What we mean by AI leakage

AI leakage is any risk to a business or a person that comes from AI: from the AI tools you use, or from AI used against you or about you.

The name comes from the most common case: information leaking out through AI tools. Client details pasted into a chat assistant can be kept, used to train someone else’s model, or seen by people they were never meant for.

But AI leaks more than data:

• Money, through a cloned voice or a fake invoice written to look like your supplier’s.
• Trust, when AI-written claims, reviews or advice turn out to be wrong or misleading, and they are still yours.
• Fairness, when an AI tool that screens people treats some of them unfairly without anyone meaning it to.
• Control, when an update switches AI features on in software you already use, or AI outputs become records you have to keep.

All of these are AI leakage.

How we research vendors, how we rate risk, what we mean by each section of a vendor profile, and how we handle our own conflicts of interest, including the commercial relationships that exist on this site and the ones we won’t accept.

Editorial principles

Three principles govern every vendor profile on this site:

1. Independence of verdicts. No vendor pays for a favourable rating. No advertising spend, no affiliate relationship, no sponsorship can change how a vendor profile rates or recommends. We take no affiliate commission on any product. We do not accept sponsored evaluations. Where any other commercial relationship exists, it is disclosed on the affected page, and the rating remains the rating we would have given anyway. If you cannot trust the verdicts, the site has no value.
2. Every factual claim is sourced. Vendor profiles cite specific URLs (verified on the date shown at the top of each profile), specific CVE numbers, specific incident reports. If we cannot source a claim, we do not make it.
3. If our recommendation is uncomfortable, we make it anyway. Several vendors in our database are rated lower than their marketing implies. Several SMB-popular tools receive recommendations to upgrade tiers or switch vendors. We optimise for the reader, not for vendor relationships.

The commercial model, what we will and won’t accept

AI Leakage is operated commercially. Independence from vendor influence on verdicts is non-negotiable; the absence of any commercial activity is not the same thing and we don’t pretend it is. Here is exactly what we do and don’t accept, with the reasoning.

What we will accept

• Paid product sales. We sell our own training and certification; our AI use policy template is free. These are independent of any vendor relationship.
• Certificates for practitioners. People who advise other businesses can take the Advanced certificate and train their own staff and clients, who take the Intermediate certificate at a lower practitioner rate. That is a price, not a commission: we pay nobody for introductions. See For practitioners.

What we won’t accept

• Paid placements that influence verdicts. A vendor cannot pay us to receive a higher risk rating, a more favourable recommendation, or removal of an unfavourable disclosure.
• Paid placements that suppress information. A vendor cannot pay us to remove a documented breach incident, an unflattering training-default, a litigation reference, or any other factual disclosure.
• Sponsored evaluations. A vendor cannot pay us for research time on their own product. This was previously accepted under strict disclosure terms and was withdrawn in August 2026. The terms were sound, but the claim that our revenue comes from readers rather than from the companies readers are being warned about is worth more than the option was.
• Sponsored content that pretends to be editorial. Any commercial relationship is disclosed at the top of the affected page, prominently. We do not publish content that reads as independent analysis when it is paid promotion.
• Press release re-distribution. We are not a wire service for vendor announcements.
• Affiliate commission of any kind. We take no commission on any product, whether or not we rate it, and that now includes adjacent tools such as backup, password management and endpoint security, which an earlier version of this page permitted. We do not join affiliate programmes, and a vendor offering an attractive one gets no link and no rating change. Rating drives linking, not the other way around.

Risk rating scale

Our ratings measure one kind of AI leakage: how well each AI tool protects the information you put into it. A tool’s rating says nothing about the other kinds. Our courses and guides cover those.

Every vendor receives a plain-English risk rating from 1 (lowest) to 5 (highest). Many vendors receive split ratings because their consumer and enterprise tiers differ materially, a vendor can be 1 of 5 at the Enterprise tier and 4 of 5 at the consumer tier. We rate every tier honestly rather than averaging.

• Risk 1 of 5 (Lowest): Genuinely strong privacy posture. Contractual no-training default. No documented serious incidents. Examples in our database: Workspace Gemini (the Training Restriction sits in Google’s Service Specific Terms), Linear (its AI Services Addendum states that Linear will not use Customer Data to train, fine-tune or otherwise improve its own models), and Canva Teams, Business and Enterprise (no training by default and it cannot be opted in). Example list corrected 26 September 2026. It previously also named Notion AI Enterprise, Adobe Firefly Enterprise and “Cursor Business”. All three were wrong for this band. Notion and Adobe do state a no-training position across their tiers, but the contractual instruments they point to bind their model providers rather than themselves, and this band requires the vendor’s own commitment to be contractual. Cursor fails on two counts: there is no Cursor plan called Business, and Cursor’s protection is Privacy Mode, a product setting that is on by default and can be enforced by an admin, which is not a contract term. Cursor also does not meet this band’s “no documented serious incidents” test, since its own profile on this site records four high-severity vulnerabilities across 2025 and 2026.
• Risk 2 of 5 (Low): Strong privacy posture with some structural caveats. Examples include inheriting customer permissions in a complicated way, theoretical vulnerability to indirect prompt injection, or incomplete data-residency options. Most enterprise-grade Embedded Productivity AI and Vertical SaaS sits here.
• Risk 3 of 5 (Moderate): Industry-typical. Training on by default for the consumer tier with opt-out available. Some breach history but no pattern of cover-up or material misrepresentation. ChatGPT, Claude, Gemini consumer, and most paid-consumer tiers sit here.
• Risk 4 of 5 (High): Above-typical concerns. Pending material litigation, recent policy regression, or a documented pattern of weak disclosure. Perplexity consumer, GitHub Copilot Free/Pro/Pro+, Midjourney non-Stealth, ElevenLabs consumer. Granola Free/Business (pending the Chamberlain v. Granola litigation).
• Risk 5 of 5 (Highest): Structurally incompatible with privacy-conscious business use without significant configuration, or actively defending material litigation that goes to the heart of the product’s operation. Grok consumer (trains on all public X posts by default). Replit AI agents in production environments. Otter.ai Free/Pro (pending the In re Otter.AI Privacy Litigation outcome).

The 12-section profile schema

Every vendor profile covers the same twelve sections in the same order. This consistency is deliberate, it makes vendors comparable and makes it harder for us to omit inconvenient sections.

1. Note on independence (when applicable). Disclosed conflicts and the corrections we apply. Where any commercial relationship exists, the disclosure is in this section.
2. Plain-English risk rating. 1 of 5 to 5 of 5, with split ratings where tiers differ materially.
3. Recommended for. Sole proprietor, small team, regulated industry, and “the honest answer” sections.
4. Critical pre-deployment warning (when applicable). The single most important thing to know before deploying the tool.
5. Data retention default. What the vendor retains, for how long, per tier.
6. Training opt-out. Whether training is on or off by default, and how to change it.
7. Zero Data Retention (ZDR) availability. Whether the vendor offers true ZDR and at which tier.
8. Plan tiers and pricing. Current pricing, what each tier includes, training defaults per tier.
9. Jurisdiction. Where the vendor is incorporated, where data is processed, which laws apply.
10. Breach history. Public incidents, with specific dates, CVE numbers, and CVSS scores where applicable.
11. What this means in plain English. Three honest takeaways for SMB owners.
12. Sources. The material the profile relies on. Primary vendor documentation is named with the date it was verified. Links are given where we hold a stable public URL, and not every source is linked. We are working through the profiles that list sources by name only.

How we verify sources

Every source in a vendor profile is visited on the verification date shown at the top of the profile. Vendor self-published security documentation (trust centres, privacy policies, terms of service) is treated as primary for vendor commitments but cross-referenced against independent reporting wherever possible.

For incident reports, we prioritise in this order: (1) the vendor’s own public disclosure, (2) the original security researcher’s published technical writeup, (3) the CVE entry in the National Vulnerability Database, (4) reputable independent security journalism. We avoid summary aggregators and prefer to cite the source the aggregator was citing.

For legal proceedings, we cite the case number and court rather than press summaries where possible, and we note when proceedings are unresolved.

Verification cadence

Each vendor profile shows a “Last verified” date at the top. That date is the honest answer to “how current is this?”. It is per-profile, not a site-wide guarantee.

We monitor vendor policy pages on a regular cycle and re-verify a profile when something changes, rather than relying on a calendar sweep to notice. Most are checked daily. A small number sit behind access controls we will not evade, so those are checked less often, and every profile shows the date it was last verified. Every profile is also fully re-verified on a rolling schedule, at least once every six months.

A profile is re-verified immediately when:

• A vendor announces a material policy change (training defaults, retention windows, pricing tier restructuring)
• A new breach or vulnerability is disclosed
• A new significant feature is launched (particularly agentic features that expand the attack surface)
• Our monitoring detects a change to the vendor’s published policy pages
• A reader flags a discrepancy via the contact page

If a profile passes 180 days without full re-verification, a staleness notice appears at the top of it automatically. We would rather show you that a rating is old than let you assume it is current.

What the monitoring does and does not do. It detects that a vendor’s policy page has changed. It does not judge whether a rating should move. A person does that. Some pages we cannot read automatically, and we would rather name the limit than let a count imply otherwise. Several vendors sit behind a bot challenge we will not defeat, because a publication about how organisations handle data should not evade the access controls of vendors it rates. Where the public web archive holds those pages we read them there instead, on the same daily cycle and through the same comparison, so the capture lags the live page. Other pages, including Cursor’s and Linear’s subprocessor lists and some pricing pages, are drawn by JavaScript after the page loads; where we can, we capture those by hand on a stated cadence. Some New Zealand government pages challenge automated access in the same way, and we check those by hand. Where a document cannot be read by either route, it is not counted as monitored: the number of watched documents shown on a profile counts only documents that actually produced a capture, and a page that returns navigation without content counts as unread. Each profile says which route its documents are on.

Our own conflicts of interest

We disclose the following conflicts:

• We use Claude (Anthropic) in our content workflow. This site uses Claude, made by Anthropic, in its research, and Claude is also rated here. We score it from Anthropic’s own published terms, using the same method, the same anchors and the same evidence standard as every other vendor, and we are telling you so you can weigh that. Updated 28 September 2026: this replaces an earlier statement that we applied a deliberate counter-correction and that readers should treat the Claude profile as more sceptical of Anthropic than it would otherwise be. Deliberately scoring one vendor harder than the rest is a different bias, not the absence of one, and it made the Claude score incomparable with every other score on this site. Parity plus disclosure is the more defensible position and it is the one we now hold. Full disclosure on the How This Site Uses AI page.
• Affiliate relationships. We hold no affiliate relationship with anyone, and take no commission on any product, rated or not. The current position is stated and dated on the Affiliate Disclosure page.
• Sponsored evaluations are not accepted. A vendor cannot pay us for research time on their own product.
• The site operator is a New Zealand-based independent researcher with no advisory or board relationships to any vendor profiled. If that changes (we accept a consulting engagement, become an investor in an AI vendor, take a board seat), we will disclose the change before publishing any affected profile.

Corrections policy

We respond to factual corrections promptly. Email the operator (contact page) with the specific claim you believe is incorrect, your evidence, and we will respond within five business days. Confirmed corrections are made inline with a “Corrected on [date]” note at the bottom of the relevant section. We do not silently edit content after publication.

If you are a vendor profiled on this site and you believe a claim about your product is inaccurate, please cite the specific section, what you believe is incorrect, and what the accurate statement would be. We will engage with the substance of the disagreement rather than the framing.

---

How this was written: this page was researched and drafted with AI assistance (primarily Claude, made by Anthropic) and checked against primary sources before publication. We hold ourselves to the same standard we rate other tools against, see How This Site Uses AI for the full disclosure.