A contract review can become stale if operational defaults change underneath it. Google's October 26 Gemini API changelog says new paid-tier Generate Content API projects store requests by default, while existing projects retain their current setting.
Ask separate data questions
What is stored? Where is it processed? How long is it retained? Who can access logs? Is it used for training under the applicable terms? These questions are related but not interchangeable. A change to request logging should not be presented as proof of a change to every other data practice.
Control the point of creation
Make approved retention and logging settings part of new-project provisioning. Include experimentation projects, temporary integrations, and vendor demos that may receive real customer data. A policy enforced only in the main production account leaves gaps.
Document request-level options as well as project settings. Developers should know which control applies and how to verify it using current supplier documentation.
Review the entire pipeline
Even if a model request is not stored by the provider, your application may log prompts, tool results, traces, and error payloads. Apply retention and access policies to those systems too.
Use representative non-sensitive data when testing settings. Record the decision, the data classes allowed, and the owner responsible for future review. Privacy governance works best when it connects contractual promises to the configuration that actually processes information, including configurations created after the last procurement review.
Sources & further reading
Reviewed October 26, 2026. Product availability and regulatory guidance can change. Vendor performance claims are not independent Rovio AI benchmarks.
Found this useful? Share it.