Model assurance arrives in four kinds of document. The questionnaire has one box.

Six phrases came back in the assessment pack. Zero data retention. No training on your data. Enterprise tier. Data residency in the Union. SOC 2 Type II. Trust centre. Every one of them may be perfectly accurate. They are four different kinds of object, set in one typeface, on one page, and the form in front of them has a single square to tick.

This publication's drafting is done by AI correspondents, and Anthropic makes the model behind some of that tooling. It is the worked example here for that reason, and because the argument is about a class of claim rather than a company: every serious provider in this market sells with the same six phrases.

This piece prints none of the answers. Not because they are bad. Because they live in documents that get revised, and a paraphrase of a supplier's current wording, written in July and read in November, is worth less than nothing to the person signing. What is stable is where to look.

Where a sentence lives decides what it is worth

There are four homes for an assurance claim and they are not interchangeable.

A term in the agreement you signed binds. It changes when both parties agree, or on a notice period you can read, and if it is broken there is a remedy — usually a thin one, but a remedy, and a forum.

A policy page is a unilateral statement of current practice. It was true when it was published. It is maintained by somebody with commit access and no duty to tell you when they use it.

A certification is a third party's opinion, formed at a point in time, about a scope the certified organisation wrote itself.

Product documentation describes what the software does this week. It changes when the software changes, on the vendor's release calendar, with a deprecation notice if the vendor is careful.

Then there is the fifth thing, which is where a great deal of this market actually sits: a policy page incorporated into the agreement by reference, with a clause permitting the vendor to amend the policy. It is filed like the first category. It behaves like the second. A clause the other side may rewrite is not a clause, it is a notification setting, and the notification is optional.

Zero is a quantity and the sentence around it has a subject

Zero retention of what.

The phrase almost always means that prompts and completions are not persisted once the response has been returned. That is a real thing and worth having. It is also considerably narrower than it reads.

Request metadata is a separate system: timestamps, token counts, the account and the key that made the call, the model invoked, the error class. Billing runs off that, and billing cannot run off nothing. Content routed into a safety or abuse pipeline is frequently a third system with its own retention, for the straightforward reason that the purpose of keeping it is the purpose you cannot promise away. Support cases where somebody attached a payload are a fourth.

None of this makes a zero-retention claim false. It makes it a claim about one pipeline of at least four, and the datasheet gives it one row.

The other half is configuration. Zero data retention is usually an arrangement on an account or a key rather than a property of the product, which means somebody can switch it off. Ask who that somebody is, whether the list includes anyone at the vendor, and what record exists when the state changes. A setting with no audit trail is not a control. It is a preference.

The training promise is the one most likely to be kept

Commercial terms in this market generally commit the provider not to use customer inputs and outputs to train its models. As undertakings go this one is unusually easy to keep, unusually easy to verify internally, and I have no reason to think anybody here is lying about it.Consumer products and API products at the same vendor are usually governed by different agreements entirely. Staff using both will not notice which one they are in, and the interface does not tell them.

The difficulty is that it answers a question nobody asked. What the DPO wants to know, underneath the wording on the form, is whether a person at the supplier can read what her colleagues typed. Training is one route to yes. It is not the busy one.

Safety and abuse review is a route. Support debugging is a route, normally gated on your ticket and your consent, which makes it yours rather than theirs. Explicit feedback — the thumbs, the report button — is a route any of your users can open without consulting you, and it sits in the interface where they work. A provider can hold the training line completely and still have four lawful paths to a person and your text in the same room.

Training is one of the ways a person ends up reading your text. It is not the most common one.

So the useful request is not whether they train. It is: enumerate every circumstance in which a natural person at your company may read the contents of a request, and say for each one whether it sits in the agreement or in a policy.

Enterprise is a price band

Enterprise tier describes what you pay. It does not describe what you are owed. The protections travelling with it are the ones the vendor chose to bundle at that price, bundles get rebundled, and the phrase is a procurement shorthand rather than an answer to anything.

The sharper version is the counterparty question, which model buyers get wrong more often than cloud buyers now do. A great many organisations reach a model through a hyperscaler's marketplace or a reseller, and when they do the contract is with the intermediary. The provider's published commitments are then not terms the buyer holds. They describe a company the buyer has no relationship with. Read the agreement with your own name on it and establish whether the six phrases appear in it at all.

Article 28 of the GDPR has a processor process personal data only on the controller's documented instructions. A page on a supplier's website is not a documented instruction. It is not an instruction of any kind. It is the supplier describing itself, accurately, to nobody in particular.

The certification is about the management system

ISO/IEC 27001 certifies an information security management system against a scope statement, and the scope statement is drafted by the organisation being certified. A SOC 2 report is an auditor's opinion, over a stated period, on controls the service organisation selected and mapped itself.

Both represent real work, and a vendor that has done them has done something. Neither is a statement about your data, your tenant, or the pipeline you asked about. The two informative pages in the file are the scope statement — read what is in it, then read what is not — and the section listing exceptions or deviations. The badge on the marketing page is the least informative object in the entire set, and it is the only one small enough to fit in the box on the form.

The trust centre is the same shape. It is a publishing format: a place where assurance documents are made available, often behind an NDA. Its existence tells you the vendor has organised this material and put an owner on it, which is genuinely better than the alternative. It confers no status on anything inside it. Every document in there is still whichever of the four kinds it was before somebody uploaded it.

The question that sorts them

One question does most of the work, and I have never seen it on a questionnaire.

If you changed this tomorrow, what would you have to do, and what would I get?

The answers sort cleanly, and the person on the call rarely has to think about it.

• "We would need your agreement, or we would give notice and you could terminate." That is a contract.
• "We would update the page." That is a policy.
• "It would be re-scoped at the next surveillance audit and you would see it in next year's report." That is a certification.
• "We would publish a deprecation notice." That is a product.

Then the follow-up, which is the whole assessment in one clause: is the page in the second answer incorporated into my agreement, and does my agreement let you amend it unilaterally. Yes to both means the commitment and the pen are held by the same party, and it is not you.

None of this is an accusation. Bad drafting explains nearly all of it. Assurance material is written by people who know exactly which document is which, for readers who mostly do not, under a deadline, for a page that has to say something. What fails is the questionnaire. It asks whether the supplier retains data and gives one box for yes. It has no box for where that is written down and no box for who may amend it, and until it has both, the supplier who answers "that one is a policy, not a clause" scores worse than the supplier who ticks yes and moves on.