You are building on OpenAI, Anthropic, Mistral or another LLM API. Your privacy policy says what you do with customer data. Does it say what your LLM vendor does with it?

Most small SaaS trust pages are silent on four things that GDPR/CCPA reviewers and enterprise security questionnaires now ask about:

  1. Named LLM vendor – do you name the model provider as a subprocessor?
  2. Prompt retention term – how long does the vendor keep prompts and completions (0 days? 30 days? "as needed"?)
  3. Training opt-out – are your customers' prompts excluded from model training, and is that stated in writing?
  4. Subprocessor list – is the LLM vendor on your subprocessor list, with its purpose and region?

A 60-second self-audit

Open your own privacy policy, DPA and subprocessor page and score each of the four checks pass/fail. In my own reading of public trust pages from small AI-chat SaaS vendors, the usual score is 1/4 or 2/4: the vendor is named, the subprocessor row exists, but retention and training opt-out are missing. That is the gap a customer's security review will find.

Example output of the CLI I built for this (run against a public docs set):

(1) named vendor PASS (2) retention term FAIL no statement of how long prompts are stored (3) training opt-out FAIL no written opt-out (4) subprocessor row PASS listed, but silent on region Result: FAIL - 2/4

Why it matters

  • Compliance: Article 28 GDPR and CCPA service-provider terms require you to know and disclose how a processor handles personal data. An unstated retention term is an open finding.
  • Sales: enterprise buyers send questionnaires that ask exactly these four questions. A trust page that already answers them shortens the deal.
  • Lock-in: once you know the retention and training terms, switching vendors becomes a documented decision instead of a guess.

Fix it in an afternoon

For each failing check, add one sentence to your privacy policy or DPA, sourced from the vendor's own API data-usage page (OpenAI, Anthropic and Google all publish one). Then add the vendor to your subprocessor list with purpose and region.

If you want the four checks as a zero-dependency command-line tool that reads a vendor's public pages and prints the scorecard above, I sell it as a $29 one-time CLI: https://renevibe76.gumroad.com/l/vdmrtn?ref=devto (disclosure: I am the author).

Run the self-audit first; it costs nothing and tells you whether the tool is worth $29 to you.

Which of the four checks does your own trust page fail today?