No-Training, Zero-Retention AI & Your Data

When you paste a contract, a customer list, or an internal roadmap into a chatbot, one question should come first: what happens to that text after you hit send? For consumer AI tools, the honest answer is often "it depends on settings you never checked." For business AI, the answer needs to be contractual, verifiable, and boring.

What "no training" and "zero retention" actually mean

These two phrases sound similar but describe different guarantees, and you want both.

No training means the AI provider will not use your inputs or outputs to improve, fine-tune, or retrain their models. Your data does not become part of a future model's weights. It is never seen by a labelling team, never sampled into an evaluation set, and never resurfaces in someone else's answer.

Zero retention means the provider does not store your prompts and responses after the request is served. Once the model returns an answer, the input is discarded rather than logged and kept for days, weeks, or indefinitely. There is no growing archive of your conversations sitting on a third party's servers waiting to be breached, subpoenaed, or repurposed.

You can have one without the other. A provider might promise not to train on your data while still retaining it for 30 days of "abuse monitoring." That retained copy is still a copy: it can be compromised, requested by a court, or exposed by a misconfiguration. For sensitive business data, the standard worth holding out for is both guarantees, written into the contract rather than buried in a settings toggle.

Why consumer AI tools are a different deal

The free or low-cost consumer versions of popular chatbots operate on a different bargain. In many cases, the default is that your conversations can be used to train and improve the service unless you actively opt out, and even then, retention windows and human review for safety may still apply.

That trade is reasonable for a personal assistant helping you draft a birthday message. It is a poor fit the moment employees start pasting in client data, source code, pricing models, or anything covered by a confidentiality clause. The problem is rarely malice; it is defaults. Staff reach for the tool they use at home, and business data quietly leaves your control through a consumer account nobody vetted.

The distinction matters legally too. Under the GDPR you remain the controller of personal data your employees feed into a tool. If that data is retained or used for training by a provider you have no data processing agreement with, you have a compliance gap that no clever prompt can close. This is why data governance belongs in your compliance posture, not in individual habits.

How AgentWorks handles your data by contract

AgentWorks runs on no-training, zero-retention model contracts with the AI providers behind the platform. Your prompts and the documents your agents read are used to produce your answer and are not fed back into model training. This applies across the models available in the platform, from GPT-5 and Claude to Gemini and Mistral Large.

Two design choices reinforce that baseline:

• PII masking at the gateway. Before any message reaches a model, detected personal data is masked at the gateway layer. The model works on a redacted version, so sensitive identifiers are minimised before they ever cross the boundary to a provider.
• EU data residency. Where EU model endpoints are offered, requests are routed to them, keeping processing within European infrastructure rather than defaulting to servers elsewhere.

Because AgentWorks is an EU-native platform built in the Netherlands, these are starting assumptions rather than upgrades you have to negotiate. A DPA is available on request, which gives you the documented processor relationship the GDPR expects.

Data control across chat, knowledge, and agents

No-training guarantees only help if they hold everywhere your data flows, not just in a single chat box.

In multi-LLM chat, you can switch models mid-conversation and use tools like web search, cited Deep Research, and code execution, while the same no-training and masking rules apply regardless of which model answers. When you build a private knowledge base, your uploaded PDFs, DOCX, CSVs, and connected sources like Notion or Confluence are indexed with pgvector and answered with citations. The system is designed to say "I don't know" when an answer is not grounded in your documents, rather than inventing one, and that knowledge stays yours.

The same holds for automated work. When you chain multi-agent pipelines such as research to draft to review to publish, or run scheduled agents, every step operates under the same data contract. There is no side channel where a scheduled job quietly retains what an interactive session would not.

Governance you can prove, not just claim

Contracts set the rules; auditability proves they were followed. AgentWorks pairs its data commitments with governance features aimed at accountability rather than marketing.

Every agent run is written to an immutable, append-only audit trail that you can export as CSV or JSON. Each agent carries a risk classification, and state-changing actions can require human-in-the-loop approval before they execute. This is the practical side of being EU AI Act-ready: the platform gives you the risk classification, oversight, and logging the regulation expects, while the actual risk level of any given use case remains yours to assess.

It is worth being precise here. Being EU AI Act-ready is not the same as a blanket "compliant" stamp, and AgentWorks does not claim ISO or SOC 2 certifications it does not hold. What it offers is a set of concrete, inspectable controls: no-training and zero-retention contracts, EU residency, gateway-level PII masking, per-agent risk classes, and an exportable audit log you can hand to a reviewer.

Summary: "No training" means your data never trains the AI; "zero retention" means it is not stored after your request is served. Consumer tools often default to the opposite. AgentWorks runs both guarantees by contract, adds gateway PII masking and EU residency, and backs them with an exportable audit trail so you can demonstrate control rather than just assert it.

Frequently asked questions

Does no training mean my data is completely private?

No-training means your inputs and outputs are not used to retrain the underlying models, and zero-retention means they are not stored after your request completes. Combined with gateway PII masking and EU data residency, this sharply limits exposure. Full privacy still depends on your own access controls and how you configure integrations, so treat it as a strong foundation rather than a single switch.

How is this different from using ChatGPT at work?

Consumer chatbots frequently default to using conversations for training and may retain them for review unless you opt out, and often without a data processing agreement covering your business. AgentWorks applies no-training and zero-retention terms by contract across all models, masks PII before data reaches any model, and offers a DPA on request, which is the arrangement the GDPR expects for business data.

Can I verify that these commitments are being honoured?

You cannot see inside a provider's model, but you can inspect the full trail of what your agents did. AgentWorks records every run in an immutable, append-only audit log that you export as CSV or JSON, with per-step risk classes and human approval on state-changing actions. That gives auditors concrete evidence rather than promises. See compliance and pricing for how these controls map to each plan.