Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstalliTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Before connecting company files, mail, source code, customer records or internal applications to an AI service, identify the exact product and endpoint, then review five separate controls: model-improvement use, chat or API retention, memory and application state, deletion exceptions, and integration permissions. Turning off training does not necessarily delete conversations, prevent safety logging or remove indexed copies.
This guide reflects vendor documentation checked in October 2026. Product labels, defaults and contractual terms change, so treat the linked documentation and your live administrator console as the final authority.
The control you need is rarely a single “retention” switch
AI providers divide business data into several records. A prompt may be used for model improvement, displayed in a chat history, retained in an abuse-monitoring log, copied into application state, embedded in a connected-app index, exported to an audit system or held for legal reasons. Each record can have a different owner and deletion schedule.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →| Control or record | What it governs | What it does not guarantee |
|---|---|---|
| Model improvement or training | Whether prompts, files, retrieved content, responses or feedback can improve models. | It does not automatically erase saved chats, API logs, safety records or synced indexes. |
| Chat history | Whether a conversation appears in a user-facing history and remains available to the account. | It may not cover temporary-chat safety storage, exports, audit records or provider backups. |
| Memory and personalization | Whether selected facts or prior interactions are reused in later sessions. | Disabling it may not delete the source conversation or files already stored elsewhere. |
| API retention and abuse monitoring | Provider logs, inputs, outputs and safety-review records for an API request. | Zero-retention settings usually apply only to eligible endpoints and features. |
| Application state | Files, vector indexes, assistants, threads, projects or other objects needed by a feature. | Deleting a chat may not delete a separately managed application object. |
| Connected-app data | Content retrieved from a drive, mail system, ticketing tool or other service, including indexes and caches. | Disconnecting the app does not prove that every copy or third-party record was immediately erased. |
| Audit, compliance and legal records | Administrative activity, exports, policy changes, safety events and legally required holds. | These records can remain after a user deletes a conversation. |
Use this separation when asking a provider or your administrator what “delete,” “history off,” “no training” or “zero data retention” actually means for your deployment.
#1 Best Overall
- Certified to FIPS 197 - High-level information security standard approved by the U.S. Government
- Brute-Force Password Attack Protection - Data is automatically erased after 6 failed access attempts. The data and encryption key are securely destroyed and the crypto drive is reset
- Rugged Double-Layer Waterproof* Design - Protects the crypto drive against knocks, drops, break-in and submerging in water. The electronics are shielded by a hardended inner case. The rubberised silicone outer casing provides a final layer of protection
- Auto-lock - The crypto drive will automatically encrypt all data and lock when removed from a PC/Mac or when the screen saver or "computer lock" function is activated on the host PC/Mac
- Secure Entry - Data cannot be accessed without the correct high-strength alphanumeric 8-16 character password. A password hint option is available. The password hint cannot match the password
1. Identify the exact service before changing a setting
Write down the product name, account type, subscription tier, endpoint, region and enabled features. A consumer chat account, a managed business workspace, a hosted API and an API delivered through a cloud marketplace can have different terms even when the model name is identical.
- Record the identity. Note the organization, tenant, workspace, project and user identity that will send data.
- Record the endpoint. Distinguish a web chat, embedded assistant, mobile app, API, batch job, retrieval service, code tool or agent action.
- Record the data path. List the source system, the AI provider, cloud marketplace or subprocessors, and any destination receiving generated output.
- Record the feature switches. Include history, memory, feedback, file upload, projects, connectors, actions, indexing, logging and export.
- Capture the current policy. Save the administrator screen, terms version and date so a later change can be detected.
Do not infer that a work email address means the user is inside a managed business experience. Google specifically distinguishes Gemini embedded in qualifying Workspace editions from Gemini used as an additional service under separate terms. Google’s Workspace guidance and its Gmail help documentation explain that distinction.
2. Separate model improvement from storage and feedback
Ask three independent questions: Are new inputs or outputs used to improve models? Are existing records still retained? Can feedback attached to a conversation be used differently from ordinary chats?
Free tools Windows power users keep installed
One-click scans. No signup required.
ChatGPT personal controls
In personal ChatGPT accounts, the “Improve the model for everyone” control governs use of new conversations for model training. OpenAI states that when the control is off, new conversations are not used to train models, but they can still appear in chat history. A conversation associated with feedback may be used for training according to the same help guidance. Read the current wording in OpenAI’s Data controls in ChatGPT.
Managed OpenAI workspaces
OpenAI says content from ChatGPT Business, Enterprise, Edu and Healthcare workspaces is not used for training by default. Its enterprise privacy statement says business data is not used for model training unless the customer explicitly opts in, including through feedback mechanisms. Confirm the workspace policy and administrator controls in OpenAI’s enterprise privacy documentation; a user-level personal setting does not establish the policy for a managed workspace.
Rank #2
- Certified to FIPS 197 - High-level information security standard approved by the U.S. Government
- Brute-Force Password Attack Protection - Data is automatically erased after 6 failed access attempts. The data and encryption key are securely destroyed and the crypto drive is reset
- Auto-lock - The crypto drive will automatically encrypt all data and lock when removed from a PC/Mac or when the screen saver or "computer lock" function is activated on the host PC/Mac
- Secure Entry - Data cannot be accessed without the correct high-strength alphanumeric 8-16 character password. A password hint option is available. The password hint cannot match the password
- SuperSpeed USB 3.0 - Transfer all your confidential files and folders faster than ever before. Works on both PC & Mac
Gemini and Workspace editions
Google says submissions in qualifying Workspace experiences are not used to train models outside the domain without permission. Users who access Gemini as an additional service may instead be covered by Gemini Apps terms and activity settings. Verify the edition, organizational unit and entry point rather than relying on the word “business” in an email address. The relevant administrator and user explanations are in Google’s Gemini Workspace access guidance and Google’s Gemini activity help.
Questions to put in the approval record
- Are prompts, uploaded files, retrieved business content and generated answers all covered by the same training rule?
- Is thumbs-up or thumbs-down feedback handled separately?
- Does the rule apply to every endpoint, model and connected application, or only the named product?
- Does an employee’s personal account bypass the organization’s workspace policy?
3. Review conversation history, memory and retention periods
ChatGPT temporary chats and deleted conversations
OpenAI states that temporary chats do not appear in history and are not used to train models, but may be retained for up to 30 days for safety. For ChatGPT Enterprise, Edu and Healthcare, OpenAI says deleted conversations are removed from its systems within 30 days unless a legal requirement requires longer retention. These are product-specific statements, not a universal deletion promise; consult the ChatGPT data-controls article and the enterprise privacy page.
Claude Enterprise custom retention
Anthropic’s Enterprise custom chat and project retention setting has a 30-day minimum. An Owner or Primary Owner configures it under Organization settings > Data and Privacy. Project retention can take precedence over chat retention, and activity in a project can reset the retention period. Changes and deletions are recorded in audit logs. These controls do not automatically cover every adjacent web feature or product; see Anthropic’s Enterprise retention instructions.
Google Workspace Gemini history
A Google Workspace administrator page lists Gemini app conversation-history choices of 3, 18 or 36 months, or history off, and reports 18 months as the default. That page is comparatively old, so verify the current default and labels in the Admin console before documenting a policy. With history off, Google says chats can remain in user accounts for up to 72 hours to provide the service and process feedback. Check Google’s administrator guidance for the current setting.
Anthropic API standard retention
Anthropic says API inputs and outputs are automatically deleted from its backend within 30 days in the standard case. Its stated exceptions include features with longer retention, contractual arrangements, policy enforcement and legal requirements. This period applies to the standard API arrangement, not every Claude product or feature; the provider’s explanation is at Anthropic’s organization-data retention page.
Rank #3
- Certified to FIPS 197 - U.S. Government Approved High Level Information Security Standard.
- Protection against brute force password attacks - Data is automatically erased after 6 unsuccessful access attempts. The data of the USB flash drive type c encryption with dual connectors is destroyed and the cryptographic drive is reset.
- Durable dual-layer waterproof design* — Protects the crypto reader from bumps, drops, run-in and immersion in water. The electronics are protected by a hardened internal case. Rubberized silicone outer case provides a final layer of protection.
- Auto-Lock —The cryptographic key automatically encrypts all data and locks when removed from a PC/Mac or when screen protection or "computer lock" is enabled.
- Secure Entry —Data on these flash drives cannot be accessed without the correct alphanumeric password of 8 to 16 characters. A password indication option is available for this flash drive. The hint cannot match the password.
Feature-specific long records
Anthropic’s platform documentation says the Claude Compliance API Activity Feed retains data for six years. The same documentation says Cowork and Claude Code local session transcripts may be stored for six years by default unless an organization has a finite custom retention period. Those durations apply to the named compliance and session features, not to all Claude content. Review Anthropic’s API and data-retention documentation.
4. Check API zero-retention and endpoint eligibility
OpenAI API
Approved OpenAI organizations can configure Zero Data Retention or Modified Abuse Monitoring at organization and project levels. OpenAI’s endpoint table identifies eligible and ineligible capabilities; some features retain application state even when a zero-retention arrangement is enabled. Zero Data Retention can also change API behavior, so developers must review the limitations for the exact endpoint and feature in OpenAI’s API data guide.
Anthropic API ZDR
Anthropic’s Zero Data Retention arrangement is enabled for an organization and does not automatically extend to other organizations under the same account. It covers only eligible features and product arrangements. When Anthropic services are delivered through Amazon Bedrock or Google Cloud’s Agent Platform, the cloud provider is the data processor; consult that platform’s retention documentation as well as Anthropic’s policy. The scope and exceptions are described at Anthropic’s platform documentation.
API review worksheet
- Endpoint and model name
- Whether inputs, outputs, files, threads or tool calls create stored application state
- Abuse-monitoring duration and any modified-monitoring approval
- Eligibility for ZDR and the exact organization or project to which it applies
- Batch, fine-tuning, evaluation and retrieval features that may follow different rules
- Deletion API behavior, backup handling and legal or safety exceptions
5. Map every connected app and permission
Retention review is incomplete if the AI can retrieve more data than intended. Inventory each connector and document the user identity, groups, scopes and actions it can perform.
- List source systems. Include drives, mail, calendars, ticketing, repositories, databases and collaboration spaces.
- Classify permissions. Separate read-only scopes from write, send, delete, share, export and administrative actions.
- Check identity propagation. Determine whether retrieval follows each user’s existing permissions or uses a shared service account.
- Find copies. Ask whether the provider synchronizes or indexes content, how often indexes refresh, and how disconnection or source deletion propagates.
- Review subprocessors. Identify the connector vendor, cloud platform and any separate privacy, storage or residency terms.
- Test least privilege. Use a test account with one approved folder and verify that inaccessible content is not returned.
OpenAI says synced-app indexes are maintained separately and that information sent to non-synced apps is governed by the third party’s storage, processing, privacy and residency terms. Its administrator guidance also warns that selected data residency does not automatically place every processing step, system record, external integration or third-party app in that region. Read OpenAI’s app and plugin controls documentation.
Rank #4
- FIPS 197 with XTS-AES 256-bit Encryption: Provides business-grade security with hardware-based encryption to protect your sensitive data
- Brute Force and BadUSB Attack Protection: Safeguards against unauthorized access attempts and malicious USB attacks with digitally-signed firmware
- Multi-Password Option with Complex/Passphrase modes: Offers flexible password configuration options to meet various security requirements and user preferences
- New Passphrase Mode: Enhanced security feature allowing users to create longer, more memorable password phrases for easier access without compromising protection
- Dual Read-Only (Write-Protect) Settings: Enables write protection functionality to prevent accidental data modification or deletion when needed
Google says Gemini Workspace access follows existing permissions and that administrators or content owners can restrict access to Workspace data. Apply those restrictions before enabling broad organizational access, as described in Google’s Gemini Workspace guidance.
6. Treat deletion as a data-class checklist
When someone requests deletion, identify the class of record and its owner instead of issuing one generic command.
| Data class | Deletion question | Typical exception to verify |
|---|---|---|
| User chat or project | When does it disappear from history and backend systems? | Legal hold, safety investigation or project activity extending the period. |
| Uploaded file or retrieval index | Is the file removed separately from the conversation? | Indexed or cached copies may follow another schedule. |
| API request and response | Does the endpoint qualify for ZDR or a custom contract? | Ineligible features, abuse monitoring or application state. |
| Feedback | Is feedback-linked content retained or used differently? | Model-improvement or quality-review workflows. |
| Audit and compliance record | Who can export or delete it, and for how long is it retained? | Regulatory, contractual or security obligations. |
| Backup or disaster-recovery copy | When does it expire and become inaccessible? | Provider backup cycles and restoration controls. |
OpenAI’s API documentation explicitly limits Zero Data Retention to eligible endpoints and notes that some capabilities store application state. Anthropic separately documents six-year retention for its Compliance API Activity Feed. Those examples show why “delete my chat” cannot be assumed to remove every related record.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Compare configurations using the same axes
There is no universal “most private” AI setting. Compare the actual configurations you could deploy.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Axis | Questions to record |
|---|---|
| Training and feedback | What is excluded by default, what requires opt-in, and are feedback or connected-source contents treated differently? |
| Retention layers | How long are chats, API logs, files, application state, synced indexes, safety records, compliance events and local transcripts kept? |
| Deletion | Can users delete records, can administrators enforce deletion, and what time and exceptions apply? |
| Connection scope | Which user identity, read/write permissions, source indexes and third-party terms apply? |
| Governance | Are there audit logs, exports, retention reports, administrator granularity and residency choices? |
| Deployment boundary | Is this consumer, business workspace, vendor-hosted API or a cloud-marketplace deployment? |
| Operational effect | Does the privacy control disable search, tools, file handling, personalization or another required feature? |
8. A practical approval workflow for administrators
- Classify the data. Mark regulated, confidential, personal, customer-provided and public information separately.
- Choose a pilot boundary. Start with a non-sensitive test tenant, one source folder and read-only permissions.
- Capture settings. Record training, history, memory, feedback, retention, ZDR, residency, connector and audit settings.
- Run access tests. Verify that users see only content allowed by source permissions and that write actions are disabled unless required.
- Run deletion tests. Delete a test chat, file and index entry; measure when each disappears from the interface and provider records.
- Review contracts and subprocessors. Match the service endpoint to the applicable business terms, cloud-provider terms and data-processing agreement.
- Approve by use case. A configuration suitable for public documents may be unsuitable for customer records or source code.
- Assign ownership. Name an administrator responsible for quarterly checks and for reviewing vendor change notices.
- Recheck after changes. Repeat the review when the model, plan, connector, region, administrator or retention policy changes.
9. Common mistakes and how to correct them
“Training off means nothing is stored”
Correction: check chat history, temporary-chat safety retention, API logs, application state, indexes and audit records separately. OpenAI’s own wording says conversations can remain in history when model improvement is off.
Best Value
- FIPS 140-3 Level 3 (Pending) Certified Military-Grade Security
- OS/Device Independent
- XTS-AES Hardware Encryption
- Enforced Alphanumeric PIN
- Multi-PIN (Admin and User) Option
“The business plan has one retention policy”
Correction: identify the endpoint and feature. A workspace chat, API call, compliance feed and local coding transcript can have different schedules.
“Disconnecting a connector deletes its index”
Correction: ask the provider how synchronized copies, caches and deletion jobs work, then verify with a test record. Third-party app terms may govern non-synced data.
“The provider’s region setting covers every processing step”
Correction: review external integrations, system records, support processing and subprocessors. Selected residency may cover only specified stored content.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems“A user can delete everything”
Correction: separate user history from administrator retention, safety records, compliance logs and legal holds. Document who can delete each class.
“The model label proves the same terms apply”
Correction: record the account, plan, endpoint and delivery channel. A model accessed through a cloud platform can have the cloud provider as processor and a different retention contract.
10. Administrator checklist
- Exact product, edition, tenant, project and endpoint recorded
- Training and feedback use documented independently from storage
- Chat history, memory and temporary-chat behavior tested
- Retention periods recorded for chats, files, indexes, API logs, application state and audits
- ZDR or modified-abuse-monitoring eligibility confirmed for every endpoint
- Deletion timelines and legal, safety, backup and compliance exceptions documented
- Connector scopes, user identities, write actions and synced copies reviewed
- Third-party processors and cloud-marketplace terms identified
- Residency claims limited to the content and processing covered by the provider
- Least-privilege test completed with representative accounts
- Policy owner assigned and next review date scheduled
When to bring in a specialist
If your organization must map regulated sources, contractual deletion duties, multiple providers or hundreds of connectors, an independent AI data governance assessment can turn this checklist into a control register. Require the assessor to identify each data class, endpoint, processor, retention exception and deletion test; do not accept a generic claim that a product is “compliant.”
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
