Is your SaaS vendor training AI on your company data? How to check
You can only tell from the vendor's current paperwork: the subscription agreement, privacy policy, data processing addendum and any AI feature terms, plus your admin console's AI settings. Look for clauses letting the vendor use customer content to improve or train models, and check before licensing your own records, since a prior grant can conflict with an exclusive license.
The short answer: read four documents and one settings screen
The product itself will not tell you. Whether a SaaS vendor may train AI on your company's data is set by its current paperwork: the subscription agreement or terms of service, the privacy policy, the data processing addendum, and any AI-specific feature terms, plus the AI settings in your admin console. Each can grant, limit or rule out training, and they do not always agree with one another.
The question matters most just before a company considers licensing its own records. A training right already given to a vendor can hand away part of the value for nothing and can complicate an exclusive AI-training license later.
Where do AI-training rights hide in SaaS paperwork?
Usually in definitions and "service improvement" language rather than in a clause headed "AI". Work through the documents in this order and save a dated copy of each.
| Document | Clause to look for | Wording worth flagging | What to ask the vendor |
|---|---|---|---|
| Subscription agreement or terms of service | The license the customer grants to the vendor | "improve, develop and enhance our services", "machine learning" | Does "improve" include training models, and whose models? |
| Privacy policy | Purposes of processing and how changes are announced | "we may update this policy", "to develop new features" | How will we be told before a new purpose applies to our data? |
| Data processing addendum | Processing only on documented instructions; subprocessors | New AI subprocessors, "aggregated" or "de-identified" carve-outs | Are AI model providers on the subprocessor list, and for what? |
| AI or generative feature terms | Model training, retention of prompts and outputs, opt-outs | "inputs and outputs may be used to train" | Is training off for business accounts, and is that in writing? |
| Order forms and renewals | Incorporation of the vendor's current online terms | "as updated from time to time" | Which version of the terms governs our current order? |
| Pilots, betas and free trials | Click-through preview terms and feedback clauses | "feedback may be used for any purpose" | Who accepted these terms, and do they still apply? |
The admin console is the sixth place to look. Some products expose workspace-level switches for AI features and data sharing; record each setting and the date you checked it.
Customer content, usage data and aggregated data: why do the definitions matter?
Most SaaS contracts separate three things. Customer content is what your people put in: messages, files, tickets, records. Usage data describes how the service is used: clicks, feature adoption, performance logs. Aggregated or de-identified data is either kind after processing that the vendor says removes identification.
Contracts often protect customer content tightly while giving the vendor broad rights over usage and aggregated data. For a company thinking about licensing its own records, the content clause is the one that counts, because content is what an AI buyer would license. A vendor right over usage telemetry is less likely to collide with a license of message or ticket history, though counsel should read both.
What have US regulators said about vendor promises and AI training?
The Federal Trade Commission's technology staff published two relevant posts. In January 2024 they wrote that promises not to use customer data for undisclosed purposes, such as training models, are enforceable, whether those promises appear in a privacy policy, terms of service, promotional materials or a marketplace listing. In February 2024 they warned that adopting more permissive practices, such as using data for AI training, and disclosing them only through a surreptitious, retroactive change to terms of service or a privacy policy could be unfair or deceptive.
Both posts are staff guidance, not rules, and both were written mainly with consumers in mind. They are still useful context when a business customer asks a vendor what changed and when.
This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.
Why check vendor terms before licensing your own records?
Two reasons: value and conflict. If a vendor may already train on your support tickets or chat history, part of what makes those records scarce has been given away without payment. And licenses for company records are typically exclusive for AI training for an agreed term, while records already licensed for AI training are a red flag during qualification. A broad vendor training right is not automatically disqualifying, but it has to be disclosed and understood before an exclusive license is signed.
The same logic applies to every system with years of history: email (see licensing an email archive for AI training), finance platforms (see licensing finance records for AI training), and support desks, CRMs and code repositories.
A pre-introduction terms review for MSPs and fractional CTOs
Managed service providers and fractional CTOs often hold the admin credentials and the vendor list, which puts them in a good position to run this check before introducing a client. Keep it to fact-finding; interpretation belongs to the client's counsel.
- Pull the system list from the client's documentation, or build a metadata-only list with the data inventory builder. Focus on systems holding five or more years of history.
- For each system, download the current terms of service, privacy policy, data processing addendum and AI feature terms, and file each with the date retrieved.
- Search every document for "train", "machine learning", "artificial intelligence", "improve", "aggregate", "de-identified" and "feedback".
- Capture the admin console's AI and data-sharing settings with the date.
- Ask who accepted any AI pilot, beta or preview terms, and when.
- Note renewal dates, since updated terms can be accepted at renewal without much notice inside the company.
- Hand the file to the client's counsel. If the client proceeds, the company shares its own conclusions with SourceX during qualification; the partner never sends client records or signed contracts.
What if a vendor already has training rights?
Not every finding is a problem. Use this table to decide the next move.
| Finding | What it likely means | Next action |
|---|---|---|
| Vendor may train on customer content, no opt-out | Overlap with any future license of that system's records | Counsel review; disclose during qualification; consider leaving that system out of scope |
| Opt-out exists but was never used | Past content may already have been used | Switch it off now; ask the vendor in writing how earlier data is treated |
| Rights limited to usage or aggregated data | Lower overlap with a content license | Record it and disclose it; rarely the deciding factor |
| Terms are silent or vague | Position unclear | Get a written statement from the vendor before relying on it |
| Rights came from a pilot's click-through terms | Scope may be narrow or expired | Check whether the pilot terms still govern any data |
Owners still weighing the bigger decision can read the pros and cons of licensing company data, and the full referral path is laid out in how it works.
Next step
If you run this review for a client with deep, clean history, register as a partner and introduce the owner. The company can also apply directly at sourcex.si/apply.
- Step 1Share your linkSend your personal link to a company you know.
- Step 2Company appliesThe company applies itself at /apply.
- Step 3Buyer selects and paysThe buyer selects and pays for the data and SourceX receives its fee.
- Step 4You get your rewardYour share of SourceX fees becomes payable.
Common questions
Does switching off AI training now undo training that already happened?
Generally an opt-out changes what happens next; it does not by itself remove data from models already trained. How a vendor treats content collected before the switch depends on its terms and practices, so ask in writing and keep the answer with the dated copy of the terms. If the system matters for a future license, tell counsel what the vendor said before any exclusivity is promised.
Do free AI pilots carry different terms from the paid product?
They can. Pilots, betas and previews are often governed by separate click-through terms that may allow broader use of inputs, outputs or feedback than the main subscription agreement. Find out who accepted them, on which date, and whether they still apply to any company data. When a pilot ends, ask the vendor to confirm in writing what it keeps and for how long.
Is a vendor training right a reason not to license the company's records?
Not automatically. It depends on the system, the data and how broad the right is. A right over usage telemetry rarely overlaps with a license of ticket or message history, while a broad right over customer content in the same system might. Disclose the finding during qualification so scope can be set around it, and let counsel decide whether that system belongs in the license.
Who in the company should own the vendor terms review?
Whoever signs or renews software contracts, working with counsel. The CFO, COO or head of IT can own it, with the managed service provider or IT team gathering documents and screenshots. What matters is one dated file per system: the terms retrieved, the AI settings observed, any vendor statements and the renewal date, so the review can be repeated and shown to a buyer's diligence team.
How often should vendor AI terms be rechecked?
At every renewal, whenever a vendor announces new AI features, and immediately before any licensing decision. Many SaaS agreements incorporate online terms the vendor can update, so last year's review may not describe today's position. Keeping dated copies makes it easy to see what changed and when, which also helps if the company ever needs to question a change with the vendor.
Related pages
Free resources
- MOIC calculator — Multiple on invested capital from realized and unrealized value.
- PDF bank statement to CSV converter — Turn Chase, Bank of America or Wells Fargo PDF statements into CSV, privately in your browser.
- Client data licensing eligibility checker — A transparent preliminary screen for one company.
- All free tools · MCP resource center
By SourceX Partnerships Team · Published 2026-10-09 · Updated 2026-10-09
Know a US company with valuable proprietary data?
Become a referral partner from anywhere we support, get your link and introduce an owner or authorized decision-maker.
Refer a company →I own a business
Explore licensing your company's data to AI developers worldwide. Start a short assessment; no uploads needed.
Start an assessment