What "we don't train on your data" means at the API layer, and how we verify it quarterly.
Every security review Threadseam goes through — and we average two a month — asks the same question in different words: when you send our messages to an LLM provider, what happens to them?
The short answer
Messages get sent to OpenAI or Anthropic enterprise endpoints with zero-day data-retention terms. The provider processes the request, returns a response, and discards the input. No training. No logging past 30 days (and only for abuse detection, which is contractually scoped). No human review of your text, ever.
The longer answer
We send the minimum text necessary to generate a draft entry — typically the thread that triggered the capture, redacted for the patterns described in our privacy model. We never send: adjacent channels, user profile data, workspace metadata, or anything from channels Threadseam wasn't invited to.
The LLM API calls happen inside the same AWS region as your knowledge-base storage. For EU customers, that means eu-west-1 (Ireland) and the provider's EU-resident endpoint. For US customers, us-east-1 (Virginia). We don't do cross-region inference, period.
How we verify
Every quarter, we run a canary test: inject a long, unique string into a test workspace, send it through the full pipeline, then query every provider endpoint we use with variants of that string. If any provider returns it, that's a breach of our zero-retention agreement and we have to disclose. We've run eight canaries. Zero hits.
The canary strings and the detection code are open-source: github.com/threadseam/zero-retention-canary. We publish the test results in our changelog.