The three ways AI touches your data: API calls, RAG, and fine-tuning

Personal data reaches an AI system in one of three distinct ways, and they carry very different levels of risk — a fact most vendor questionnaires don’t ask about, because most vendors don’t distinguish between them either.

API and direct model usage

This is the simplest case: your system sends data to a model, gets a response, and the data’s fate from there depends entirely on the vendor’s contract and configuration — does the vendor retain the input, does it use it for training, for how long. This is fully reversible in the sense that matters: change the contract, change the setting, or stop sending the data, and the exposure stops. The catch is that the setting is often wrong or unverified. “Enterprise” tiers frequently disable training use by default; free or lower tiers frequently don’t. Which tier your team is actually on, and what its actual configuration is, is a fact — not an assumption worth making from the vendor’s marketing page.

RAG: the index nobody remembers to check

Retrieval-augmented generation stores your data in a separate retrieval index that the model queries at answer time. The data isn’t inside the model itself, so deletion is reversible in principle — but in practice, a deletion request has to reach every copy: the index, any cache, any backup, any downstream system that ingested the retrieval results. Most organizations can tell you their primary database has a deletion path. Far fewer can tell you whether their RAG index does, or whether it was ever asked to.

Fine-tuning: the one-way door

Fine-tuning trains a model further on your data, which becomes absorbed into the model’s own weights. This is not reversible in any practical sense — there is no operation that removes one customer’s data from a fine-tuned model without retraining it from scratch. If personal data reached a fine-tuning run, “we deleted it from our database” does not mean it’s gone from the model that was trained on it. This is the highest-exposure of the three, and the one most likely to be happening somewhere in a vendor’s pipeline without your team having made an explicit decision about it.

Why this matters for your vendor list

A vendor questionnaire that asks “do you use AI” produces a yes/no that hides the actual risk profile. A vendor doing simple API calls with training disabled is a very different exposure than the same vendor running your data through fine-tuning, or holding it in an unmanaged RAG index — and from the outside, both vendors can look identical on a sales page.

What to ask a vendor before you sign

Which of the three applies to each feature you’ll actually use, not the product as a whole. What the retention setting is on your specific account tier, not the vendor’s general policy. Whether a deletion request reaches the retrieval index as well as the primary store. And whether fine-tuning happens at all — and if it does, on what basis, and with what practical path to removing your data if the relationship ends.