They Are Still Training on Your Data
The AI industry's dirty little secret is that it is still training on your data. Your prompts are better than another scrape of Reddit. They contain current code, private documents, expert corrections, tool traces, purchase decisions, failed attempts, and the answer you finally accepted. A closed router sees all of it across every model. That may be the most valuable dataset in AI.
A Google DeepMind paper explains how to turn private or otherwise unusable data into training data. The paper starts with the data shortage. Training datasets are growing faster than new text appears on the public web. Far more text exists in messages, private code, company documents, and other user-generated content. Companies have avoided much of it because it contains personal information, copyrighted material, and toxic content.
The method is called Generative Data Refinement. Give a model one real example and ask it to rewrite the dangerous parts while preserving the useful information. The result is called grounded synthetic data. It keeps the diversity of the real dataset because every synthetic example begins with a real one.
This works. The researchers tested more than 20,000 sentences across 108 kinds of personal information. Their approach reached mean recall of 0.99 and precision of 0.80 on that benchmark. They ran it across 1.2 million lines of code from 479 repositories. They also cleaned 100,000 toxic messages and trained a model on the result. The trained model learned facts from the original messages after the toxic wording was gone.
Now read the usual promise again: we do not train on your data. Which data? The exact row you sent may disappear. A synthetic rewrite conditioned on that row can live forever. The training job consumes the rewrite, so the company says the model trained on synthetic data. Your real prompt supplied the facts, structure, vocabulary, and diversity that made the synthetic example valuable.
Zero data retention can have the same hole. A server receives the raw prompt, runs the refinement step, writes the derivative somewhere else, and deletes the raw bytes. A strong contract can ban that. It needs to cover derivatives, de-identified content, model improvement, product improvement, research, and disclosures to partners. The three letters ZDR do not tell you whether it does.
Some router terms make the data business visible. OpenRouter's terms say that users who opt into prompt logging grant a license that includes selling anonymized user content. A separate section grants a perpetual license to prepare derivative works of anonymized inputs for rankings. OpenRouter also says it does not sell prompt data. All of those sentences can be true at once. Vercel's privacy notice says de-identified AI product information from Hobby and Pro users may be disclosed to AI partners for product development and model training, subject to user preferences. The contract calls the information anonymized or de-identified before it changes hands.
I cannot tell you that every closed router runs this exact pipeline. You cannot tell either. The source is closed, the production binary is hidden, and the prompt arrives in plaintext. A privacy page describes the company's current rules for itself. It gives your computer nothing to verify.
TrustedRouter removed this business model from the router. Public TLS terminates inside an attested open source workload. The control plane never receives prompt or output bodies. The published gateway code does not build or persist a synthetic training corpus, and the live attestation lets a client check which gateway image is handling the request. A different binary produces a different measurement.
The upstream model provider is a separate boundary. trustedrouter/zdr selects providers with a tracked zero-retention posture. trustedrouter/e2e requires eligible confidential provider compute and provider-side encryption. The provider directory publishes each claim and leaves unknown providers marked unknown. A normal provider route can still expose the prompt to that provider, so choose the privacy floor your data requires.
Deleting your row is easy. Giving up the information inside it is expensive. The AI industry found a way to keep the second while promising the first.