How to Choose an AI Model for Security and Compliance Work

Choose an AI model for security and compliance work by starting with your data rules: who may see the data, whether it can train a model, how long it is kept and who can review it. Then match the model to the job. Counting findings needs no language model at all; drafting summaries and fixing code do.

Safeguard is an alternative you can switch to without losing what you already pay for. In Safeguard you choose the model for each conversation: Zero z20 answers with no language model, Griffin, Eagle and Lion are Safeguard's own models, and you can bring your own model on your own provider account. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already use.

Start with your data rules, not the model

Security work touches the most sensitive data a company has: vulnerability findings that show where you are exposed, source code, customer names in tickets, audit evidence and incident notes. Before anyone compares models, write down the rules that data has to follow. Five questions cover most of it.

1. What will the model see? List the inputs for each job. "Summarise last week's critical findings" sends finding records. "Fix this dependency" sends code. "How many open highs do we have" may send nothing sensitive at all, if it can be answered without a model.
2. Can the provider train on it? The answer often depends on the plan, not the model. The same model family can sit under consumer terms on one plan and commercial terms on another.
3. How long is it kept, and can you turn that off? Look for the standard retention period and whether zero data retention exists for your account type.
4. Who can review it? Some services keep the right to run safety review on inputs and outputs. Know whether that review is automated, human, by the model maker or by the cloud provider.
5. Who decides which models people may use? If any employee can pick any model, your data rules are a suggestion. You want an admin setting that limits the choice.

Write the answers down per job, not per tool. NIST's AI Risk Management Framework, released on 26 January 2023 and intended for voluntary use, and its Generative AI Profile (NIST AI 600-1, July 2024) give you a structure for recording these decisions if your auditors expect one.

How major providers handle business data

Here is what each provider's own pages said when we read them on 21 October 2026. Terms change, so check the live page before you sign anything. This is a comparison of documented defaults, not a ranking.

Notes on each route

Anthropic. The Claude Code data usage page says consumer users choose whether their data can improve future models, and that Anthropic does not train generative models on code or prompts sent under commercial terms unless the customer opts in. Zero data retention for Claude Code is not part of the standard Enterprise plan; the account team enables it per organisation after confirming eligibility. One thing to know before adopting: the Claude Code client keeps session transcripts locally in plain text for 30 days by default, adjustable with cleanupPeriodDays.

OpenAI. OpenAI's enterprise privacy page says business data from ChatGPT Business, Enterprise, Edu and the API Platform is not used for training by default, and that OpenAI can sign a Business Associate Agreement for API use with protected health information. Codex is included in the ChatGPT Free, Go, Plus, Pro, Business, Edu and Enterprise plans, and the Codex pricing page recommends API key sign-in for automation such as CI, billed at API rates separate from subscription usage. Check which plan a person is signed in with, because consumer and business plans carry different terms.

Amazon Bedrock. AWS says model providers do not have access to Bedrock logs or to customer prompts and completions. Retention is a mode you set per Region or project: none for zero retention, default to follow the model's policy, and aws_review, which lets AWS keep data for up to 30 days for human review. Before adopting a new model there, check its allowed modes: Bedrock's docs say some models, including Claude Fable 5 and 5.1, require aws_review and are unavailable if your account is set to none.

Ollama. Ollama is an MIT-licensed project for running open-weight models such as DeepSeek, gpt-oss, Qwen and Gemma on your own machine, and its latest release on GitHub when we checked was v0.40.7 from 18 October 2026. Local models keep prompts on your hardware. Quality and tool use vary by model; OpenCode's provider docs, for example, suggest raising Ollama's num_ctx setting if tool calls fail.

Turning the table into rules

A short policy makes the table usable. A team might write:

• Findings, code and audit evidence go only to commercial or business plans, or to a cloud provider account we own, with training off.
• Personal consumer plans are fine for public research and learning, not for customer data.
• Anything regulated goes through an account with zero retention, or through a route that uses no language model.
• An admin, not each user, decides which model families are allowed.

If you use Bedrock, the last rule can be enforced in code. AWS documents a Service Control Policy that denies any retention mode other than none:

{
  "Effect": "Deny",
  "Action": [
    "bedrock-mantle:PutAccountDataRetention",
    "bedrock-mantle:CreateProject",
    "bedrock-mantle:UpdateProject"
  ],
  "Resource": "*",
  "Condition": {
    "StringNotEquals": { "bedrock-mantle:DataRetentionMode": "none" }
  }
}

In Claude Code, an admin can limit the models people may pick with managed settings:

{
  "availableModels": ["sonnet", "haiku"],
  "enforceAvailableModels": true
}

Four ways to run AI in security work

Once the data rules are clear, most teams end up with a mix of four options. Each one fits different jobs.

1. No language model at all. Many security questions are lookups: how many critical findings, which projects use a package, what changed since last week. These can be answered by turning the question into a query over your data. In Safeguard this is Zero z20, which answers with no language model at all by turning the question into a platform query. It suits teams with a strict no-AI rule and any question where an exact count matters more than prose.

2. A security vendor's own models. Griffin, Eagle and Lion are Safeguard's models. They are an option when you want AI help inside the security platform without connecting another provider.

3. Your own model on your own provider account. If your company already has an approved provider, such as a commercial Claude or OpenAI account or a cloud provider, you can bring that model and route jobs such as chat or summaries to it. Your contract and retention settings with that provider still apply.

4. A local model. Running an open-weight model on your own hardware, for example through Ollama, keeps prompts inside your network. Plan for the hardware and test the model on your real tasks before you rely on it.

Matching jobs to options

Choose your model in Safeguard, step by step

Here is the order we suggest for setting up model choice in Safeguard.

1. Write the data rules. Use the five questions above and decide which jobs may use which kind of model.
2. Set the allowed families. A tenant admin chooses which model families people in the tenant may use. Allow only what your rules permit.
3. Connect your own model if you have one. Bring your own model on your own provider account, and route jobs such as chat or summaries to it.
4. Pick per conversation. Each person chooses the model for each conversation from the families the admin allowed.
5. Use Zero z20 for lookups. For counts and filters, pick Zero z20 so the question becomes a platform query with no language model involved.
6. Review quarterly. Provider terms and models change. Recheck the table above and your allowed list each quarter.

This demo shows choosing a model for a conversation, Zero z20 answering with no language model, Griffin, Eagle and Lion as Safeguard's models, a tenant admin choosing which model families people may use, and bringing your own model to route jobs such as chat or summaries.

Click through it at your own pace, or open it full screen.

Do the work properly with the Safeguard CLI

The model menu covers questions and summaries. Fixing code happens on your machine, and that is what the Safeguard CLI is for. It scans code, container images and SBOMs on your own machine, sends only the results to the platform, and includes an assistant that can fix what it finds. It can write code, not only scan.

Install

macOS and Linux:

curl -fsSL https://cli.safeguard.sh/install | bash

Windows:

irm https://cli.safeguard.sh/install.ps1 | iex

It is a single static binary, with no Node, Python or JVM needed. It runs on macOS, Linux and Windows, on x86_64 or arm64 (Windows is x86_64 only).

First session

1. Run safeguard with no arguments in your project folder to open the interactive terminal.
2. Type /login to sign in through the browser.
3. Type /scan . to scan the current folder.
4. Ask in plain language, for example "how many critical vulns do we have".
5. Type /model to see or switch the AI model, @ to attach a file from the folder you started in, and /resume to pick up the last session in that folder.

Writing and fixing code

The assistant has tools for your local files and for your Safeguard data, and picks whichever the question needs. Ask "fix the lodash CVE in this repo" and it edits the code with your approval. It also works as a general terminal assistant: it can find and read files, edit code and run commands on your machine, with your approval, plus everything security. "What's the latest file in ~/Downloads" is one of the examples in the docs.

Use the Claude, ChatGPT or Codex plan you already pay for

Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. Use /model to see or switch the model, and the CLI docs for connecting one.

"Your plan's terms still apply" matters for the data rules above. A business or enterprise plan carries business terms; a personal plan carries consumer terms. Pick the plan that matches the data you will put through it.

You can also stay in the chat you already use. Connect Claude or ChatGPT to the Safeguard MCP server and ask about your findings there. This demo connects ChatGPT to the Safeguard MCP server with OAuth and chooses which tools ChatGPT can use.

Click through it at your own pace, or open it full screen.

Approvals

Tools that change things, such as writing a file, editing code or running a command, ask before they act. /permissions sets the mode: Ask prompts before every action, Auto approves known actions and asks for anything new (the default), and Yolo approves everything. Use Ask when you try a new model, so you see every change it proposes.

Scans and CI

safeguard scan --dir .
safeguard scan --image your-image:latest
safeguard validate sbom.cdx.json
safeguard exec "summarise the critical findings in this repository"

safeguard scan builds an SBOM and matches it against vulnerability databases, with results as JSON files under ./output such as vuln.json and license.json. safeguard validate checks CycloneDX, SPDX and VEX documents. safeguard exec runs one non-interactive assistant turn for CI. Policies and gates are evaluated in the platform, not by the CLI. When the local runner runs platform scan jobs, your source code never leaves the machine; only SBOMs and findings are uploaded. The platform also offers reachability analysis and autonomous remediation with fix pull requests, which is off by default. For more, read the Safeguard CLI as a security-aware coding assistant.

One platform on every surface

The download page lists the CLI 1.4.0 for macOS, Linux and Windows; the desktop app 3.2.2 for Windows, macOS and Linux, where you ask your supply chain anything in plain English; mobile apps for iPhone and iPad and for Android; IDE extensions for VS Code, JetBrains and Open VSX; and a browser extension. With nothing to install, there is the web interface, the Cloud CLI, a cloud browser, and a cloud sandbox tenant against a seeded demo repo, free for seven days with no card. Start in the terminal, continue on the desktop and check findings on your phone.

Common mistakes

Choosing a model before writing the data rules. A model can be a good fit on quality and still be wrong for your data because of the plan it runs under. Write the rules first.

Assuming the model name decides the terms. The same model family can be offered under consumer terms, business terms and a cloud provider's terms. The plan or account decides training and retention.

Using a personal plan for customer data. Anthropic's consumer plans can use data for training when the setting is on. Keep customer data on business or commercial accounts.

Plugging a subscription into a tool the provider has not approved. OpenCode's provider docs say Anthropic prohibits using Claude Pro or Max plans through third-party plugins. Read the provider's terms before connecting any plan to any tool.

Sending lookups to a language model. "How many critical findings" has one right answer. A query with no language model gives it without sending data to a model.

Leaving model choice to every user. Without an admin allowlist, people pick whatever is newest. Use Safeguard's tenant setting or Claude Code's availableModels.

Forgetting local transcripts. Coding tools may store sessions on disk. Claude Code keeps them for 30 days by default. Include laptops in your data map.

FAQ

What should decide which AI model we use for security work?

Your data rules first: training, retention, who can review the data and who decides which models are allowed. Then fit the model to the job, and use no language model for lookups where an exact answer matters.

Can Safeguard answer questions without any language model?

Yes. Zero z20 answers with no language model at all by turning the question into a platform query. It suits counts, filters and teams with a strict no-AI rule.

Which models does Safeguard offer?

You choose the model for each conversation. Zero z20 uses no language model, Griffin, Eagle and Lion are Safeguard's own models, and you can bring your own model on your own provider account and route jobs such as chat or summaries to it.

Can an admin limit which models people use?

Yes. In Safeguard a tenant admin chooses which model families people may use. Claude Code offers availableModels in managed settings, and on Bedrock you can enforce a retention mode across accounts with IAM or Service Control Policies.

Can I switch to Safeguard and keep my Claude, ChatGPT or Codex?

Yes. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from that chat.

Do Anthropic and OpenAI train on our business data?

Their own pages say they do not by default under commercial or business terms. Anthropic's consumer plans let each user choose, and OpenAI's statement covers Business, Enterprise, Edu, Healthcare, Teachers and the API Platform. Check the plan each person actually uses.

Should we run a local model instead?

A local model keeps prompts on your hardware, which helps with data rules. You still need to secure the machine, and model quality and tool use vary, so test on real tasks.

Does my source code leave my machine with the Safeguard CLI?

When the local runner runs platform scan jobs, your code stays on your machine and only SBOMs and findings are uploaded. When you ask the assistant to work on code, the model you chose sees what the task needs, under that provider's terms.

Try it yourself

This demo sets up the runner on your own machine: pick the platform, start it, approve it with its device code, then use the same CLI to scan from the terminal.

Click through it at your own pace, or open it full screen.

Download the CLI or desktop app from safeguard.sh/download and read the CLI docs. For a side by side look at the two biggest assistant families, see Claude vs ChatGPT for coding.

Quick check

Sources

• Safeguard CLI documentation
• Safeguard CLI interactive terminal
• Safeguard download page
• Claude Code data usage
• Claude Code model configuration
• OpenAI enterprise privacy
• Codex pricing and plans
• Amazon Bedrock data protection
• Amazon Bedrock data retention
• Ollama repository
• OpenCode providers
• NIST AI Risk Management Framework

Last reviewed: 21 October 2026.