Does AI Use My Company Data for Training? How to Check

Does AI use my company data for training? The honest answer is that it depends on the account the data went through, not on the brand of the tool. Many vendors run two sets of rules: business and enterprise plans that exclude customer data from model training by default, and free or personal plans that may include it unless someone switches a setting off. So the useful question for a small team is narrower: which account did each person use, and what does the vendor's data-use page say about that exact plan today?

This article covers where that answer actually lives, the four separate questions hiding inside "does it train on our data," and the places small teams usually forget to look. It is general information about reading vendor terms, not legal advice. If a client contract or a regulation governs the data, whoever reads your contracts gets the final word.

Same tool, different answer: why the plan matters more than the brand

The clearest recent example comes from GitHub. Its announcement, Updates to GitHub Copilot interaction data usage policy (published March 25, 2026, read for this article on September 24, 2026), says that from April 24, 2026, interaction data from Copilot Free, Pro and Pro+ users is used to train its AI models unless the user opts out. The same post says Copilot Business and Copilot Enterprise users are not affected, and that interaction data from enterprise-owned repositories is excluded.

That is one product with two answers. A developer using a personal Pro account on company code falls under the first rule. The same developer, signed into a seat the company pays for on a Business plan, falls under the second. The code is identical. The account decides.

Microsoft draws a similar line for its work product. Its documentation page, Data, Privacy, and Security for Microsoft Copilot (read September 24, 2026), states that "prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs." That page is written for organizations using the work version under Microsoft's commercial commitments. It is not a statement about whatever someone on your team does in a consumer app on a personal login.

So the first follow-up to "does this tool train on our data" is always the same: on which plan, and signed in as whom?

Does AI use my company data for training, or is it four questions?

"Training" is only one thing that can happen to your data. Vendors answer each part separately, and a "no" on one does not mean "no" on the others.

The Microsoft page shows this well. It says Copilot prompts and responses are not used to train the foundation models. In the same document, it explains that those prompts and responses are stored as a user's activity history, which admins can search and set retention rules for through Microsoft Purview. "Not trained on" and "not stored" are different promises, and only one of them was made.

Here are the four questions worth answering for every tool, and what a real answer looks like.

Question	A real answer looks like	Where to look
Is our data used to train or improve models?	A statement that names your plan and lists any exceptions	The vendor's data-use or privacy page for that plan; the terms
How long is it kept, and can we delete it?	A retention period or an admin retention control, plus a deletion route	Admin console; data processing terms
Can a person at the vendor read it?	A clear statement about human review, abuse monitoring or support access	Privacy documentation; security or trust center
Does it go to another company?	A named list of subprocessors or model providers	Subprocessor list; data processing addendum

The Microsoft page answers the third and fourth questions too. It says Copilot services have opted out of the abuse monitoring with human review that is available in Azure OpenAI, and it notes that third-party AI models can be offered inside Copilot, that admins decide whether to use them, and that additional terms may apply. That last detail matters: the answer to question four can change when an admin flips a switch.

If you can only answer the first question, you have not finished checking. Write "unknown" in the other three rather than assuming the best.

Where the real answer lives, from strongest to weakest

Not every source carries the same weight. When two sources disagree, the higher one wins.

1. The contract and data processing terms your company accepted. This is what the vendor is actually bound by. On a paid business plan it often sits behind a link in the admin area or the order form.
2. The vendor's documentation page that names your plan. Good when it names the plan and shows a date. The Microsoft page shows when it was last updated, which lets you tell whether you are reading something current.
3. The admin console or account setting. This shows what is switched on for your workspace right now, which may differ from the default described elsewhere.
4. A help center FAQ or marketing page. Useful for orientation, but these often speak about "customers" in general without saying which plan the promise covers.
5. A reply from support or a sales rep. Save it, date it, and treat it as a pointer toward the terms rather than the terms themselves.

One habit makes this much easier: every time you read one of these, save the link and the date you read it. Vendor pages change, and a screenshot from six months ago tells you what was true then, not what is true now.

The account problem: which login did the data go through?

Most small teams are mixed. A few people have paid seats in a company workspace. Others use personal accounts they signed up for months ago. Someone installed a browser extension. A plan's promise covers the accounts on that plan and nothing else, so a business subscription does not protect what goes through a personal login, even if the personal login uses a work email address.

This is why the check starts with people, not with tools:

• Ask each person which AI tools they use for work, including free ones and browser add-ons. Ask plainly and without blame, or you will get a partial list.
• For each tool, note the plan and who owns the account. Company workspace, personal paid plan, or personal free plan.
• Move work use onto company accounts where you can, or have the person check the training setting on their own account in the meantime.

The same inventory is the first step in rolling a notetaker out to a team of five to twenty, so if you have done one, you have most of the other.

The AI you did not buy as AI

Small teams tend to check the chatbot and forget everything else. AI features now arrive inside software you already pay for: code tools, document suites, project trackers and meeting apps. Each new feature can come with its own updated terms, and the GitHub change above was announced about a month before it took effect. Nobody on your team went shopping for it.

Add-ons are the other blind spot. Microsoft's page says that when agents are used with Copilot, you should "check the privacy statement and terms of use of the agent to determine how it will handle your organization's data." In plain terms, the main tool's promise does not automatically extend to everything plugged into it.

Meeting tools deserve their own look, because they capture more than anyone types. If your team records calls, the questions in our guide to whether your meeting data trains the model apply alongside where your meeting recordings are stored and who can open them.

A step-by-step check you can run with your team

1. Make the list. Every AI tool and AI feature in use, including extensions, notetakers and AI features switched on inside existing software.
2. Record the plan and account owner next to each one.
3. Find the data-use statement for that exact plan. Save the link and the date you read it.
4. Answer the four questions from the table above. Mark anything you could not confirm as unknown.
5. Check the live setting in the admin console or account settings, and screenshot what it shows today.
6. Decide what may go into each tool. A tool with a clean training answer but an unknown retention answer may still be the wrong place for client files.
7. Set a reminder to re-check. Every three months is a sensible rhythm for AI tools, plus any time a vendor emails about updated terms.

None of this requires a specialist. It requires someone to own the list and keep the dates current.

What opting out does, and what it does not

Turning off a training setting is worth doing on any personal account used for work, but it is narrower than it sounds.

• It works from that point forward. Assume it does not reach back into data already collected unless the vendor says otherwise in writing. GitHub's post notes that users who had already opted out keep that preference, which is the forward-looking model.
• It does not stop storage. As the Microsoft example shows, data can be kept as history and still be excluded from training.
• Feedback is data too. GitHub's post lists user feedback on suggestions among the interaction data it collects. Microsoft's page says optional feedback may be used to improve Copilot, though not to train the foundation models, and that admins can manage it. The thumbs-up button is not neutral.
• Settings do not travel. Opting out on one account does nothing for a colleague's account, or for your own second account in the same tool.

When the answer is not yours to give

A vendor can truthfully promise not to train on your data, and your client contract can still forbid putting that client's material into any third-party tool at all. Confidentiality clauses, NDAs, and rules covering health, financial or personal data can all be stricter than any vendor setting. The vendor's page tells you what the vendor does. It does not tell you what you agreed to with your own clients.

If a client call is involved, recording a client call: what to check before you start walks through the consent side. For anything regulated or contract-bound, ask whoever handles your contracts before the data goes in, not after.

The honest limit of all this: you are relying on vendors to describe their own practices accurately and to tell you when those practices change. Reading the right page, for the right plan, on a recent date, is the best a small team can do. It is also far more than most teams do.

FAQ

If we pay for a business plan, is all our data excluded from training?

Only the data that goes through that plan's accounts. Anything a team member puts into a personal or free account of the same tool falls under that account's rules. Check the plan named on the vendor's data-use page, and check which accounts your people actually use.

Is a free AI account safe if I sign up with my work email?

Usually the email address does not change the plan. A free account created with a work email is still a free account, with the free plan's data terms. What matters is whether the account sits inside a company workspace on a business plan.

If I opt out today, is data I already entered removed from the model?

Assume not. Opt-out settings generally apply going forward. If removal of past data matters, look for a specific deletion or retention statement from the vendor, and treat the question as unanswered until you find one.

How often should we re-check whether an AI tool trains on our data?

A three-month cycle suits AI tools, plus a re-check whenever a vendor sends notice of updated terms or adds a new AI feature. Policies do change, as GitHub's 2026 update showed.

Does rating an AI answer with a thumbs-up affect training?

It can. Feedback is often collected separately from the main conversation, and vendors describe its use differently. Read how your vendor handles feedback, and on a business plan, check whether an admin control covers it.