Defense AI: Data Retention, Who Sees Our Data, Is it Used for Training

Short answer: With Defense AI, OpenAI and Anthropic don't run the models you use and don't receive your prompts, files or code. Microsoft runs OpenAI models in your Azure subscription, and Google runs Claude models in your Google Cloud project. Under their enterprise terms, neither uses your prompts or responses to train models.

Atomus sees how Defense AI is set up and how much it's used, but not what people ask or what the models answer. Prompts, responses and files go from your tools to your gateway and models in your own cloud, and never pass through the Atomus admin portal. Defense AI and your gateway don't store prompts or responses. They store settings and daily usage totals. Microsoft and Google run abuse monitoring that can keep flagged content: up to 30 days on Azure and up to 90 days on Google Vertex AI by default. To stop that, your company has to apply to the provider for an exemption. We recommend every Defense AI customer applies.

Note: We've noticed delays in Microsoft and Google coming back with decisions on these exemptions. Apply early, and tell your Atomus contact when you submit.

What each party keeps

Response caching

Response caching is off by default. If an admin turns it on, cached responses live only in the gateway's memory for a short time and are never written to disk. They're cleared when the cache time runs out or the gateway restarts.

What Atomus can and can't see

What Atomus can see

• Your settings: company settings, which models are deployed, budgets and rate limits, and which connectors are turned on.

• Usage totals: daily request counts, token counts and estimated cost, by model and by person.

• Who's set up: the work accounts of people who've signed in and received a key.

• Health and setup: setup progress, gateway health, the audit log of admin changes, and error codes from operational logs. These logs are designed to exclude prompt and response content.

What Atomus can't see

• Prompts, responses, files or anything else people send to the models

• Your Microsoft 365 email, files, calendar, contacts or sign-in tokens

• Gateway traffic in transit. It isn't recorded anywhere Atomus can read

• Your cloud account passwords

The access Defense AI does have

So you can judge it for yourself, here's what Defense AI holds to run your deployment:

• An admin key for your gateway. The portal uses it to issue and revoke people's keys and to read usage totals. It's encrypted at rest and only used by server-side code. The gateway doesn't store prompts or responses, so this key doesn't give access to them.

• Roles on your Defense AI subscription. During setup, your admin grants the Defense AI Setup app the Contributor and User Access Administrator roles on the dedicated Defense AI subscription, so it can create and update those resources. You can see these role assignments in the Azure portal under Access control (IAM) on that subscription.

• Short-lived setup sign-ins. The one-time admin sign-ins used during setup are encrypted, kept for at most 10 minutes (Azure) or 60 minutes (Google Cloud), and deleted when setup finishes.

• No Google service-account keys. Your gateway connects to Google Cloud using Workload Identity Federation, so no Google keys are created or stored.

Atomus staff access

• Only invited Atomus staff can use the staff side of the portal.

• Read-only staff can view setup status for support. They can't deploy anything or change your configuration.

• Every admin change is recorded in an audit log.

If Atomus is also your managed service provider

Some companies also use Atomus to manage their Microsoft 365 or Azure environment. That access comes from your managed services agreement, not from Defense AI, and is governed by that agreement. Ask your Atomus contact if you'd like to review it.

OpenAI models on Azure

• Microsoft runs them. OpenAI models run on Microsoft's Azure OpenAI service, inside your Azure subscription.

• OpenAI doesn't receive your data. Microsoft states that prompts and responses are not available to OpenAI.

• No training. Microsoft states that prompts, responses and embeddings aren't used to train or improve OpenAI or Microsoft models without your permission.

• Abuse monitoring. By default, Azure OpenAI checks prompts and responses for misuse and may store them for up to 30 days, in the same Azure region as your resource. Microsoft says only authorized Microsoft employees can review content, only when it has been flagged, using secure workstations and just-in-time approval. Stored content isn't used to train models.

If Microsoft approves your company for modified abuse monitoring, it doesn't store prompts or responses for that subscription, and human review doesn't happen.

How to apply for modified abuse monitoring

1. Find the subscription ID of your Defense AI subscription in the Azure portal under Subscriptions.

2. Open Microsoft's Limited Access registration for modified abuse monitoring: https://aka.ms/oai/modifiedaccess

3. Complete the form for that subscription. Use an admin email in the same tenant, because Microsoft sends its decision there.

4. Wait for Microsoft's decision by email. Microsoft decides who qualifies, and some advanced models have stricter criteria.

5. Once you're approved, confirm the setting on your Azure OpenAI resource, then tell your Atomus contact.

Claude models on Google Cloud (optional add-on)

• Google runs them. Claude models run on Google Cloud Vertex AI, inside a Google Cloud project your company owns.

• No training. Google's terms don't allow it to use your data to train or fine-tune models without your instruction.

• Anthropic's terms also apply. Use of Claude on Google Cloud is covered by Anthropic's commercial terms.

• Abuse monitoring. By default, Google may log prompts that its safety classifiers flag, for up to 90 days, in the region your project uses. Authorized Google staff may review flagged prompts. Logged prompts aren't used to train models. Customers with a Google Cloud Master Agreement have different defaults.

How to get a Google exemption

1. Check whether your company has a Google Cloud Master Agreement or uses Google's standard online terms.

2. Ask your Google Cloud account team to confirm, in writing, that abuse-monitoring prompt logging is turned off for your project and for the Claude models you use.

3. Share the confirmation with your Atomus contact so we can note it on your account.

Models with required retention

Google and Anthropic designate some models as "Advanced AI", including the Claude Fable and Claude Mythos families. For those models, prompts and responses are kept for up to 30 days and must be shared with Anthropic for abuse monitoring. There's no opt-out. Defense AI's Claude add-on offers Claude Haiku, Sonnet and Opus. Check with your Atomus contact before you turn on any model with required retention.

Compared with signing up directly

What about the apps themselves?

Claude Desktop and Claude Code are made by Anthropic. Codex is made by OpenAI. Defense AI sets them up to send prompts and responses to your gateway, not to the AI company. The apps may still contact their makers for things like updates, sign-in screens and crash reports. Defense AI's Claude Code settings turn off Claude Code's non-essential traffic to Anthropic.

To keep CUI on the Defense AI path:

• Don't sign in to these apps with a personal or company account from OpenAI or Anthropic while working with CUI. A signed-in session sends requests to that company, not your gateway.

• In Claude Desktop, check that the bottom-left corner says Defense AI.

Is this "zero data retention"?

For Defense AI and your gateway: prompts and responses aren't stored.

For the cloud provider: only after your exemption is approved, and only for models it covers. Until then, flagged content may be kept as described above.

Related articles: Defense AI: How It Works (Architecture and Request Flow) · Defense AI: Security Controls · Defense AI: What Setup Creates and What Permissions It Asks For · Defense AI: Using AI Coding Agents: Files, Secrets and Repository Content