On this page
Key takeaways
- With AI analytics, the model usually sees your question, a description of your columns and summarised results, not your whole dataset.
- Major providers such as OpenAI and Anthropic state that, by default, they do not train on data sent through their commercial APIs.
- With bring-your-own-key, your organisation's agreement with the provider governs your data.
- Always check the provider's current policy and ask your vendor exactly what is sent.
The short answer
For business API use, major AI providers say no, not by default. OpenAI and Anthropic both state that data sent through their commercial API products is not used to train their models unless the customer opts in. Policies, retention periods and exceptions vary by provider and product, and they change, so read the current policy for the provider you use:
- OpenAI: Enterprise privacy
- Anthropic: Commercial terms
Consumer chat apps are a separate case. Their settings and defaults can differ from the API, so do not assume one applies to the other.
What an analytics tool sends to the model
To turn a question into a correct query and explain the result, the model needs some context. In conversational analytics, that usually means:
| Sent to the model | Why | Example |
|---|---|---|
| Your question | To understand what you want | "Revenue by region last quarter" |
| Column descriptions | To write a query against the right columns | order_value_usd: currency measure |
| Summarised results | To write the explanation | Revenue per region: 5 numbers |
What it normally does not need is every row of your data. The query runs against your data inside the analytics platform, and only the question, the structure and the aggregated result are needed to write the explanation.
Ask your vendor to confirm exactly what is sent for each feature. It is the most useful question in any AI security review.
How bring-your-own-key changes the picture
When an analytics tool uses its own AI account, your data flows through the vendor's agreement with the provider. You depend on the vendor's settings and contract.
With bring-your-own-key (BYOK), model calls run on your organisation's account. That means:
- Your agreement applies, often one your legal or security team has already reviewed.
- You choose the provider, including one your company has already approved.
- You can revoke access at any time by revoking the key.
- You can see usage on your provider's dashboard.
DashboardGPT supports bring-your-own-key on every plan.
Other protections that matter
Training is only one question. Also check how the analytics tool protects your data:
- Tenant isolation: your workspace's data is kept separate from other customers.
- Secure processing: data is protected in transit and at rest.
- Access control: only the right colleagues can see each workspace.
- Read-only connections: the tool cannot change your database.
- Deployment options: private or self-hosted deployment for strict requirements, available on DashboardGPT Enterprise.
Practical steps to limit what is shared
- Upload only the columns you need. Remove names, emails and phone numbers before uploading.
- Use aggregated or anonymised extracts for sensitive topics.
- Connect views, not raw tables, when you link a warehouse, so sensitive columns are excluded at the source.
- Use a dedicated API key for analytics, with its own spend limit.
- Review your provider's data settings once a quarter.
Questions to ask any AI analytics vendor
- Which data is sent to the model for questions, explanations and profiling?
- Is raw row-level data ever sent? When?
- Can we use our own AI provider key?
- How is our data isolated from other customers?
- Where is our data stored and processed?
- Is private or self-hosted deployment available?