Look for the clause that lets the vendor use your data for its own purposes. It may be called telemetry, usage data, aggregated data, benchmarking or product improvement. Security tools see sensitive material, so you want to know which of these cover your code and findings, and which cover only usage counts.
Four kinds of use
Service data. Your code, results and configuration that the tool processes to serve you. The vendor should use it only to provide the service.
Usage telemetry. Counts and events about how the product is used: logins, feature clicks, scan durations. Normally low risk, but ask whether it can contain repository names, file paths or user identities.
Aggregated or anonymised data. Statistics combined across customers. Ask how the data is aggregated, whether it could be tied back to you, and whether it can include content from your code or findings.
Model training. Using your code, findings or prompts to train or tune machine learning models. If the tool has AI features, check this explicitly and in writing.
What to ask the vendor
- Is customer code or finding content ever used to train models, yours or a third party's?
- If an AI feature calls an external model provider, what are that provider's retention and training terms for our data?
- Can we opt out, and is the default off or on?
- Does the DPA say the vendor acts only on our documented instructions? Under GDPR Article 28(3)(a) a processor handles personal data only on documented instructions, which is hard to square with broad own purpose use.
- If the answer changes later, how will we be told?
For AI specific wording, see answering "do you train on our data", which covers the same question from the seller's side.
Benchmarking clauses
Some vendors reserve the right to compare customers using aggregated data. That is acceptable to many buyers if the output is not identifying and does not include content. Some contracts also restrict your right to publish benchmark results about the tool. Read that one too. It can limit how openly you can discuss a bad pilot.
Red flags
- A licence to use "customer data" for any purpose.
- A clause that treats findings or code snippets as aggregated data.
- AI features enabled by default with no description of the model provider.
- Changing terms by updating a web page.
Safe wording to request
"The vendor will use customer data solely to provide the service to the customer and will not use customer data, including code, findings and prompts, to train or improve machine learning models without written consent." Have your counsel adapt it.
Sources
Quick check
Is anonymised data free to use?
Not automatically. Ask how it is anonymised and whether it can include code or finding content.
Where is this clause usually found?
In the master terms or a data use section, sometimes in a privacy page linked from the order form.
Last reviewed: 19 October 2026.
