What the vendor states about your data. With the sentence and the source.
When a new AI tool shows up in discovery, the first question is always the same: what are the terms? A fact card answers it from the vendor's own published pages, per plan, with the wording, the link and the date it was read. What could not be read is marked unknown.
Real vendor statements from the shipped fact data. Choose a tool and a plan.
- Trains on customer data
- Yes by default; opt-out available
- “we may use Content you provide us to improve our Services, for example to train the models that power ChatGPT”
- openai.com
- Default retention
- Kept until the user deletes it; removed within 30 days of deletion
- “Once you choose to delete Personal Data, we will remove it from our systems within 30 days”
- openai.com
- Unknown for this plan
- Human review of inputsSingle sign-on (SSO)SCIM provisioningAudit logs
- Tools with researched facts
- About 40
- Pages read on
- 12 Nov 2026
- Every fact carries
- Quote, source, date
- Public pages
- 37 tools
Per plan, because the plan decides.
The same product can have opposite terms on different plans. A personal account may be used for training by default while the enterprise plan of the same tool is not. So a card is organised by plan tier: consumer, individual, team, enterprise and API, each listing the plan names it covers.
For each tier a card records what the vendor states about:
- Training on customer data: yes, no, by default with an opt-out, only on opt-in, or controlled by a setting.
- Retention: the default period, whether a zero-retention option exists, deletion on request.
- Human review of inputs: none, abuse monitoring only, or limited to listed cases.
- Enterprise controls: single sign-on, SCIM, audit logs, an admin console, data residency, customer-managed keys.
And for the vendor as a whole: stated attestations such as SOC 2 Type II and ISO/IEC 27001, whether a data processing agreement was found, model providers used, and where data is processed.
If your workspace has a licence recorded for the tool, the card opens on the tier you actually hold: "You hold ChatGPT Enterprise: these terms apply."
{
"value": "opt_in",
"detail": "Data is used for training only where the customer explicitly opts in.",
"quote": "By default, we do not use your business data for training our models.",
"source_url": "https://openai.com/enterprise-privacy/",
"last_verified": "2026-11-12",
"confidence": "primary"
}"The vendor states." Never "we found".
Every fact is a statement on a page the vendor itself publishes: terms, privacy policy, trust centre, help centre, documentation. GhostAudit records the statement. It does not audit the vendor, test the product or read your contract.
Unknown is a first-class value. A fact that was not read on the vendor's current page is unknown. It is never guessed, never inferred from a competitor and never filled from memory. "Not stated" is different: the page was read and does not say.
No verdicts. The data format rejects words such as "unsafe" in any value. A card tells you what was stated and what was not; the decision is yours.
Dated, and re-checked. Each fact shows the day its page was read. A monthly job re-fetches every source and reports any quotation that is no longer on its page, so a person can re-read it. Facts older than 120 days are shown as possibly out of date.
Coverage is honest too. Facts have been researched for about forty tools. The rest of the catalogue has a card that lists the vendor's official pages and marks every fact unknown. The public fact pages include only tools whose training stance is sourced.
- Corrections: email {{site.contactEmail}} with the page that shows the current wording
- The full method and research log ship with the product
In front of you at the moment of decision.
A fact card is reference data. It becomes useful where a decision is made:
- In the discovery review queue, under "Before you approve", when a new tool is found.
- In the inventory, as a column and a filter: every tool that trains on data by default on the plan you hold.
- In the usage view, when you open a tool people are using.
- Side by side: compare up to four tools on one screen.
- In the vendor assessment document, pre-filled with the vendor's statements and marked as unverified. If you use AI drafting, the model cannot alter them.
- In questionnaire answers, where a customer asks whether their data trains a model.
The card also suggests a starting risk tier for the inventory and shows its arithmetic. It is a suggestion an admin accepts or changes. Nothing applies it on its own.
Fact card details
- Coverage
- A card for every tool in the catalogue and three widely used tools outside it. Researched plan tiers for about forty; official addresses only for the rest. 37 tools have a public page.
- Sources
- The vendor's own pages only. Search results, blogs and third-party summaries are not used.
- Confidence
- Primary (the vendor's own page), secondary (a regulator or major news outlet), or unknown.
- Freshness
- A monthly check of every source address. Facts older than 120 days are flagged.
- Outbound requests
- The monthly check fetches only the vendor addresses in the shipped data set, with a user agent that names the product. It sends no customer data.
- Not included
- Your contract, negotiated terms, or any test of the vendor's product. Public incidents are not recorded for any vendor yet.
- Plans
- Reference data, available in every plan.
Questions
- Is this legal advice or a vendor assessment?
Neither. The cards are summaries of statements vendors publish, as read on a date. Terms change, and the plan you hold and any negotiated terms decide what applies to you. Open the linked source and check your contract before you rely on a statement.
- Why are so many facts "unknown"?
Because the page that would answer them could not be read, or was not read yet, and guessing would be worse. Several vendors refuse automated requests to their trust centres. The research log lists every address that could not be opened.
- How do I report an error?
Email [email protected] with the tool, the fact and the page that shows the current wording. The page is re-read. If it supports the correction, the fact, its quotation and its date are updated in the next data release. If the page cannot be opened, the fact is set to unknown.
- Can I see the facts without an account?
Yes. The public fact pages cover 37 tools, and the same data is served as JSON from the product's public API.
Know the terms before you approve the tool.
Start a 14-day trial with every Govern feature, connect one discovery source and enroll a handful of devices. No card is needed to start, and nobody is asked to change how they work.