The underlying account, first reported by The Information and summarized by Tom’s Hardware, says Nvidia has confined Fable to work that does not require access to sensitive data, while other companies have demanded sharper contractual limits or moved sensitive workloads elsewhere. The report also names Palantir in its headline, but the supplied reporting does not document a particular Palantir policy change, deployment restriction, or contract term. That distinction matters for IT buyers: the concern is real and documented, while several of the most attention-grabbing company-specific details remain single-sourced.
For Windows administrators, security teams, and developers building agents against corporate data, this is less a debate over whether a provider trains on prompts than a much harder operational question: which systems can receive prompts, retain them, inspect them, or correlate them across sessions—and under what deployment model?
Anthropic changed retention, not its enterprise-training position
Anthropic’s June announcement did not say it would train future Claude models on enterprise customer traffic. It said Fable 5, Mythos 5, and similarly capable future models would require 30-day retention because the company believed it needed to correlate activity across requests and accounts to detect sophisticated misuse, including jailbreaks, fraud, and cyberattacks.
Anthropic said retained business traffic would not be used to train new Claude models or for non-safety purposes. It also said access would be logged and that the data would be deleted after 30 days in almost all cases. Those commitments are materially different from a blanket right to absorb customer source code, product plans, engineering documents, or data into model training.
They do not, however, equal zero retention. A company subject to export controls, customer confidentiality clauses, regulated-data rules, or strict intellectual-property controls may be unable to send certain material to a provider-operated service even if the service contractually promises not to train on it. Retention, automated safety analysis, possible human review of flagged material, cross-request correlation, and training are separate controls. Procurement teams that collapse them into a single “your data is private” checkbox are creating a governance gap.
The reported reaction from Nvidia therefore follows a recognizable enterprise pattern. Keep a frontier hosted model available for low-risk drafting, coding assistance, or research, but block it from repositories, design artifacts, internal tickets, customer records, credentials, and production-control systems. That is a data-classification decision, not necessarily a judgment that the model provider is training on company information.
The September reversal narrows the immediate dispute
Anthropic’s September 1 Enterprise Frontier Safeguards announcement is the critical development missing from a simple retelling of the June policy change. The company said eligible enterprise customers can use Fable 5 and Fable 5.1 with zero data retention until the new safeguards system is ready, with phased availability planned for later in fall 2026.
Under Enterprise Frontier Safeguards, Anthropic says customer data will reside in cloud infrastructure controlled by the customer rather than Anthropic. It says human review will, by default, be carried out by the customer instead of Anthropic. Anthropic also says the system will work across Claude Enterprise, Claude Code, its API platform, Amazon Bedrock, Google’s Agent Platform, and Microsoft Foundry.
That is a significant concession: Anthropic is effectively acknowledging that the 30-day retention requirement created a real compatibility problem for regulated and security-sensitive buyers. It also makes the current situation transitional rather than permanent. Organizations considering Fable should not assume either that the June policy still applies unchanged to every account or that Enterprise Frontier Safeguards is already available to them.
The caveat is practical, not semantic. “Eligible” is not the same as universally entitled, and a phased rollout is not a deployed control. An enterprise should obtain written confirmation of its model version, contract status, retention setting, data residency, review path, deletion terms, and the date on which its own environment will move to Enterprise Frontier Safeguards. A product webpage or sales assurance is not an adequate substitute for that record.
Microsoft Foundry is not one data boundary
The report’s suggestion that Microsoft offers an isolated cloud alternative is directionally correct, but it risks obscuring a deployment distinction that matters enormously to Windows and Azure administrators.
For Models sold by Azure in Microsoft Foundry, Microsoft’s documentation says prompts, completions, embeddings, and training data are not made available to OpenAI or other model providers; they are not used to train generative foundation models without the customer’s permission or instruction. Microsoft hosts those offerings in Azure, and the provider does not operate the service endpoint in the same way it does for a direct API relationship.
That protection does not automatically extend to every third-party model listed in Foundry. Microsoft’s own staff responses on its support forums have said Anthropic Claude deployments in Foundry follow a different processing arrangement: Anthropic acts as the data processor, and Claude prompt and response data is processed by Anthropic-hosted services. Those answers specifically say Claude models in Foundry are not covered by Azure OpenAI’s zero-data-retention terms.
In other words, “deployed through Microsoft Foundry” is not enough information to determine where prompts go. An administrator needs to identify whether a project uses a Microsoft-hosted model sold by Azure, a marketplace model, a provider-hosted endpoint, or a customer-controlled deployment under Anthropic’s forthcoming safeguards. The branding may be unified; the data path is not.
This is also why Microsoft cannot simply claim a clean win from competitors’ retention controversy. Microsoft Foundry can give organizations a governed platform for identity, networking, logging, policy, and selected Azure-hosted models. But if a team chooses Anthropic Claude through a third-party Foundry arrangement, the organization must still read Anthropic’s applicable data terms and determine whether the model’s retention policy fits the workload.
Metadata and model reasoning need separate answers
Tom’s Hardware, citing The Information, reports that telecom company C Spire is uneasy about technical usage data that OpenAI and Anthropic can collect even where contracts bar model training on customer data. The report says C Spire wants clearer explanations of what is captured about connected applications and model activity.
OpenAI’s enterprise policy says it does not train on ChatGPT Enterprise, Business, Edu, Healthcare, Teachers, or API inputs and outputs by default. Anthropic says it has never trained on enterprise data without explicit permission. Those are important commitments, but neither answers every architecture question an enterprise must ask.
Metadata can include account identifiers, timestamps, request volumes, model selections, tool-invocation patterns, authentication events, error data, IP or regional information, and connection details. The exact collection varies by service and configuration. Some of that telemetry is required to bill, secure, troubleshoot, and audit a service. It may still reveal a great deal about an organization’s projects, adoption pace, technical stack, or operational rhythms.
The same caution applies to chain of thought, the model’s hidden reasoning trace. OpenAI has said it does not show raw chain of thought to users and has described monitoring reasoning as useful for safety research. A provider’s assurance that it does not train on such material does not by itself settle whether intermediate reasoning, tool outputs, retrieved documents, or agent traces are retained for abuse monitoring, debugging, compliance features, or stateful session functions.
Security teams should require their providers to answer each category separately. “We do not train on your data” is not an answer to “What is stored, where, for how long, who can access it, and how do we verify deletion?”
The useful response is policy, not a blanket ban
Northrop Grumman’s reported choice to operate open-source models on air-gapped infrastructure illustrates the highest-control end of the spectrum. That model can reduce exposure to third-party retention policies, but it shifts responsibility for hardware, patching, model evaluation, access controls, observability, incident response, and safety guardrails back to the customer. Local inference is not automatically secure inference.
Most enterprises will need a tiered approach rather than an all-or-nothing decision:
- Public or low-sensitivity work can use approved hosted models with normal enterprise controls and monitored access.
- Internal confidential material should be limited to services with written no-training terms, defined retention limits, tenant controls, and reviewed data-flow documentation.
- Regulated, export-controlled, highly sensitive intellectual property, credentials, and production-control data should require zero retention, customer-controlled infrastructure, or an isolated self-hosted environment.
- Agent deployments should receive separate review because tool outputs, retrieved documents, logs, memory stores, and downstream API calls can expose more than the original prompt.
Nvidia’s reported restriction is therefore not evidence that hosted AI has become unusable for enterprises. It is evidence that the frontier-model market has reached a stage where the model selection cannot be separated from the data-handling architecture.
Anthropic’s forthcoming Enterprise Frontier Safeguards may solve that problem for some Fable customers, and Microsoft’s Azure-hosted model offerings provide a different control boundary for others. Until those terms are verified in the customer’s own contract and deployment, the safe default is straightforward: do not route proprietary data to a model simply because the portal says “enterprise.”