How long does your AI vendor actually keep your prompts? Longer than most teams think. And the answer is now the first thing legal wants in writing before a pilot moves to production.
A SOC 2 report won't tell you. The marketing page won't either. The answer lives inside a vendor's data retention policy, a court docket, and a handful of toggles buried in an admin console.
That is why the security questionnaire that used to be a formality has grown a new section, and why procurement is suddenly reading model documentation like a contract.
Why Is Legal Asking About Prompt Retention Now?
The short version: a court can reach into your vendor's logs. The longer version made headlines through 2025.
In the ongoing New York Times copyright suit, a federal magistrate judge ordered OpenAI to preserve and segregate output log data that would otherwise have been deleted, including deleted chats. You can read the preservation order itself. The duty to retain that consumer and API content indefinitely lifted on September 26, 2025, but the lesson it left for in-house counsel is still sitting on their desks.
If a plaintiff can convince a judge that a vendor's logs are relevant evidence, those logs become discoverable, regardless of what the vendor's privacy page promises on a normal Tuesday. That is a new category of risk, and it is the one legal teams are pricing into AI deals right now. The Digital Reader's reporting on why AI pilots stall at the security review frames it well: pilots pass the demo and then die on question seven of the risk team's spreadsheet, and the retention clock is almost always one of those questions.
What Does a SOC 2 Not Cover?
A SOC 2 report tells a buyer how the vendor runs the company. It does not tell them how the vendor runs the model. Access control, change management, encryption at rest, incident response, employee onboarding, all of that is in scope. What goes into the prompt, what the model does with it, who sees the output, and how long any of it is kept are not.
That is the hole procurement is now trying to fill, with questions that look nothing like a classic security review:
- Retention window. How many days does the vendor keep prompts and outputs by default, and can the tenant set it to zero?
- Human review. Under what conditions can vendor staff or contractors read customer content, and is that behavior logged?
- Training use. Is enterprise data excluded from model training by default, or does the customer have to opt out?
- Subprocessor reach. Which downstream providers see the prompt, and what are their retention terms?
- Deletion on request. How quickly can the vendor honor a deletion or litigation-hold instruction, and how is that documented?
None of this is in a SOC 2. All of it is now in the questionnaire.
Why Isn't the Model Card Enough?
A model card describes the model the vendor trained. It does not describe the system you are buying. The card will give you training data categories, evaluation benchmarks, and known limitations. It will stay silent on whether your tenant has zero retention enabled, whether the prompt-injection filter is on by default, or what happens to logs when the vendor's own vendor pushes an update.
Vendors are starting to meet buyers in the middle. OpenAI's own zero data retention page is a useful example of the shape buyers now want: a specific statement that prompts and responses are not kept after a request is processed, that staff cannot review customer content, and that enterprise data is not used for training unless the customer opts in.
The AI fact sheet needs to live in that register, with the same specificity. Dates, defaults, toggles. Nothing dressed up to sell.
What Should Go on the AI Fact Sheet Before Procurement Asks?
The teams getting through security review quickly have stopped waiting for the questionnaire. They write a one-page AI fact sheet during the pilot and hand it over with the pricing proposal. The content is boring on purpose. Dates, defaults, names of toggles.
That document earns its keep in the vendor file in-house counsel builds, not in the deck sales shows the buyer.
How Should Buyers Treat AI Logs as Evidence?
Prompts and outputs are electronically stored information. Courts have started treating them the same way they treat email and Slack, which means preservation duties travel with them, including to third-party systems the buyer does not control. A recent litigation-hold guide from a national firm lays this out plainly: default vendor retention windows are often shorter than a company's hold obligations, so the hold has to reach the vendor, and the contract has to make that possible.
That is the quiet reason the retention clock made it onto the questionnaire. If the vendor deletes on day 30 and the duty to preserve attaches on day 45, the buyer has a problem that SOC 2 attestation alone will not solve. The fix is a clause, a toggle, and a paragraph on the fact sheet. Have all three ready before the pilot moves to procurement, and the review stops being the thing that kills the deal.