Every vendor is adding AI, and the terms for what it reads, stores and trains on differ. Slack, for example, does not train generative models on customer data without opt-in, but uses it for predictive models unless you email to opt out. Ten questions to ask each vendor, and where owning the data changes the answers.
An AI feature in a SaaS tool can read everything the tool holds. That is the point of it. It also means each vendor's AI terms are now part of your data protection, and they change faster than your contracts.
Slack's published privacy principles are a good example of how specific the answers get. Slack says it will not train generative AI models on customer data without affirmative opt-in. It also says it analyses customer data, including messages and files, to build predictive models such as emoji and channel suggestions, and that a workspace owner opts out by emailing its customer experience team.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Is our data used to train or improve any model, generative or not? Opt-in or opt-out, and how is opting out done?
Which third-party model providers receive our data, and under what retention?
Are prompts and outputs logged? For how long, and who can read them?
Can AI features be turned off per workspace, per user and per data type?
Does the AI feature respect the same permissions as the user, or can it read across them?
Where is the processing done (region), and is that covered by our data processing agreement?
What happens to embeddings or indexes built from our data when we leave?
Are AI features covered by the same certifications (SOC 2, ISO 27001) as the core product?
How are we told when these terms change?
Can we export everything, including AI-generated content and history, in a usable format?
When the data sits in your own database, you choose the model, the provider terms, the logging and the permissions. On Amazon Bedrock, for example, model providers get no access to prompts or completions. That does not make owning everything right. It makes the tools that hold your most sensitive data the first ones to reconsider.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Own Your Data in the Age of AI: When to Replace a SaaS Tool With Your Own
Building a CRM, an analytics pipeline or a help desk used to be a year of work. With AI coding tools and open-source cores it is weeks. That changes the math on per-seat pricing and on handing your customer data to someone else. When it pays to run your own, when it does not, and what you take on.
Read
Replacing Salesforce or HubSpot: A Self-Hosted CRM (Twenty) or One You Build
A CRM is contacts, companies, deals, activities and a pipeline view. At $90–$195 per seat per month, ten seats cost $11k–$23k a year. Twenty is an open-source CRM you can run yourself; building on Postgres is the other route. What each option costs, what you lose, and how to migrate without losing history.
Read
As of October 30, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.