Is your software vendor training AI on your business records?

Can a software vendor train AI on your records?#

A software vendor can train AI on your records only if its contract with you grants that right, but the grant is often indirect. Few business terms say in plain words that the vendor trains models on your support tickets. The right more often sits inside clauses about operating and improving the service, using aggregated or de-identified data, or providing AI features.

Vendors take different approaches. Some exclude customer content from model training by default, some offer an opt-out, and some treat training as part of an AI feature you switch on. The same vendor can also treat a free plan, a standard plan and a negotiated enterprise agreement differently, so the answer belongs to your contract, not to the brand.

Start the review with vendors that hold free text, because free text is what language models learn from most readily: help desk and chat platforms, CRM notes and call logs, meeting notetakers, document and wiki tools, and code hosting. Systems that hold mainly structured transactions, such as payroll or accounting, still matter for privacy but are usually a lower priority for this question.

The clause checklist: what to read and how to read it#

The clause checklist below covers the provisions that, together, decide whether a vendor may learn from your records. Read each one in the master agreement, the data processing addendum, any AI-specific terms and the order form, then note which document wins when they conflict.

What do vendors' published AI training positions look like?#

Vendors' published AI training positions differ in scope: some exclude customer content entirely, some exclude only certain kinds of model, and some depend on the plan, the contract or an admin setting. The examples below come from each vendor's own terms or help pages, or from press reports of them, and show why a headline promise needs reading in full.

Treat these as examples of drafting patterns, not as a current reading of any contract. Terms change, and the version that governs your records is the one attached to your plan and order form for the period the records were created.

Why does vendor training matter beyond privacy?#

Vendor training matters beyond privacy because it touches three obligations the company already carries. The first is confidentiality: your contracts with customers, partners and employees may restrict who handles their information and for what purpose, and a vendor training on it can sit awkwardly with those promises.

The second obligation is protecting trade secrets. The federal definition in 18 U.S.C. 1839(3) treats information as a trade secret only if the owner has taken reasonable measures to keep it secret. Pricing logic, engineering discussions and internal playbooks shared with a vendor under an unexamined training grant may make that showing harder.

The third is your own ability to license. A buyer licensing your records will ask whether anyone else holds rights in them or has already trained on them. If a vendor has, the answer shapes the warranties you can give and may narrow what is worth licensing.

How do vendor terms change after you sign?#

Vendor terms often change after signing, because many online agreements let the vendor update policies by posting a new version or sending notice. Negotiated enterprise agreements may lock key terms, while click-through plans usually follow whatever version is current. Changes can also be reversed: in July 2025, after user objections, WeTransfer revised planned terms to remove language about using uploaded content to improve machine learning models.

For records, the version in force when data was created can matter as much as today's terms. Keep dated copies of the terms, the data processing addendum and any AI addendum at each renewal. Where a vendor adds AI features mid-contract, record the date and the setting you chose; that history answers questions from customers, auditors and future buyers.

Retroactive changes also draw regulators' attention. In a February 2024 blog post, FTC staff warned that a company adopting more permissive data practices, such as using consumers' data for AI training, and disclosing them only through a surreptitious, retroactive change to its terms or privacy policy may be engaging in unfair or deceptive practices. The warning addresses consumers, and how far it reaches business customers is less settled. If a vendor expands its data rights, ask in writing whether the change reaches data collected earlier, whether you can opt out without losing the product, and whether opting out applies to every workspace on your account.

What can you do when the answer is yes?#

When a vendor's terms do allow training, the company still has options, and most are administrative rather than legal. Start with settings, then the contract, then the vendor relationship itself.

• 1Check admin settings for AI training, model improvement or data sharing controls, and record the date you changed them.
• 2Ask for written confirmation of what has already been used, and whether opting out affects past data.
• 3Negotiate an AI addendum or data processing terms that exclude your content from training.
• 4Ask counsel whether privacy laws such as the CCPA or GDPR limit how the vendor, acting as your service provider or processor, may use personal information.
• 5Limit which teams paste sensitive material into AI features until the review is finished.
• 6Add the vendor's position to your contract register and your data inventory.
• 7Plan a migration if the vendor will not move and the records are sensitive.

Illustrative: a manufacturer reviews its vendors at renewal#

Illustrative: a fictional precision machining company runs a cloud ERP, a cloud quality management system, a help desk for distributor questions and a file-sharing platform that holds customer drawings. Its general counsel starts the review after the ERP vendor announces a new AI assistant.

Working through the clause checklist, she finds four different positions. The ERP's AI addendum excludes customer data from model training, but only if an admin accepts the addendum. The QMS vendor may use aggregated quality data to build industry benchmarks. The help desk's reply drafting feature is on by default, and its terms allow service improvement. The file platform limits use to providing the service, which matters because customer drawings are covered by confidentiality clauses in purchase agreements.

The company accepts the ERP addendum, asks the QMS vendor in writing how aggregated data is de-identified, switches off help desk drafting until the terms are clarified, and files dated copies of every document. When it later considers licensing nonconformance records, it can answer a buyer's question about prior vendor use on one page and keeps customer drawings out of scope.

How SourceX approaches vendor terms#

SourceX reviews vendor terms in the Rights step of the SourceX five-step transaction with two questions in mind: whether the supplier may export the records for licensing, and whether any vendor already holds rights that overlap with a proposed license. The findings shape scope before any data moves.

The outcome is written into the SourceX Evidence Packet, in its licensing rights and permitted use entries, so the supplier and the buyer read the same position. Applicable laws and contract terms are assessed deal by deal with the supplier's counsel. SourceX's dataset rights, including any training use, are set out in the signed supplier agreement, and the supplier approves every step.