Training data
fine-tuning / pre-training / will you train on our data / model training
Training data is what a model learned from. The question owners ask is whether their own data joins it, and there is no single answer: OWASP names three separate stages, pre-training, fine-tuning and embedding. A commitment worth having names the stage and comes in writing.
The question is always the same and the answer depends on a distinction most conversations skip. OWASP names three: data poisoning can target different stages of the LLM lifecycle, including pre-training, which is learning from general data, fine-tuning, which is adapting models to specific tasks, and embedding, which is converting text into numerical vectors. Your information could touch any one of those and not the others, so a yes or no answer is not an answer.
The reason the distinction is a security matter, not only a privacy one, is in the same document. Data poisoning occurs when pre-training, fine-tuning, or embedding data is manipulated to introduce vulnerabilities, backdoors, or biases. Whoever controls what goes in controls part of what comes out, which is why unverified training data increases the risk of biased or erroneous outputs.
The failure that catches ordinary businesses is not an attack at all. OWASP lists it plainly: users unknowingly inject sensitive or proprietary information during interactions, which could be exposed in subsequent outputs. Nobody set out to hand over a price list or a client name. Somebody pasted it into a prompt because it was the fastest way to get an answer.
What a real commitment looks like is worth seeing once. One vendor writes that your prompts, completions, embeddings and training data are not available to other customers, and are not used to train any generative AI foundation models without your permission or instruction. It goes further, stating that customer data, prompts and completions are not used to improve its own or third-party products or services without explicit permission. That is what a specific answer reads like, and it is a useful shape to hold other answers against.
In practice
The practical control is not a clause, it is a habit. Whatever your agreement says, staff decide what goes into the box, and the box does not look like a filing cabinet. Deciding what is never pasted in, and saying so once in plain words, does more than a paragraph nobody reads.
Not the same as
- Retrieval
- A system that reads your documents to answer a question is not learning from them. That is a different arrangement with different risks, and the two get described with the same sentence in sales conversations.
- Logging
- Keeping a record of what was asked is ordinary and often required. Whether those records then feed a model is a separate decision that should be written down separately.
Why it matters to you
This is the question every business asks about AI and the one most often answered in a way that sounds definitive and commits to nothing. Knowing that there are three stages turns a vague reassurance into something checkable, and the vendors who have thought about it will answer stage by stage without being prompted.
What to ask or check
- 01Which of the three stages, if any, could our information reach?
- 02Is that commitment in the contract, or only in a sales conversation?
- 03What have we told staff they must never paste into one of these tools?
What people get wrong
That training is one thing a vendor either does or does not do. OWASP separates pre-training, fine-tuning and embedding, and a commitment that does not say which stage it covers has not answered the question.
Red flags
- A reassurance about training that appears nowhere in the agreement.
- An answer that does not distinguish the stages when asked directly.
- No guidance to staff about what may be pasted into an AI tool.
Who owns it
The vendor owns the commitment and you own the habit. Only one of those is enforceable, and the other is the one that leaks.
Where you will see it
In a vendor's security page, in the paragraph of a contract nobody negotiated, and in whatever somebody pasted into a chat box this morning.