Skip to content

Commit 9e31049

Browse files
author
Evie (Attaché)
committed
docs(security): add LLM provider data handling guide
Covers data retention, training policies, and ZDR agreements for Anthropic, OpenAI, AWS Bedrock, and Google Vertex AI. Includes comparison to tools already in use (GitHub, Slack, Google Workspace) and guidance on choosing the right tier by sensitivity level.
1 parent b286b98 commit 9e31049

2 files changed

Lines changed: 160 additions & 0 deletions

File tree

‎docs/docs/security/index.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,3 +119,4 @@ Attaché's security controls today cover gateway hardening, exec allowlists, cha
119119
- **[Shared Access](./shared-access.md)** — How to let your team interact with agents without giving everyone the keys to the kingdom.
120120
- **[Risk Register](./risk-register.md)** — A structured look at each risk, how Attaché addresses it, and where you need to take action yourself.
121121
- **[Audit](./audit.md)** — How to verify your security posture and check for signs of compromise.
122+
- **[LLM Provider Data Handling](./llm-providers.md)** — What each provider does with your data, how to choose the right tier, and how this compares to tools you already trust.

‎docs/docs/security/llm-providers.md‎

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
---
2+
title: LLM Provider Data Handling
3+
sidebar_position: 6
4+
---
5+
6+
# LLM provider data handling
7+
8+
Your agent sends code, messages, and file contents to an LLM provider every time it reasons about a task. That's the fundamental tradeoff of using hosted models. But not all provider relationships are equal — the subscription tier you pay for determines what happens to your data after inference.
9+
10+
This page breaks down what each provider does with your data, and how to choose the right tier for your deployment.
11+
12+
## The data sovereignty argument
13+
14+
With Attaché, your agent runs on hardware you control. Your files, credentials, memory, and conversation history stay on your Mac mini. The only data that leaves your network is the inference payload — the prompt and context sent to the LLM for processing, and the response that comes back.
15+
16+
Compare this to cloud-based AI tools (Google Gemini with Drive access, Microsoft Copilot with email integration, GitHub Copilot with your full codebase) where the tool itself runs in someone else's infrastructure and has standing access to your data. With Attaché, you control what gets sent and when.
17+
18+
The remaining question is: what does the LLM provider do with the inference data?
19+
20+
## Provider comparison
21+
22+
### Anthropic (Claude)
23+
24+
| Tier | Trains on your data? | Retention | Zero Data Retention? |
25+
|---|---|---|---|
26+
| **API (default)** | No | 7 days (reduced from 30 in Sept 2025) | Available via agreement |
27+
| **API (ZDR agreement)** | No | Zero — deleted after response returned | Yes, covers API + Claude Code |
28+
| **Claude Pro / Max** | Opt-out available | Retained for product improvement | No |
29+
| **Claude Free** | Yes, by default | Retained | No |
30+
31+
Anthropic's API does not use your data for model training, period. The 7-day retention is for abuse monitoring only. If you need zero retention, it's available through a commercial agreement and applies to API endpoints and Claude Code.
32+
33+
**For Attaché deployments: use the API tier.** If handling sensitive client data, get a ZDR agreement.
34+
35+
### OpenAI (GPT-4, GPT-4o)
36+
37+
| Tier | Trains on your data? | Retention | Zero Data Retention? |
38+
|---|---|---|---|
39+
| **API (default)** | No (since March 2023) | 30 days for abuse monitoring | Enterprise agreements only |
40+
| **Team / Enterprise** | No | 30 days abuse monitoring | Enterprise: yes |
41+
| **ChatGPT Plus / Pro** | Opt-out available, but **on by default** | Retained | No |
42+
| **ChatGPT Free** | Yes, by default | Retained | No |
43+
44+
OpenAI's API hasn't used customer data for training since March 2023. But the retention window is 30 days (longer than Anthropic's 7 days). ZDR requires an Enterprise agreement. The consumer products (Plus, Free) have training enabled by default — users must manually opt out.
45+
46+
**For Attaché deployments: use the API tier.** Be aware of the 30-day abuse monitoring window.
47+
48+
### Google (Gemini)
49+
50+
| Tier | Trains on your data? | Retention | Zero Data Retention? |
51+
|---|---|---|---|
52+
| **Vertex AI** | No | Per GCP data processing terms | Yes (GCP enterprise terms) |
53+
| **Gemini API (paid)** | No | Varies | Check current terms |
54+
| **Gemini Free** | Yes | Retained | No |
55+
56+
Google Vertex AI runs within your GCP project and follows standard GCP data processing agreements. This is the strongest Google option for data-sensitive work.
57+
58+
### AWS Bedrock
59+
60+
| Tier | Trains on your data? | Retention | Who has access? |
61+
|---|---|---|---|
62+
| **Bedrock (all models)** | No | Not stored or logged | AWS only — model providers have no access |
63+
64+
AWS Bedrock offers the strongest data isolation of any hosted option. Amazon deep-copies the model into its own infrastructure. The model provider (Anthropic, Meta, etc.) never sees your prompts or completions. Your data stays within AWS's security boundary.
65+
66+
From the AWS docs: *"Amazon Bedrock doesn't store or log your prompts and completions. Amazon Bedrock doesn't use your prompts and completions to train any AWS models and doesn't distribute them to third parties."*
67+
68+
**The tradeoff:** Bedrock is pay-as-you-go and more expensive per token than direct API access. For high-volume agent workloads, the cost difference can be significant. But for clients with strict data residency requirements, it's the right choice.
69+
70+
### Google Cloud Vertex AI
71+
72+
Similar to Bedrock — runs within your GCP project, follows your data processing agreement, model providers don't have direct access to your inference data.
73+
74+
## How this compares to tools you already use
75+
76+
Before getting anxious about LLM inference data, consider what you're already trusting third parties with:
77+
78+
| Tool | Where your data goes | Who controls it | Training risk |
79+
|---|---|---|---|
80+
| **GitHub** | Microsoft servers | Microsoft | Private repos: no. Public repos: used for Copilot training |
81+
| **Google Workspace** | Google servers | Google | Enterprise: no training |
82+
| **Slack** | Salesforce servers | Salesforce | Enterprise: no training |
83+
| **OpenClaw + Anthropic API** | Your Mac mini + Anthropic inference | You + Anthropic | No (API default) |
84+
| **OpenClaw + AWS Bedrock** | Your Mac mini + AWS | You + AWS (provider has no access) | No |
85+
| **GitHub Copilot** | Microsoft servers | Microsoft | Enterprise: no. Individual: opt-out |
86+
87+
Your source code already lives on GitHub. Your email is on Google or Microsoft servers. Your chat history is on Slack. If your organization trusts those platforms for standing data storage, it's worth asking why LLM inference — where data is processed and discarded — would be held to a stricter standard.
88+
89+
That's not an argument for being careless. It's an argument for consistency. Apply the same data governance framework across all your tools, including AI.
90+
91+
## Choosing the right tier
92+
93+
**Minimum for any professional use:** API tier (Anthropic or OpenAI). No training on your data. Short retention windows. No consumer-grade subscriptions (Free, Plus) for client work.
94+
95+
**For client-facing work with NDA-covered code:** API with Zero Data Retention agreement. Data deleted after the response is returned.
96+
97+
**For regulated industries or strict data residency:** AWS Bedrock or Google Vertex AI. The model provider never sees your data. Your inference runs within your cloud account's security boundary.
98+
99+
**What to avoid:**
100+
- Consumer-tier subscriptions (Claude Free, ChatGPT Free/Plus) for any work involving client data
101+
- Assuming "I'm paying for it" means your data is protected — the tier matters, not just the price
102+
- Using one provider's consumer product while holding another provider's API to enterprise standards
103+
104+
## Configuration
105+
106+
OpenClaw supports multiple LLM providers. Point your agent at the appropriate endpoint:
107+
108+
```json
109+
{
110+
"providers": {
111+
"anthropic": {
112+
"apiKey": "op://Agent-Vault/ANTHROPIC_API_KEY/credential"
113+
}
114+
}
115+
}
116+
```
117+
118+
For AWS Bedrock:
119+
120+
```json
121+
{
122+
"providers": {
123+
"bedrock": {
124+
"region": "us-east-1",
125+
"model": "anthropic.claude-sonnet-4-20250514-v1:0"
126+
}
127+
}
128+
}
129+
```
130+
131+
For Google Vertex AI:
132+
133+
```json
134+
{
135+
"providers": {
136+
"vertex": {
137+
"project": "your-gcp-project",
138+
"location": "us-central1",
139+
"model": "claude-sonnet-4-20250514"
140+
}
141+
}
142+
}
143+
```
144+
145+
:::tip Match the provider to the sensitivity
146+
You can configure different providers for different agents. Your personal agent can use the direct Anthropic API for cost efficiency. A client-facing agent handling regulated data can route through Bedrock. Same platform, different data handling guarantees.
147+
:::
148+
149+
## Documenting your choice
150+
151+
Whatever tier you choose, document it. Your security policy should state:
152+
153+
1. Which LLM providers are approved for use
154+
2. Which subscription tiers are required (API, not consumer)
155+
3. Whether a ZDR agreement is in place
156+
4. For which clients or projects Bedrock/Vertex is required
157+
5. How this was communicated to the team
158+
159+
This documentation is what turns "we think our data is safe" into "here's our data governance policy for AI inference." The former is hand-waving. The latter is governance.

0 commit comments

Comments
 (0)