The Exposure Floor: Why Zero Data Retention Never Means Zero

Signing an enterprise agreement with a frontier AI lab doesn't take your data exposure to zero. It can't. Every one of these contracts has a bottom, a level of exposure that survives the strongest terms you can get, and no redline moves it. We call it the exposure floor. I've sat in these negotiations. The paper is non-editable, the zero data retention clause carries a safety carve-out, and the deletion promise comes with no way to audit it. A contract governs what happens to your data after it leaves your walls. Only architecture governs whether it leaves at all.

What is the exposure floor?

It's the residual exposure that remains under even the best enterprise AI contract: the part you can describe in writing but can't negotiate away.

The floor has three layers. First, transmission. For a hosted model to do the work, your data has to reach it, so your most sensitive material is sitting on someone else's infrastructure the moment the request fires. Second, the carve-outs. Zero data retention clauses almost always reserve the vendor's right to inspect traffic for safety and security purposes, which means a person or a system on their side can still touch your data even with retention off. Third, trust-based enforcement. Retention limits and deletion commitments live inside the vendor's systems, not yours. You can't walk their datacenter. You take their word for it, and the contract is the word.

Doesn't zero data retention mean zero?

No. It means the vendor promises not to keep what it still receives, minus exceptions the vendor wrote.

I've negotiated these agreements, and the pattern repeats across labs. The data terms arrive as a fixed exhibit. You can push on pricing, seats, and support tiers all day. Ask to strike the safety monitoring language and the answer is that the document isn't editable, at any spend we could bring to the table. I understand why the carve-out exists. Labs face real abuse and real liability, and they won't fly blind. But be clear about what you signed: a promise of restraint, made by a counterparty holding your data, enforced by nothing you can inspect. For plenty of workloads that's a reasonable trade. As the default posture for your whole business, it's a foundation made of trust in someone else's discipline.

What did the Grok Build incident actually prove?

That the gap between a vendor's settings page and what crosses the wire is real, measurable, and invisible until an outsider checks.

In July, a security researcher intercepted traffic from xAI's Grok Build coding tool and found it uploading entire code repositories, full Git history and committed secrets included, to a cloud storage bucket. On a test repo, the coding task itself needed roughly 192 kilobytes of traffic. The background channel moved 5.1 gigabytes. Turning off the "Improve the model" privacy toggle changed nothing, because that setting governed training consent, not transmission. The fix shipped as a hidden server-side flag with no security advisory, and the upload code still sits in the binary, held back by a switch the vendor controls. Then came the cleanup: a public promise that all previously uploaded data would be completely deleted. Maybe it was. There's no audit, no timeline, and no way for any affected team to confirm their repo is gone. To be fair to xAI, the evidence proves transmission and storage, not training or misuse. That's exactly the point. Nobody should have to litigate a vendor's intent to know where their data stands, and the only way out of that argument is for the data never to have left.

Isn't this just the prompt trail problem again?

No, it's the tier above it.

We've written before about the prompt trail and data you can't recall: the record your people create when they paste sensitive work into public AI tools nobody governs. The fix there was drawing a line and moving sensitive work into environments you control. The exposure floor is what greets you after you've done all that. Picture the leader who did everything right. Banned the consumer tools, signed the enterprise agreement, secured the zero data retention clause, and now believes the data question is closed. It isn't closed. It's meaningfully better, and the floor is still there under the paperwork. The prompt trail builds by accident, one ungoverned paste at a time. The floor is disclosed, written down, and accepted the day you sign, which makes it easier to miss and harder to blame on anyone else.

Does lowering the floor mean going vendor-agnostic?

That's the move, and it's why your system architecture now matters more than your model choice.

We've made the capability case for this before: single-model risk, swap-ready architecture, the control ladder as the answer to the frontier tax. The same design carries the data case. An abstraction layer between your workflows and any single vendor lets you swap models when prices move or quality slips, and it also lets you route by sensitivity. Commodity work goes to a hosted frontier model under the enterprise agreement, and that's fine, because the exposure floor on a marketing draft is a cost of doing business. Regulated records, deal terms, source code, anything you'd sweat in discovery, routes to an open-weight model running inside your own cloud, where the floor drops to nearly nothing because nothing leaves your walls. One architecture, two payoffs. The industry is coming around to the idea that the system around the model matters more than the model itself. We'd go further: your data policy lives or dies in the system design, because that's the only layer you fully control.

What should you do about the exposure floor?

Install this rule and let it govern every AI decision you make this year: no workload crosses the wire until someone has decided, on purpose, that its floor is acceptable.

That single rule pulls everything else into place. You have to classify work by sensitivity instead of by team enthusiasm, and the routing question drags the abstraction layer in behind it, which happens to be the first rung of the control ladder anyway. The rule also puts the enterprise contract back in its proper job: pricing, uptime, indemnity, support. Contracts are good at those things. Keep negotiating them hard. Just stop asking a document to do work that only your architecture can do.

If you're staring at a frontier lab's enterprise agreement right now and wondering which workloads belong above the floor and which don't, that routing map is one thing we build: Check out our AI Blueprint approach or reach us at contact@theyor.com.