4 | |
| Ferrox Labs | Flux Router (Ferrox Labs) | Criteria Only | a limited operational period, for a PII-redacted (scrubbed) copy of the request and its metadata; expressly not zero-retention, no period stated | Absent | 2026-08-03v1.4 | |
| Ferrox Labs | Wayland (Ferrox Labs) | Not Addressed | Not Measured Under Method v1.4Never Asked | Absent | 2026-08-03v1.4 | |
| Fillout | Fillout (forms, scheduling, workflows, AI form builder, Form Agent) and Zite app building — one platform operated by Restly, Inc. | Not Addressed | Not Measured Under Method v1.6Never Asked | Bare Restatement Of The Test | 2026-08-14v1.6 | |
| Fireflies.ai | Fireflies.ai Platform (meeting transcription and notes, Voice Agents, AI Skills, AI Assistant, Slack Assistant and public API) | Period Published | Not Measured Under Method v1.6Never Asked | Period Published | 2026-08-15v1.6 | |
| Fireworks AI | Fireworks AI Platform | Period Published | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-11v1.6 | |
| Fivetran | Fivetran SaaS data movement platform, including Fivetran Activations (formerly Census), Context Layer and Agent Context MCP (both Public Preview) | Not Addressed | Not Measured Under Method v1.6Never Asked | Period Published | 2026-08-11v1.6 | |
| Formstack | Formstack Forms, Documents, Sign and Workflows (including Forms for Salesforce and Documents for Salesforce), operated under a single Software Services Agreement, DPA and Privacy Policy by Intellistack, LLC (formerly Formstack, LLC); the same instruments and the same published sub-processor list also cover the Intellistack Streamline and Formsite product lines, confirmed on the same sub-processor table | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-15v1.6 | |
| GitHub | GitHub platform and GitHub Copilot, volume-licensed (Enterprise, Business, GitHub Customer Agreement) | Criteria Only | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-07v1.6 | |
| Google Cloud | Google Workspace and Google Cloud Platform (single Cloud DPA; also covers Cloud Identity, SecOps, Looker) — consumer products out of scope | Not Addressed | Not Measured Under Method v1.6Never Asked | Period Published | 2026-08-13v1.6 | |
| Groq | GroqCloud AI Inference Platform (console.groq.com / api.groq.com / GroqChat), including the Compound agentic system — Groq LPU hardware sales and on-premises/offline-terms deployments are a separate offering and out of scope of this assessment | Period Published | Up to 30 days for inference and Batch endpoints (system reliability and abuse monitoring / application state) — ZDR-eligible; Fine-tuning endpoint data retained until customer deletion — ZDR-eligible if the feature is disabled. All retention is customer-controllable: Zero Data Retention (ZDR) is available to every tier (Free, Developer, Enterprise) and can be toggled globally or per feature by an org admin at any time. | Period Published | 2026-08-15v1.6 | |
| Haast | Haast Compliance Platform (AI-powered marketing and communications compliance review, pre-publication content scanning, live digital-footprint monitoring, and regulatory horizon scanning) | Not Addressed | No period and no criteria specific to AI processing are published anywhere. The one retention clause in the Privacy Policy ('for as long as necessary for the purposes set out in this privacy notice') is general to all personal information and does not mention AI, model inference, or the compliance-review pipeline at all. | Bare Restatement Of The Test | 2026-08-13v1.6 | |
| HighLevel | HighLevel Inc. | Not Addressed | Not Measured Under Method v1.4Never Asked | Criteria Only | 2026-07-31v1.4 | |
| HubSpot | HubSpot CRM / Marketing / Sales / Service / Content / Operations Hubs (hosted, hubspot.com), including Clearbit-brand enrichment products and HubSpot AI features | Criteria Only | No period is published. HubSpot AI knowledge-base material states 'zero data retention with third party AI service providers wherever possible' — a qualified criterion, not a stated period. | Criteria Only | 2026-08-13v1.6 | |
| Intercom | Intercom customer service platform — default (United States) hosting, including Fin AI Agent, Fin Voice AI Agent, Copilot, the Intercom MCP server and Data Connectors | Not Addressed | Not Measured Under Method v1.6Never Asked | Bare Restatement Of The Test | 2026-08-11v1.6 | |
| iubenda | iubenda Privacy & Cookie Policy Generator and surrounding legal/consent product suite (Privacy Controls and Cookie Solution, Consent Database, Data Subject Rights Management Tool, Whistleblowing Management Tool, Accessibility Widget) | Not Addressed | Not Measured Under Method v1.6Never Asked | Period Published | 2026-08-13v1.6 | |
| Jotform | Jotform (hosted form-builder platform, jotform.com) | Criteria Only | AI Terms bound retention to the purpose of providing AI Functionality; no numeric period is published. The Terms separately disclaim control over what third-party AI Providers do with data once transmitted to them. | Criteria Only | 2026-08-13v1.6 | |
| LinkedIn Platform — Individual Member (linkedin.com, core service) | Customer-Controlled | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-13v1.6 | ||
| Loom | Loom on the Atlassian platform (Loom AI available) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-11v1.6 | |
| Lunary | Lunary Cloud (app.lunary.ai) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-11v1.6 | |
| Mailgun | Mailgun Platform (Sinch Email) — hosted API and dashboard, EU region selected | Customer-Controlled | Not Measured Under Method v1.6Never Asked | Period Published | 2026-08-11v1.6 | |
| Make | Make Cloud Platform (hosted, make.com) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-10v1.6 | |
| Microsoft | Microsoft Enterprise Cloud Services (Microsoft 365 incl. Copilot, Entra, Azure incl. Azure AI Foundry, Dynamics 365, Power Platform) — default configuration | Customer-Controlled | Microsoft 365 Copilot and Copilot Chat prompts and responses are retained subject to the customer's own Microsoft Purview retention policies once configured; audit of interactions is supported. No entity-wide default retention period for Copilot prompts/responses is published outside of customer configuration. Azure AI Foundry / Foundry Models: prompts and completions are stated not to be stored by the system for training purposes; no general retention period for inference logs is published on the surfaces read. | Criteria Only | 2026-08-15v1.6 | |
| MiniMax | MiniMax Open Platform (API) and consumer AI products, no plugin connector | Not Addressed | Not Measured Under Method v1.6Never Asked | Absent | 2026-08-15v1.6 | |
| Miro | Miro cloud platform (Free, Starter, Business and Enterprise plans, including Miro AI and the Miro MCP Server) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-14v1.6 | |
| Mistral AI | Mistral AI Studio / La Plateforme API (Commercial, Governed By Commercial Terms + DPA) | Period Published | API default: Input/Output retained only as long as needed to generate the Output, then thirty (30) rolling days for abuse monitoring (unless zero-data-retention is activated). Agents API: retained until account termination. Fine-Tuning API: retained until the customer deletes it from Mistral AI Studio or terminates the account. | Period Published | 2026-08-15v1.6 | |
| Mistral AI | Mistral Vibe (Consumer/Prosumer Chat And Agent — Formerly Le Chat) | Customer-Controlled | Vibe: Input and Output are kept until the user deletes the conversation or deletes the account — no fixed calendar period stated for this product specifically. | Period Published | 2026-08-15v1.6 | |
| monday.com | monday.com Work OS — Platform Services (work management, CRM, dev, service, WorkCanvas, WorkForms, monday code) | Period Published | Up to 60 days for interaction data used to monitor and improve the Services; administrator opt-out available | Criteria Only | 2026-08-10v1.6 | |
| MongoDB | MongoDB Atlas (hosted Cloud Services) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-11v1.6 | |
| Moonshot AI | Kimi consumer assistant (kimi.com and Kimi apps, operated by Beijing Moonshot Technology Co., Ltd.) | Criteria Only | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-15v1.6 | |
| Moonshot AI | Kimi Open Platform / API and Kimi Business enterprise cooperation, including the Kimi Code CLI agent tool (platform.kimi.ai, operated by Moonshot AI PTE. LTD., Singapore) | Criteria Only | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-15v1.6 | |
| Morph | Morph (AutoInfra, Inc.) | Period Published | 90 days (Free) - 30 days (Paid) - zero (Enterprise, processed exclusively in memory) - customer-controlled (Self-hosted). Sub-processor hops not stated | Period Published | 2026-07-31v1.4 | |
| MYOB | MYOB Acumatica (enterprise ERP) | Not Addressed | Not Measured Under Method v1.6Never Asked | Absent | 2026-08-10v1.6 | |
| MYOB | MYOB Business (Lite, Pro, AccountRight, Payroll Only) | Not Addressed | Not Measured Under Method v1.6Never Asked | Absent | 2026-08-10v1.6 | |
| MYOB | MYOB Business API and Developer Program (third-party acting surface) | Not Addressed | Not Measured Under Method v1.6Never Asked | Absent | 2026-08-10v1.6 | |
| MYOB | MYOB Payment Services | Not Addressed | Not Measured Under Method v1.6Never Asked | Absent | 2026-08-10v1.6 | |
| n8n | n8n Cloud (hosted, app.n8n.cloud) | Criteria Only | No period is published. The AI Terms bound retention by a criterion only: n8n will not retain Customer Content 'beyond the time required for AI Feature processing and delivery of Output to Customer'. No retention period is published for AI Assistant conversation history on any surface read. | Criteria Only | 2026-08-07v1.6 | |
| Notion | External Agents in Notion — Claude agents and Cursor agents | Period Published | Zero-retention expressly does not apply. Anthropic stores Claude Managed Agent session data between requests; Cursor sessions run under Cursor's own retention policy, which Notion states the customer configures directly | Criteria Only | 2026-08-10v1.6 | |
| Notion | Notion Calendar and Notion Mail | Not Addressed | Not Measured Under Method v1.6Never Asked | Period Published | 2026-08-10v1.6 | |
| Notion | Notion workspace and Notion AI (hosted, notion.com / notion.so) | Period Published | Zero retention for Enterprise plan workspaces; 30 days or fewer for all other plans; data-retaining models off by default and administrator-switchable | Period Published | 2026-08-10v1.6 | |
| Nous Research | Nous Research (Nous Research, Inc.) | Not Addressed | Not Measured Under Method v1.4Never Asked | Absent | 2026-07-31v1.4 | |
| NVIDIA | NVIDIA AI Enterprise / DGX Cloud / Omniverse on DGX Cloud / NVIDIA Brev (enterprise AI infrastructure, governed by the NVIDIA Cloud Services Data Processing Addendum) | Period Published | 90 days post-termination (DPA §10). | Period Published | 2026-08-15v1.6 | |
| NVIDIA | NVIDIA Consumer Products And Services (nvidia.com account, GeForce Experience, GeForce NOW, NVIDIA App, SHIELD, on-site/in-app chatbots, event and marketing data) | Criteria Only | Chat: not fixed. Account data: 5 yrs since last use. | Criteria Only | 2026-08-15v1.6 | |
| NVIDIA | NVIDIA Developer Program / NGC / API Catalog (build.nvidia.com trial and hosted NIM inference APIs, governed by the NVIDIA Technology Access Terms of Use and the NVIDIA API Trial Terms of Service) | Period Published | 30/90 days by upload type; else session-only. | Period Published | 2026-08-15v1.6 | |
| Obsidian | Obsidian App — Local Vault Only | Not Measured Under Method v1.6Never Asked | Not Measured Under Method v1.6Never Asked | Not Measured Under Method v1.6Never Asked | 2026-08-11v1.6 | |
| Obsidian | Obsidian Publish | Not Measured Under Method v1.6Never Asked | Not Measured Under Method v1.6Never Asked | Period Published | 2026-08-11v1.6 | |
| Obsidian | Obsidian Sync | Not Measured Under Method v1.6Never Asked | Not Measured Under Method v1.6Never Asked | Period Published | 2026-08-11v1.6 | |
| Odoo | Odoo Cloud Platform — Odoo Online and Odoo.sh hosting of the Odoo Enterprise ERP/CRM/business-application suite (odoo.com), including the built-in Odoo AI application (Gemini/OpenAI-backed, Odoo 19). The separately-priced, credit-billed In-App Purchase (IAP) feature set (SMS, document digitization, partner autocomplete, legacy AI text tools) carries its own distinct privacy policy and subprocessor list and is flagged, not analysed, at §3.13 | Not Addressed | Not Measured Under Method v1.6Never Asked | Period Published | 2026-08-15v1.6 | |
| Okta | Okta Customer Identity Cloud (Auth0), including the Fine-Grained Authorization, Breached Password Detection and Guide add-ons, on the public-cloud regions and the private-cloud region set | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-14v1.6 | |
| Okta | Okta Workforce Identity Cloud (including Identity Governance, Privileged Access, Advanced Server Access and Identity Security Posture Management) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-14v1.6 | |
| Ollama | Ollama (Ollama Inc.) | Criteria Only | not stored beyond the time required to fulfil the request (at Ollama); zero retention required of inference providers, who are unnamed, so the requirement cannot be traced to any provider's own terms | Criteria Only | 2026-07-31v1.4 | |
| OneTrust | OneTrust LLC | Not Addressed | Not Measured Under Method v1.1Never Asked | Period Published | 2026-07-29v1.1 | |
| OpenAI | ChatGPT Free, Plus and Pro consumer tiers, governed by the European and global consumer privacy policies | Not Addressed | Not Measured Under Method v1.6Never Asked | Not Measured Under Method v1.6Never Asked | 2026-08-13v1.6 | |
| OpenAI | OpenAI API, Business and Enterprise tiers, governed by the Customer Data Processing Addendum effective 1 January 2026 | Not Addressed | Not Measured Under Method v1.6Never Asked | Not Measured Under Method v1.6Never Asked | 2026-08-13v1.6 | |
| OpenRouter | OpenRouter | Criteria Only | Not Measured Under Method v1.4Never Asked | Criteria Only | 2026-08-06v1.4 | |
| Oracle | Oracle Cloud Services (DPA estate) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-11v1.6 | |
| Oracle | Oracle MCP and agentic surface | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-11v1.6 | |
| Oracle | oracle.com corporate and account surface | Not Addressed | Not Measured Under Method v1.6Never Asked | Period Published | 2026-08-11v1.6 | |
| PayPal | PayPal-branded wallet and checkout services, Braintree ("Unbranded Payment Services"), Fastlane, Hyperwallet, Xoom, and PayPal Point of Sale / Zettle, together with the PayPal MCP agent surface at mcp.paypal.com, all governed by PayPal's global Privacy Statement and by the parallel Payment/Card Processing Data Protection Addenda. Venmo is an Excluded Service under PayPal's own Privacy Statement and is out of scope for this report. | Not Addressed | Not Measured Under Method v1.6Never Asked | Period Published | 2026-08-13v1.6 | |
| Perplexity | Perplexity Enterprise and API offerings, governed by the Data Processing Addendum (DPA) last updated August 13, 2026 | Period Published | 30 days after the end of the provision of Services (DPA §9, Deletion of Personal Data); Chat Completions API specifically holds zero retention. | Period Published | 2026-08-15v1.6 | |
| Perplexity | Perplexity Free, Pro and Max consumer tiers, governed by the consumer Privacy Notice last updated July 8, 2026 | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-15v1.6 | |
| ProcessUnity | ProcessUnity Global Risk Exchange | Criteria Only | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-08v1.6 | |
| ProcessUnity | ProcessUnity TPRM Platform | Criteria Only | Not Measured Under Method v1.6Never Asked | Period Published | 2026-08-08v1.6 | |
| QuickBooks | QuickBooks Online (EN-ROW and European route) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-10v1.6 | |
| QuickBooks | QuickBooks Online (United Kingdom route) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-10v1.6 | |
| QuickBooks | QuickBooks Online (United States and Canada route) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-10v1.6 | |
| QuickBooks | QuickBooks Online Payroll and QuickBooks Time (processor route) | Not Measured Under Method v1.6Never Asked | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-10v1.6 | |
| Qwen | Qwen Chat / Qwen Studio — consumer and self-service AI chat and generation product | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-15v1.6 | |
| Recall.ai | Recall.ai Platform (Meeting Bot API, Desktop and Mobile Recording SDKs, Calendar API, Output Media, MCP server) | Customer-Controlled | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-11v1.6 | |
| Reddit Advertising (Ads Manager, Business Tools, Custom Audiences) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-15v1.6 | ||
| Reddit consumer platform (reddit.com and Reddit apps, including Reddit Answers) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-15v1.6 | ||
| Reddit Developer Platform and Data API (Devvit, third-party apps, Data API licensees) | Not Addressed | Not Measured Under Method v1.6Never Asked | Period Published | 2026-08-15v1.6 | ||
| Relyance | Relyance Platform (relyance.ai) | Not Addressed | Not Measured Under Method v1.6Never Asked | Bare Restatement Of The Test | 2026-08-08v1.6 | |
| Sakana AI | Sakana AI (Fugu) | Not Addressed | Not Measured Under Method v1.1Never Asked | Criteria Only | 2026-07-29v1.1 | |
| Salesforce | Agentforce and the Einstein Generative AI Services | Period Published | Zero retention at the model provider; logged in Data 360 in the customer's org; 120 days | Period Published | 2026-08-11v1.6 | |
| Salesforce | Salesforce Services on Hyperforce | Period Published | Zero retention at the model provider; 120 days for inactive Einstein data | Period Published | 2026-08-11v1.6 | |
| SAP | SAP Cloud Services (global default configuration, including SAP Business AI and Joule) | Period Published | 365 days (Joule interaction data, default retention). Conversation-log storage is opt-in by admin consent; a conversation expires after 24 hours or 8 hours of inactivity, whichever comes first. Changeable only by SNOW ticket to component CA-Joule-CI. | Criteria Only | 2026-08-08v1.6 | |
| SecurityScorecard | SecurityScorecard (TITAN) | Criteria Only | purposes stated, no period — auditability, compliance tracking and prompt engineering | Bare Restatement Of The Test | 2026-07-30v1.1 | |
| Sentry | Codecov (software test coverage reporting, about.codecov.io) | Not Addressed | Not Measured Under Method v1.6Never Asked | Period Published | 2026-08-11v1.6 | |
| Sentry | Sentry (application monitoring and error tracking, sentry.io) | Period Published | For Seer: the duration of the analysis run only — code is deleted immediately and permanently once the run completes. | Criteria Only | 2026-08-11v1.6 | |
| ServiceNow | ServiceNow AI Platform — general Subscription Service | Criteria Only | Deleted from the compute hubs after the response has been generated; no period stated for any other AI processing, and no period stated for the data-sharing corpus used to improve the Now LLMs. | Criteria Only | 2026-08-14v1.6 | |
| Slack | Slack (commercial cloud, slack.com, including Slack AI and Slackbot) | Period Published | Not Measured Under Method v1.6Never Asked | Bare Restatement Of The Test | 2026-08-07v1.6 | |
| SmartSuite | SmartSuite Platform (hosted at smartsuite.com) — direct customer channel | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-07v1.6 | |
| Snowflake | Snowflake AI Data Cloud, including Cortex AI Features | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-11v1.6 | |
| Softr Platforms GmbH | Softr No-Code Application Platform (hosted, softr.io) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-07v1.6 | |
| Stripe | Stripe hosted platform (payments, Connect, Identity, Terminal, Issuing, Atlas, Treasury) including the hosted MCP server at mcp.stripe.com | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-07v1.6 | |
| Supabase | Supabase Platform (hosted, supabase.com) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-07v1.6 | |
| Tailscale | Tailscale Aperture (AI gateway, beta) | Criteria Only | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-11v1.6 | |
| Tailscale | Tailscale Solution (hosted coordination service and tailnet) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-11v1.6 | |
| TaskUs | TaskUs BPO / AI Data Services (client-contracted) and the taskus.com corporate website | Not Addressed | No retention period or criterion for AI-processed inputs after processing was found on any surface read. The Global AI Policy addresses minimisation BEFORE data enters an AI system (redaction/anonymisation) but not retention of inputs afterward. | Criteria Only | 2026-08-13v1.6 | |
| Teamwork.com | Teamwork Desk — AI-powered features | Period Published | Not Measured Under Method v1.6Never Asked | Bare Restatement Of The Test | 2026-08-11v1.6 | |
| Teamwork.com | Teamwork.com Platform (projects, resource, Chat, Spaces, TeamworkAI, MCP server) | Period Published | Not Measured Under Method v1.6Never Asked | Bare Restatement Of The Test | 2026-08-11v1.6 | |
| TikTok | TikTok Platform — EEA / UK / Switzerland User (TikTok Technology Limited and TikTok Information Technologies UK Limited, joint controllers) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-15v1.6 | |
| Trello | Trello Cloud, Standard and Premium Workspaces (AI activated by default) | Period Published | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-10v1.6 | |
| TrueFoundry | TrueFoundry (Ensemble Labs, Inc.) | Not Addressed | Not Measured Under Method v1.4Never Asked | Gated | 2026-07-31v1.4 | |
| TrustArc | TrustArc Inc | Not Addressed | Not Measured Under Method v1.1Never Asked | Period Published | 2026-07-29v1.1 | |
| Twilio | Twilio platform (Programmable Messaging, Programmable Voice, Verify, Flex, Segment, Stytch and the AI/ML Features), contracted with Twilio Ireland Limited | Customer-Controlled | No retention period is published for AI Input. Adjacent published numbers: sub-processors 'have agreed to retain data for a maximum of 60 days' (TIA); Logged Data and AI/ML Outputs deleted 'within thirty (30) days' of a completed Deletion Request Form, except Anonymized Data (Conversational Intelligence Addendum s6). | Criteria Only | 2026-08-11v1.6 | |
| Whimsical | Whimsical (visual workspace: boards, docs, flowcharts, wireframes, mind maps, including Whimsical AI) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-15v1.6 | |
| Whispir | Whispir Platform (hosted, whispir.com) | Not Addressed | Not Measured Under Method v1.6Never Asked | Period Published | 2026-08-07v1.6 | |
| Whistic | Whistic TPRM AI Platform (hosted, whistic.com) including Whistic AI and the Whistic MCP Server (BETA) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-10v1.6 | |
| Wrike | Klaxoon, The Separately Activated Wrike Affiliate Brand | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-14v1.6 | |
| Wrike | Wrike Work Management Platform, With Wrike AI And AI Agents | Period Published | Up to sixty (60) days within the systems of applicable Third-Party Data Model providers, for abuse monitoring | Criteria Only | 2026-08-14v1.6 | |
| Xano | Xano Agents, MCP Builder, MCP Server and Developer MCP (customer-supplied credentials) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-11v1.6 | |
| Xano | Xano Platform (hosted backend), including the vendor-selected Xano AI features | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-11v1.6 | |
| Xero | Xero (hosted accounting platform, xero.com), including JAX | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-10v1.6 | |
| Zapier | Zapier Automation Platform (hosted, zapier.com — Zap workflows, Tables, Forms, Canvas, Agents, Chatbots, MCP, SDK, Functions) | Customer-Controlled | Not Measured Under Method v1.6Never Asked | Period Published | 2026-08-10v1.6 | |
| Zendesk | Zendesk — customer service and CRM platform (Support, Guide, Talk, Chat, Sell), including Zendesk AI Agents and the first-party MCP server/client | Criteria Only | No AI-Input-specific period; 'zero data retention' is claimed only on a support page, not in an instrument. AI Services Addendum §3.2 folds AI Input into the general DPA retention position. | Criteria Only | 2026-08-15v1.6 | |
| Zhipu AI | Z.ai API / Enterprise (GLM API) | Period Published | Not Measured Under Method v1.6Never Asked | Period Published | 2026-08-15v1.6 | |
| Zhipu AI | Z.ai Consumer Chatbot (chat.z.ai) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-15v1.6 | |
| Zhipu AI | Zhipu Domestic Platform (bigmodel.cn) | Not Addressed | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-15v1.6 | |
| Zoho | Zoho Cloud Suite with Zia AI | Not Addressed | Not Measured Under Method v1.6Never Asked | Period Published | 2026-08-10v1.6 | |
| Zoom | Zoom Workplace (hosted, zoom.com) — Federated AI deployment | Customer-Controlled | Not Measured Under Method v1.6Never Asked | Criteria Only | 2026-08-07v1.6 |
State Access — A Separate Band
Origin is not destination. An elevated origin yields Cannot Assess, never No Lawful Route. Nationality, ownership or founder origin may never ground an elevated finding.
Classification rests on documented ownership and statutory obligation only — never founder nationality, ethnicity or personal origin.
State-Access (Stakeholder) — Not Researched on all 147 rows
Basis, recorded identically on every row: “not researched under the method — no documented ownership or statutory-obligation finding on the record”.
The band holds one value because the 9,363-row reference set that could have filled it says on 9,336 of its own rows that the value is a mechanical default rather than a verified absence. A lookup against it could not tell “checked and clean” from “never checked”, so it would have published a clean result nobody measured. And the file sits outside the repository, so the same records built on two machines produced two different published wordings — a cell whose basis depends on the build host is not a fact about anyone. The builder no longer opens it. When stakeholder control is genuinely researched it enters through a fact record like every other observation, cited, dated and carrying its claim tier.
Conditional Rows, Named But Not Celled51
Hosting Locality23
United States Government CloudAtlassian Government CloudInfrastructure and support operated exclusively within the EU by EU-resident personnel under Amazon Data Services European Sovereign Cloud GmbH (Germany); support limited to Amazon Development Centre Ireland Limited and Amazon Web Services EMEA SARL; third-party service providers limited to the EU/EEA-region entities of the same messaging vendors named on the main platform's list.AWS European Sovereign Cloud — distinct legal entity, EU-resident governance and personnel, separate and shorter sub-processor listEuropean Union — AWS Dublin, IrelandClickUp Enterprise Plan with the European hosting region selectedEU Regional Services + Customer Metadata Boundary (Enterprise paid add-on)Cloudflare Platform — Enterprise with Data Localization SuiteUnited Kingdom regionEmployment Hero Platform — United Kingdom region (Employment Hero (UK) Ltd, HR data in Australia and Ireland, payroll primarily Ireland)EU or Australia regionGitHub Enterprise Cloud with data residency (GHE.com)Existing workspace (residency unreachable)Loom — an existing workspace, which cannot be migrated to a pinned data regionTenant provisioned in the EU/EFTA Macro Region Geography with an EU/EFTA billing address, bringing Microsoft 365, Entra, Azure regional services, Dynamics 365 and Power Platform in-scope for the EU Data BoundaryMicrosoft Enterprise Cloud Services — EU Data Boundary provisioningEuropean Union data residency (Ireland primary, Germany backup)Miro cloud platform — European Union data residency hosting localityNew ZealandMYOB Business — New Zealand hosting localityEurope (Frankfurt)Obsidian Sync — Europe (Frankfurt) hosting_localityEuropean Cell — Germany and Ireland for hosting and the data warehouse, Belgium and the Netherlands additionally for Identity Governance and Privileged Access. A configuration a customer can select today, taken without the Customer Identity Cloud and without the Service Log Investigator or any other generative-AI feature enabled.Okta Workforce Identity Cloud — European Cell hosting locality, without the Customer Identity Cloud and with no generative-AI feature enabledCustomer Content in Ireland or Australia; all other account and usage data in the United StatesRegional Twilio — supported products with Customer Content stored in the selected region (Ireland or Australia)Hyperforce EU Operating Zone selected by the customerSalesforce Services in a Hyperforce EU Operating ZoneEU Access — optional, per-service, chargeable, EEA and SwitzerlandSAP Cloud Services — EU Access optionSAP NS2 — processing confined to US locations and US personnelSAP Cloud Services — SAP National Security Services (US locations and US personnel)European Union (Frankfurt, Germany) selected as the organisation's Data Storage Location at creationSentry with the European Union data storage location selected (de.sentry.io, Frankfurt)Australia — protected platform offeringServiceNow Protected Platform AustraliaRest Of World / Australia — TikTok Pte. Ltd. (Singapore)TikTok Platform — Rest Of World / Australia User (TikTok Pte. Ltd., Singapore, controller)United States — TikTok USDS Joint Venture LLCTikTok Platform — United States User (TikTok USDS Joint Venture LLC, operator since 22 January 2026)Account pinned to a customer-selected region or territory, as described on the Singapore security pageWhispir Platform — region-pinned account (residency option as described on the Singapore security page)European Data Centre (Amsterdam primary, Dublin secondary)Zoho Cloud Suite — European data centre tenancyEU-HostedZoom Workplace — EU-hosted account (Zoom-Hosted Models Plus)
Deployment Mode23
AI agent operating on the production account through the AgentOS MCP connectorsAirwallex Platform (Business Accounts, Payments, Spend, Billing, Platform APIs and Embedded Finance) — AgentOS production-account connectors deployment modeAsana AI preferences switched off for the domain in the admin consoleAsana work management platform with Asana AI disabled at the domain level by an adminSelf-Managed (Data Center)Atlassian Data Center (customer-operated, self-managed)Early Access AI Agent add-onAuth0 for AI Agents and Okta for AI Agents (Early Access add-on)Self-managed. The customer installs and operates the software on its own infrastructure under the Confluent Platform Agreement (Last Updated April 24, 2024) rather than under the Cloud Services Agreement, and Confluent hosts no customer topic data. Confluent nonetheless collects Usage Data and, unless disabled, Telemetry Metrics from the customer's own installation.Confluent Platform — the self-managed distribution installed on the customer's own infrastructureSelf-HostedFireworks AI — Bring Your Own Cloud (BYOC) deploymentHybrid DeploymentFivetran Hybrid Deployment - pipeline processing inside the customer's own network, orchestrated from Fivetran's cloudDedicatedLunary Dedicated (managed by Lunary in a customer-chosen region)Self-HostedLunary Self-Hosted (Enterprise Edition, customer infrastructure)MCP Server ConnectedMailgun Platform with the published MCP server connected (customer-hosted, model in the loop)On-Premises AgentMake (on-premises agent) — Variant of Make Cloud PlatformPlugin Marketplace connector enabledMiniMax Agent (agent.minimax.io) with a Plugin Marketplace connector enabledAI features enabledmonday AI Work Platform (AI features and agents, enabled per account)Self-HostedMongoDB self-managed (Enterprise Advanced and Community Edition)AccountRight subscriptionMYOB Business — AccountRight subscription deployment modeSelf-Hosted on customer infrastructure. The n8n-operated AI Assistant is not available, and product telemetry is enabled by default.n8n (self-hosted)Asia PacificOneTrust LLC — Asia Pacific deployment modeZero data retention enabled as an API configuration — an option the customer must switch on, not the default state of the offeringOpenAI API with zero data retention enabled (Variant of the API, Business and Enterprise baseline)SendGrid Services and Private Beta Offerings — same platform, same instruments, except that the BCR route is expressly unavailableSendGrid Services and Private Beta Offerings — the Services expressly carved out of the Binding Corporate RulesSold and administered through a business partner or reseller under the 13 March 2025 partner instruments rather than the 1 January 2026 Customer DPASmartSuite Platform — partner and reseller channel (Business Partner DPA / Reseller DPA)Self-HostedSupabase (self-hosted)Self-HostedTeamwork.com MCP server (self-hosted from the published repository)Agent Execution Surface (Model Context Protocol)Zoho MCP — agent execution surface
Commercial Tier5
Individual (non-volume-licensed)GitHub individual accounts and GitHub Copilot Free, Pro and Pro+Enterprise B2B SubscriberLinkedIn Platform — Individual Member — Enterprise B2B Subscriber commercial_tier (Sales Navigator, Recruiter/Talent Solutions, Learning Solutions, Marketing Solutions, Glint)FreeTrello Cloud, Free planReseller channel — the published Data Processing Addendum is disapplied by its own termsWrike Purchased Through A Wrike PartnerCompany or Enterprise planZapier Automation Platform on the Company or Enterprise plan
Correction, Right Of Reply, And Free-And-First
The finding goes to the organisation free and first. An organisation that disputes a cell gets the same route as one disputing a report: the correction is published with a version note, and where a document is produced the reading is re-run. Every organisation’s own record carries the route.
Nothing on this page is behind a sign-in, a price or an account, and nothing on it ever will be. Comparison at this depth is the free layer; what is sold is the reading that goes deeper, never a better answer on this one.