Protect Government Data: Retention, Reuse, and Training Limits

A vendor’s standard terms often say the service may retain prompts and outputs, and may use them to improve its services. A program lead often reads that and shrugs, because the team is only using the tool for draft text. That assumption fails because draft language is still government work product, and it can still contain non-public facts that were never meant to travel. The risk is not only disclosure in the moment. The risk is persistence, where the text remains in places the user never sees and later becomes available for other purposes.

The permission that causes this is usually a single broad clause that covers everything at once, including retention, analytics, and model improvement. Here is typical standard-terms language:

“You grant Vendor and its affiliates a worldwide, non-exclusive, royalty-free license to host, store, reproduce, modify, create derivative works from, and use Customer Content to provide, maintain, secure, and improve the Services, including for analytics, troubleshooting, safety, and service development. Vendor may retain Customer Content as necessary to comply with law, enforce policies, and maintain backups.”

The three bolded parts of that clause are where agency data escapes, and each one needs a specific change before signature:

• “Improve the Services, including for analytics… and service development.” This lets the vendor use agency prompts and outputs to build its product, not just to serve you. Ask for a term that limits use of non-public agency inputs and outputs to delivering the requested output, with no product improvement or service development unless the agency gives explicit consent.

• “Its affiliates.” This extends the same rights to every company related to the vendor, so your data can be reused well beyond your contract, including in model training. Ask for a named list of who may access agency data, with the same limits applied to each. A ...