LLM Use And Confidentiality

Provider 1
Claude / Anthropic API

Tool

Crossband.io uses the Claude API via the Claude Platform. As such, the platform is subject to Anthropic's Commercial Terms of Service.

Training

B. Customer Content in the Commercial Terms of Service explicitly states:
"Anthropic may not train models on Customer Content from Services."

Privacy

Retention times for prompts and responses (inputs and outputs) are determined by Anthropic's Commercial Customers Data Handling & Retention policy.

Crossband.io uses the Anthropic API and does not use the Files API or covered models, and as such is subject to the Standard Retention Timeframe:
"For Anthropic API users, we automatically delete inputs and outputs on our backend within 30 days of receipt or generation".

Crossband.io enables Anthropic prompt caching in certain circumstances to reduce cost. Cached prompt prefixes are stored only for a short, time-limited window (on the order of minutes, up to one hour with extended caching), remain subject to the same no-training and standard-retention terms, are configured per request, and can be disabled at any time. Its interaction with a Zero Data Retention arrangement would be confirmed against Anthropic's feature-eligibility table.

A request has been made for Zero Data Retention here.

Compliance

Additionally, Anthropic maintains the following compliance credentials:
HIPAA-ready configuration (BAA available)
ISO 27001:2022 (Information Security Management)
ISO/IEC 42001:2023 (AI Management Systems)
SOC 2 Type I & Type II

Provider 2
Gemini / Google

Tool

Crossband.io uses the Google Gemini Enterprise via Agent Platform (formerly Vertex AI). As such, the platform is subject to the Google Cloud Terms of Service, which incorporate the URL Terms, which in turn incorporate the Cloud Data Processing Addendum and Service Specific Terms:

Section 14.15 of the Google Cloud Terms of Service states:
"The URL Terms are incorporated by reference into this Agreement."

And URL Terms is defined in Section 14.19 as:
"collectively, the AUP, Cloud Data Processing Addendum, Service Specific Terms, SLA, and TSS Guidelines."

Training

The incorporated Cloud Data Processing Addendum defines prompt inputs and outputs as Customer Data. Appendix 4 of the Cloud Data Processing Addendum states:
' “Customer Data”, if not defined in the Agreement, means data provided to Google by Customer or End Users through Google Cloud Platform under the Account, and data that Customer or End Users derive from that data through their use of Google Cloud Platform.'

Section 18. Training Restriction (formerly Section 17 (Training Restriction)) of the Service Specific Terms explicitly states:
"Google will not use Customer Data to train or fine-tune any AI/ML models without Customer's prior permission or instruction."

Crossband.io has not granted Google prior permission or instruction to train or fine-tune any AI/ML models.

Additionally, under Section 20 of the Service Specific Terms (formerly Section 19 (Generative AI Services)) for Generative AI Services, the Service Specific Terms explicitly include model responses as Customer Data:
'a. Definition. “Generated Output” means the data or content generated by a Generative AI Service prompted by Customer Data. Generated Output is Customer Data. As between Customer and Google, Google does not assert any ownership rights in any new intellectual property created in the Generated Output.'

Privacy

Retention times for prompts and responses (inputs and outputs) are determined by Google's Abuse Monitoring policy.

Section 4.3 Generative AI Safety and Abuse for GCP Services of the Google Cloud Terms of Service states:
"Notwithstanding the ‘Handling of Prompts and Generated Output’ section in the Service Specific Terms for GCP Services, if these tools detect potential abuse or violations of Google’s AUP or Prohibited Use Policy, Google may log Customer prompts solely for the purpose of reviewing and determining whether a violation has occurred. See the Abuse Monitoring documentation page for more information about how logging prompts impacts Customer’s use of the GCP Services."

The Abuse Monitoring policy describes how Google uses "automated safety classifiers to detect potential abuse and violations" and may log prompts (but not responses) for up to 90 days only if potential abuse or violations are automatically detected:
"Prompt logging: If automated safety classifiers detect suspicious activity that requires further investigation into whether a customer has violated our policies, then Google may log customer prompts solely for the purpose of examining whether a violation of the AUP or Prohibited Use Policy has occurred. This data won't be used to train or fine-tune any AI/ML models. This data is stored securely for up to 90 days in the same region or multi-region selected by the customer for their project and adheres to Google Cloud assurances, such as Data Residency, Access Transparency and VPC Service Controls."

A request has been granted to opt out of prompt logging, and as such prompt logging has been disabled on the site link.

Compliance

Additionally, Google maintains SOC 2 Type I & Type II, ISO/IEC 42001:2023, and many other compliance credentials.

Next: LLM Confidentiality Environment