"We don't train on your data" — why that promise isn't the point

Every serious AI platform says some version of "we don't train on your data." Maybe it is true today. That is not the point. A training pledge is a policy. Policies change. CEOs change. Companies get acquired. Terms get updated. The only guarantee that nobody trains on your client's W-2 is that nobody has the W-2 in the first place.

This post does not accuse a vendor of lying. It says the industry is answering the wrong exam question — and tax professionals are grading the training sentence while the file sits on a disk they do not own. For the contract version of that problem, see why privacy policies can change while uploads cannot be un-sent.

What the sentence actually covers

"We don't train on your data" typically means the vendor's current product configuration will not use your prompts and uploads as gradient updates to the foundation model they ship to everyone else. That is a meaningful commitment. It is also a narrow one.

It does not automatically mean:

• No employee or contractor can ever open a file. Support tickets, quality-assurance reviews, and abuse-detection processes may all involve human access to uploaded content — even when training is off.
• No subprocessor stores the object. The model vendor's cloud provider, their CDN, their logging system, and their backup infrastructure are all potential locations where fragments persist.
• No backup retained the bytes after "delete." Deletion in a product UI removes the pointer. Backup tapes, disaster-recovery snapshots, and compliance-hold systems operate on different schedules.
• No future entity can change the sentence. A new CEO, a board decision, an acquisition, or a product pivot can alter training policies going forward — and the file is already there when the policy changes.
• No lawful process can reach the copy. A subpoena aimed at the vendor compels production of whatever they hold. Your client's W-2 can become part of someone else's lawsuit because the file was findable.

Training is one use of data. Possession is the prior fact. Possession is what the upload journey creates.

Policy vs. physics

	Policy ("we don't train")	Physics (file never left)
What has to stay true?	A paragraph in a trust center	A network path that does not exist
What breaks it?	An update, a merger, a new product mode	You plugging the document into an external API
Can you audit it from your desk?	Not really — you rely on the vendor's word	You can refuse the path entirely
Who benefits from changing it?	The vendor, if data has commercial value	Nobody — the data is not available
What does your WISP say?	A vendor relationship with a promise	A device in a room you control

Physics is the definition of private AI. Policy is what governs Level 1 and Level 2 in the three-level framework.

Why tax firms latched onto the wrong assurance

It is the question journalists ask first. It is the question sales teams rehearse. It sounds like an ethics commitment. And it is genuinely better than the alternative — a vendor that openly uses your files for training is worse. The problem is that "better than the worst case" became "good enough" in partner meetings, and nobody asked the next question.

For §7216, the operative verb is disclose — making return information available to a party other than the taxpayer. A disclosure occurs when the file arrives at the vendor's server, not when or if the vendor runs training on it. A copy that is never used for training is still a copy that was disclosed. See what you remain responsible for under the IRS framework.

What happens when the sentence changes

Training policies are version-controlled. The version that existed when you uploaded may not be the version in effect six months later. Four scenarios that change the deal without changing the file:

1. Product pivot: The vendor launches a "pro" tier that uses customer uploads for fine-tuning. Your old uploads may or may not be grandfathered — read the migration terms.
2. Acquisition: The buyer values the data corpus. The acquiring company's privacy practices may differ. Assignment clauses in the original terms may allow transfer.
3. Regulatory pressure: A government requests access to training data for audit or investigation purposes. Whatever the vendor holds is what they produce.
4. Operational change: Human reviewers are added for quality assurance. The no-training promise is maintained, but human eyes now see files that were uploaded under a different expectation.

None of these scenarios require the vendor to have lied. They require only that the file still exists outside your office when the event occurs. Deeper analysis of this dynamic in the policy-change post.

A better script for vendor demos

Replace "do you train on my data?" with a sequence that actually reveals the data lifecycle:

1. Does any client document leave this building to be processed on your cloud? If yes, everything below applies. If no, confirm how — not with a marketing claim, but with an architecture description.
2. Who are all recipients, including subprocessors? The model vendor, the cloud provider, the logging system, the backup provider, the CDN — name them.
3. How do I export and delete, and what don't those buttons cover? Primary storage, backups, logs, DR snapshots — what is the gap between the UI and the infrastructure?
4. What happens to the training pledge if you are acquired? Is there an assignment clause? Does the pledge survive a change of control?
5. Can I run document jobs with no external API call at all? If the answer is yes, that is Level 3. If the answer is "we process locally in your browser," verify with network monitoring.

If the demo cannot survive question 1 — if the file leaves the building — questions 2 through 4 are about managing the consequences of that disclosure. They are important, but they are downstream of the fundamental decision.

Zero-retention APIs: closer, but still not local

Some vendors offer "zero-retention" or "ephemeral processing" APIs where files are processed and immediately discarded, with no storage. These are a meaningful improvement over standard retention — but they are not the same as the file never leaving:

• The file still traversed the internet to their server during processing
• "Zero retention" is a policy claim about their operational discipline — you cannot independently verify it
• Processing logs, error dumps, and transient caches may retain fragments even under a zero-retention policy
• The API operator's legal jurisdiction still governs compelled disclosure during the processing window

Treat zero-retention APIs as Level 2 with better hygiene, not as Level 3. Document the vendor relationship in your WISP with the same rigor you would apply to any cloud service that handles return information.

Frequently asked questions

If they truly do not train, isn't that enough for a small firm?

It is better than the opposite. It is not equivalent to never sending the file. Small firms still have §7216 obligations and a WISP requirement. Firm size does not create a public-chat exception to disclosure rules.

Are zero-retention APIs the same as private AI?

Closer on paper. You still transmitted the bytes to a machine you do not own during processing. Zero-retention is a policy plus an architecture claim. Treat it as Level 2 with extra homework, not Level 3.

Does XyloDocs promise never to train on client documents?

Do not reduce this article to a slogan war. Ask where files go in each feature. Communication and intake is a product you can use today on a client record you operate; local document inference is the 2027 architecture thesis. Evaluate each feature's data flow independently.

What if no vendor offers Level 3 today?

For document processing tasks (OCR, extraction, classification), on-premise solutions do exist in the market. For a full tax workflow — intake through filing — the Level 3 option is what 2027 product roadmaps are building toward. The XyloDocs tax software is designed with this architecture in mind. Meanwhile, enforcing the knowledge-vs-documents split by firm policy prevents the most common Level 1 mistakes.

The bottom line

Believe the training pledge if the evidence supports it. Then notice it was never the guarantee you actually needed. Nobody trains on what nobody has. Build your practice around that sentence — not around a promise that a copy on someone else's server will be treated well forever.

Continue with private cloud vs. private local: why the difference matters for tax data.