What can we reasonably ask?

How the vendor evidences separation: whether the audit report covers it, whether independent testing has examined it, and whether they will describe their approach in writing. Those are ordinary requests. The implementation detail is rarely useful to a buyer and rarely shared.

What is the AI-specific question?

Whether anything derived from your material could surface for another customer. That is about training and retention terms rather than about storage separation, and it is the question buyers most often intend when they ask how their data is kept apart.

Should we ask for dedicated infrastructure?

Where a reviewer has raised it specifically, it is worth pricing, since it removes a class of question. It comes with enterprise terms, a higher cost and sometimes a lag on new capabilities. Where nobody has raised it, it is paying to answer a question nobody asked.

Glossary

Tenant isolation

Keeping each customer's material separated inside a service that many customers share, which is what stands behind a vendor saying your content stays yours.

In plain terms

Almost every service you buy is one system serving many customers at once. Your material and another company's sit in the same platform, and something keeps them apart. That something is what this term names, and for most buyers the useful version of the question is not how it works but how the vendor evidences that it does.

Why it matters

Because sharing a platform is the normal arrangement rather than an unusual one, so this is what almost every buyer is relying on whether or not they have thought about it. For AI products it also carries a question with no equivalent in ordinary software, which is whether anything derived from your material could reach another customer through the model rather than through the storage.

How it works

Separation is a design property rather than a feature you switch on, which is why it is evidenced rather than configured. What a buyer can reasonably ask is how the vendor demonstrates it: whether the audit report covers it, whether independent testing has examined it, and whether the vendor will describe its approach in writing. Those are ordinary questions and vendors expect them.

The AI-specific question is about derived material rather than stored material. Whether anything learnt from your content could surface for another customer is a different question from whether your files are separated, and it is answered by the training and retention terms rather than by the storage design. Buyers frequently ask the storage question and mean this one.

Search and retrieval deserve their own question because they cross boundaries by design. A tool that indexes material to answer questions has built something derived from it, and where that index sits and who it can serve is worth asking about specifically. It is also the place where permissions inside your own organisation matter as much as separation between customers.

A dedicated arrangement is sometimes offered as the stronger answer and it is a real one with real costs. Running separate infrastructure for a single customer removes a class of question, and it typically arrives with enterprise terms, a higher price and occasionally a lag on new features. Where a reviewer has raised this specifically it is worth pricing; where nobody has, it is buying an answer to an unasked question.

The question asked, and the question meant

What makes this substitution so easy is that the left-hand answer is true, well evidenced and delivered with justified confidence. A vendor asked whether customers are separated can point to a design, an audit report and independent testing, and everybody in the conversation is satisfied. The buyer's underlying worry, which is about their material influencing what somebody else sees, has not been touched, because it is not a storage question at all. It sits in the training and retention clauses of the agreement, where it can be read and sometimes negotiated. The habit worth forming is to ask the right-hand question in its own words rather than through the storage proxy, because asked directly it gets a specific contractual answer, and asked by proxy it gets a confident answer to something else.

Seen in the wild

Asking a search vendor how an index built from one organisation's documents is kept from serving anybody else.
Glean
Establishing whether an assistant's terms rule out anything learnt from your material reaching other customers.
ChatGPT
Running a model on your own hardware, where there are no other tenants and the question does not arise.
Ollama

Common misconceptions

People assume

Shared infrastructure means our material is at risk.

In fact

Sharing is the normal arrangement for almost all software, and separation between customers is a basic design property that vendors evidence through audit reports and independent testing. The useful question is how it is demonstrated rather than whether the platform is shared.

People assume

Separated storage answers the AI question.

In fact

It answers the storage question. Whether anything derived from your material could reach another customer is settled by the training and retention terms rather than by how files are kept apart, and buyers frequently ask the first while meaning the second.

Questions

What can we reasonably ask?: How the vendor evidences separation: whether the audit report covers it, whether independent testing has examined it, and whether they will describe their approach in writing. Those are ordinary requests. The implementation detail is rarely useful to a buyer and rarely shared.
What is the AI-specific question?: Whether anything derived from your material could surface for another customer. That is about training and retention terms rather than about storage separation, and it is the question buyers most often intend when they ask how their data is kept apart.
Should we ask for dedicated infrastructure?: Where a reviewer has raised it specifically, it is worth pricing, since it removes a class of question. It comes with enterprise terms, a higher cost and sometimes a lag on new capabilities. Where nobody has raised it, it is paying to answer a question nobody asked.

Key takeaways

Sharing a platform is the normal arrangement, not an unusual risk.
It is evidenced rather than configured; ask how it is demonstrated.
The AI question is about derived material and lives in the training terms.
Search indexes are worth a separate question, because they are derived by design.

Tools that use this

Glean
How an index built from one organisation's documents is kept from serving others.
ChatGPT
Whether terms rule out anything learnt from your material reaching others.
Ollama
No other tenants, so the question does not arise.

Last checked July 2026

All glossary terms