Where what your employees type into AI ends up
The real path of a corporate prompt: retention, model training, subprocessors and data residency — and the questions that belong in the contract.
*Second article in our series on enterprise AI, legacy integration and information governance.*
Executive summary
Every prompt an employee types is a data transfer to a third party. The question almost never asked before signing is simple: where does that data travel, how long does it stay, who else can see it, and what happens if the company wants it all back. This article maps the real path of a corporate prompt and lists what must be in writing in the contract — not on the vendor's marketing page.
The journey of a prompt
When an employee pastes a contract excerpt into an AI tool, the data crosses at least six stages. Each one is a governance decision point the company can — and should — control.
- 1.Capture. The text leaves the device. If the tool is a browser extension or an unmanaged app, visibility is lost in the first meter.
- 2.Transit. Encryption in transit is standard at any serious vendor; it is not a differentiator, it is the floor.
- 3.Processing. The inference provider may differ from the interface vendor. Tools commonly resell third-party model capacity — adding a subprocessor to the path.
- 4.Retention. Prompts and responses are typically stored for a period for abuse monitoring, support and debugging, even when training is disabled.
- 5.Reuse. The most sensitive point: is the content used to train or tune models? Enterprise plans usually say no; individual plans often say yes, by default.
- 6.Disposal. Deletion timelines, backups, and what is actually erased when the contract ends.
| Stage | Question to ask | Acceptable evidence |
|---|---|---|
| Processing | Which subprocessors are involved? | Public, versioned list with advance notice of change |
| Retention | How long are prompts stored? | A term in the contract, not in an FAQ |
| Reuse | Does content train models? | Contractual commitment excluding training |
| Residency | Where is data processed and stored? | Declared region and regional restriction option |
| Internal access | Who at the vendor can read content? | Access policy, logging, incident-only restriction |
| Exit | What happens at contract end? | Full export and certified deletion timeline |
Consumer and enterprise plans are not the same product
The most expensive confusion in companies today is treating the consumer version as equivalent to the enterprise one because the interface looks identical. It is not. Training commitments differ, retention differs, account administration differs, administrative logging differs, and legal responsibility in an incident differs.
A practical consequence: a company can have an impeccable enterprise contract and, at the same time, hundreds of employees using the personal version for the same work. Policy only holds when the approved path is more convenient than the alternative.
GDPR and LGPD applied to the prompt
From a regulatory standpoint, pasting personal data into an AI tool is processing with transfer to a processor — frequently across borders. That requires a legal basis, a declared purpose, minimization and, depending on risk, an impact assessment.
Three common traps:
- Purpose creep. Data collected to perform a contract may not lawfully serve to train or evaluate an AI system.
- Minimization ignored. Pasting a full document when three paragraphs would do multiplies exposure with no quality gain.
- The data subject forgotten. If someone requests erasure, the company must know whether that data landed in a third party's conversation history.
Controls that work without blocking work
Banning rarely works; channeling does. The controls with the best protection-to-friction ratio are:
- 1.An official path that is easier. Corporate access with single sign-on, available to everyone, eliminates most parallel usage.
- 2.Simple data classification. Three levels, not seven. The rule must fit in the head of someone in a hurry.
- 3.Redaction and masking at the edge. Stripping identifiers before sending preserves text utility and reduces personal data in transit.
- 4.A record on the company side. Storing input, output and context in your own infrastructure makes the trail independent of the vendor — the subject of Turning AI interactions into auditable knowledge.
What to do on Monday
- Ask legal for the subprocessor list and retention clause of every AI tool already contracted.
- Check whether any active "contract" is in fact an individual plan reimbursed as an expense.
- Publish a one-page rule on what may never be pasted into an external tool, with real examples from your industry.
- Enable the corporate path before announcing any restriction — policy without an alternative becomes hidden usage.
Conclusion
A prompt is not a message: it is a data transfer with a term, a jurisdiction and a chain of custody. Treating it that way before an incident costs a few contract clauses. Treating it afterwards costs customer trust.
Further reading
Engineering track:
- AI gateway: DLP and outbound data control — the technical deep dive on this topic.