Which AI Providers Train on Your Agent's Data? We Checked 21 of Them.

Your agent sends your emails, your customer messages, and your SOUL.md to a model provider on every single call. Whether that becomes training data depends on which provider you picked and which setting you never opened. Here is the row-by-row answer, verified against each provider's own terms.

An agent is not a chat. When you type into a chatbot you send one message. When your agent runs, it sends your SOUL.md, your tool schemas, your conversation history, and whatever it just pulled from your inbox, on every call, fifty to five hundred times a day.

So "does this provider train on my data" stops being a philosophical question. If the answer is yes, the provider receives your entire operating manual several hundred times before lunch.

The short answer, if you only read one paragraph: the major paid APIs (OpenAI, Anthropic, Google Gemini paid tier, Vertex, Azure OpenAI, Groq, Mistral, Together, xAI) do not train on your agent's traffic by default. The ones that do are the free and consumer tiers: Gemini's free tier, ChatGPT, consumer Grok on X, and DeepSeek's first-party API. Local inference (llama.cpp, Ollama, Jan, LM Studio) never sends your prompts anywhere, with two telemetry footnotes covered below. Everything else in this post is the detail that stops you getting one of those rows wrong.

We worked through the documentation for 21 providers and endpoints, one row each. Below is what each does with your agent's traffic as of September 15, 2026, with the specific opt-out where one exists.

What "training on your data" actually means for an agent

Most privacy pages blur three separate things. An agent operator needs all three answered separately.

Does the provider log your requests? Nearly all do, for abuse detection and debugging. Retention runs from zero days to thirty-plus.

Does the provider train on your requests? This is the one that matters for your IP. If yes, your agent's instructions and your customers' messages become part of the next model.

Does the provider store your requests long-term? Beyond the logging window. Enterprise contracts sometimes guarantee deletion. Default API terms often don't.

A provider can log everything and train on nothing. A provider can train on nothing and still hold your data for thirty days. Private is not one switch, and no single column below answers all three.

The table

Verified against each provider's own terms, privacy documentation, or pricing page on September 15, 2026. The last column is our call for an agent that touches customer data or PII; adjust it for your own risk appetite.

Last verified: September 15, 2026. Where a cell says "could not verify," we could not confirm it from published documentation and are not guessing, because someone is going to make a compliance decision from this table.

The row that changed twice this summer: frontier-model retention

If you moved an agent onto a frontier model between June and now, your compliance posture changed without your contract changing. Here is the sequence, because the three dates matter more than any single headline.

June 9, 2026. Anthropic ships Claude Fable 5 and Mythos 5 as "Covered Models" with required 30-day retention on every surface, first-party and third-party, overriding existing zero-retention agreements. Anthropic's stated reason is safety: multi-request attacks are invisible if you evaluate each call alone. Retained data is not used for training, but for a legal, medical or financial workload "not trained on" is not the bar; "not stored" is. Microsoft and others restricted internal use.

August 19, 2026. OpenAI announces it will keep zero data retention on its frontier models and previews Private Safety Processing, an automated system that looks for misuse patterns across related interactions without exposing prompts to OpenAI staff. Content stays on customer-managed infrastructure. Rollout and a technical white paper are due in September.

September 2, 2026. Anthropic reverses with Fable 5.1 and Mythos 5.1. Eligible enterprise customers can run Fable 5.1 with zero data retention now, and a system called Enterprise Frontier Safeguards, which stores safety-monitoring data in the customer's own S3, Azure Blob or Google Cloud Storage, arrives in phases from this fall. The June models keep their 30-day requirement.

The lesson for agent operators is not "OpenAI good, Anthropic bad." Both companies describe the same problem and landed in the same place within two weeks. The lesson is that a retention guarantee is scoped to a model, not a vendor, and that the scope can change with a model release. Pin the model string in your agent config and re-check the row when you change it.

The five rows where the table isn't enough

OpenAI: read the API policy, not the ChatGPT one. The API baseline excludes customer content from training, ChatGPT does not, and Enterprise is a third thing again. Most wrong answers about OpenAI come from someone reading the ChatGPT policy and applying it to their API key. There is a recurring Hacker News thread about the ChatGPT "Improve the model for everyone" toggle switching itself back on after terms updates, with the top comment reporting the same on Claude's consumer app. Those reports concern account-level consumer settings, not API traffic, but they are a good reason to re-verify any privacy toggle you depend on after every terms acceptance.

Gemini's free tier is a different product from its paid tier. Google's own pricing page carries a row labelled "Used to improve our products." Free tier: Yes. Paid tier: No. That is not buried in a DPA, it is in the price table. Every agent you have been running on a free Gemini key has been contributing to Google's products, and enabling Cloud Billing is the entire opt-out.

DeepSeek is the row people scrutinise, correctly. One privacy policy covers both the consumer app and the Open Platform API. It states that personal data is processed and stored in the People's Republic of China, and describes training on user data with a policy-level opt-out rather than an API carve-out. The Open Platform terms do not separately exempt developer inputs. Training on by default, no published retention window, cross-border transfer by design. The weights are a different object entirely: run DeepSeek locally and nothing leaves your machine, and several non-Chinese hosts serve the same models under their own zero-retention terms.

OpenRouter has two layers, and is unusually honest about it. Their own retention is one question, the downstream provider's policy is another. What I like about their documented approach: they track each endpoint's policy, negotiate stricter terms where they can, and where they cannot establish a provider's policy they assume it retains and trains and label it as such. You can enforce zero retention globally, per model group, or per request with a zdr parameter. It applies to inference routing only, so plugins like web search fall outside it.

Ollama's -cloud tags are not local. This is the trap that will catch people. Ollama's local inference path sends nothing, the codebase has no telemetry, and independent packet captures confirm it. But model tags ending in -cloud are hosted API calls wearing a local-looking command. If your agent is pointed at one of those, "it runs on my machine" is false and Ollama's hosted privacy policy applies instead.

Where agents are actually safest

Think of it as three tiers, from strongest guarantee to weakest.

Structural: local inference. This is the only category where the answer is architecture rather than paperwork. If the model runs on your hardware, no policy change can reach your prompts. llama.cpp is the strongest of these: zero outbound connections in the inference path, no update check, no telemetry. Ollama and Jan AI collect nothing by default, though Ollama's desktop builds check for updates. LM Studio never transmits prompts either, but it does ship startup analytics on by default, so turn that off. If you want the model options at that tier, the best free models for agents rundown covers what actually runs on consumer hardware.

Contractual: the commitment lives in a signed agreement. Groq is the standout here. Not because of a documentation page: Groq puts the commitment in its Services Agreement, section 4.2, which defines inputs and outputs as customer data and then states it is not permitted to use them for training or fine-tuning without your explicit instruction. A docs page can be edited on a Tuesday afternoon; a contract clause cannot. Zero retention is a self-serve toggle in Data Controls rather than a sales conversation. The catch is that retained data sits in US buckets with no EU endpoint, so for EU-only processing Mistral (EU-native, EU hosting, no transfer mechanism needed) is the cleaner choice. Any ZDR agreement you sign with OpenAI, Anthropic, xAI or Cohere also lands in this tier, which is the whole point of signing one: it moves you from "their policy says" to "our contract says."

Policy: documented default, no signature. Anthropic's standard API, Gemini's paid tier, Azure OpenAI's zero-day default and Together's opt-in-only training all sit here. It is a good tier. It is also the tier where a terms update can move the line, so it needs the quarterly re-check at the end of this post.

How BYOK changes the decision

On a platform that locks you to one provider, that provider's data policy is your data policy, whether you read it or not.

On BYOK you choose, and the choice is per agent rather than per platform. On BetterClaw each agent can run on a different provider: your support triage agent touches customer messages, so route it through Anthropic, Groq or Mistral; your internal research agent is less sensitive and cost matters more, so send it somewhere cheaper. One platform, two privacy postures, and the bill comes from the provider directly with no markup from us. You can start on the free plan and set this up in the time it takes to paste two API keys.

Audit your own agents in ten minutes

1. List which provider and which model string each of your agents actually uses. On BetterClaw that's Settings, then Models, per agent.
2. Find the row above. Match the tier, endpoint and model, not the brand, since free and paid often differ completely, and frontier models can carry their own retention rules.
3. If it trains by default, use the opt-out in the table or move that agent to a provider that doesn't.
4. Check retention against what the agent handles. If it touches PII, the retention window is a compliance number, not trivia.
5. Write the date you checked next to each agent. Re-check quarterly at minimum, and immediately after any terms update or model change, because consent state gets reset.

One step people skip: look at what your agent is actually sending. A bloated context prefix ships more of your business to the provider on every call than it needs to, and trimming it improves the bill and the exposure at once. That's the argument in the piece on skills that reduce token usage, and the cost side of the same decision is in the LLM pricing guide.

The thing I keep coming back to

Every provider here is behaving reasonably by its own lights. Free tiers get paid for with data. Logging catches abuse. Retention serves debugging, and on frontier models it serves safety monitoring that both OpenAI and Anthropic say they need. None of it is a scandal.

What is unreasonable is that answering "is my customer data in someone's training set" takes an afternoon of reading terms across three tiers, two jurisdictions and now a per-model exception, and that the answer changed twice this summer without anyone emailing you. The only durable defence is boring: know which provider and model each agent uses, write the date you checked beside it, and check again.

Updated monthly, and every pass is dated. If a policy changed before we caught it, tell us and we'll fix the row.

If any of this resonated, give BetterClaw a try. Bring your own keys across 28-plus providers with no inference markup, pick a different provider per agent, and see exactly what each one costs. Free plan with 1 agent and 100 credits a month, Basic at $19 a month, Pro at $49 for 5 agents. Start on the free plan or see full pricing.

Frequently Asked Questions

Does OpenAI train on API data?

Not by default. OpenAI's API baseline excludes customer content from model training, which is a different policy from ChatGPT, where conversations do feed training unless you turn off "Improve the model for everyone" in Data controls. Eligible API customers can also get zero data retention, and OpenAI confirmed in August 2026 that ZDR continues on its frontier models through its new Private Safety Processing system.

Does Anthropic train on API data, and what changed with Claude Fable?

Anthropic does not train on API traffic under its Commercial Terms, on any model. What changed is retention: Claude Fable 5 and Mythos 5, released June 9, 2026, require 30-day retention and are excluded from zero data retention agreements on every surface. Claude Fable 5.1 and Mythos 5.1, released September 2, 2026, restored ZDR for eligible enterprise customers, with a customer-hosted safeguards system arriving later this fall. Standard Claude models (Opus 5, Sonnet 5, Haiku 4.5) were never affected: 30-day default, ZDR by approval.

Which AI API is the most private for an agent?

Locally run models (llama.cpp, Ollama local tags, Jan AI, LM Studio) are the only option where privacy is structural, because prompts never leave your machine. Among hosted APIs, Groq is the strongest default because its no-training rule sits in the Services Agreement rather than a docs page and zero retention is a self-serve toggle, though it is US-only. For EU-only processing, Mistral is the cleaner choice.

Does the Gemini API free tier train on your data?

Yes. Google's own pricing table marks the Gemini free tier "Used to improve our products: Yes" and the paid tier "No." Enabling Cloud Billing and moving to the paid tier is the entire opt-out, and it is the cheapest privacy upgrade on this page. A free tier is fine for an agent that reads public data and never fine for one that reads your inbox.

Does DeepSeek's API train on your data?

The first-party DeepSeek API is covered by a single privacy policy shared with the consumer app, which describes training on user data with only a policy-level opt-out, no published retention window, and processing and storage in the People's Republic of China. The open weights are a separate matter: run DeepSeek locally, or through a third-party host with zero-retention terms, and none of that applies.

Is BYOK actually safer, or does it just move the problem?

BYOK doesn't create privacy, it gives you the choice that determines it, since your provider's terms apply either way. The gain is that you can route a customer-data agent through a no-train, zero-retention provider and a low-sensitivity agent through a cheaper one, instead of accepting one platform-wide policy. It also means the provider bills you directly, so there's no intermediary holding traffic you haven't vetted.