A Privacy Toggle Is Not a Firewall

The remediation is part of the evidence: OpenAI said it patched the bug, added checks matching cached data to the requesting user, examined logs, notified affected users, and improved monitoring. A privacy promise deserves that kind of concrete failure record.

Four questions hide inside one toggle

Training exclusion is different from transmission, retention, review, and authority. A consumer setting may change whether content contributes to model improvement. It does not by itself tell you whether text crossed a provider boundary, stayed in abuse-monitoring logs, was reviewed for safety, or reached a connected tool. Product and endpoint rules differ, so read the current terms for the route you are actually using. OpenAI’s data-use policy OpenAI’s API controls

A July 2026 report about Grok Build 0.2.93 described codebase uploads from a consumer login despite a training opt-out. The July 14 update reported server-side disabling of codebase uploads and a separate retention control; deletion completion was unconfirmed in that account. This is a dated, version-specific report, not evidence that the same behavior applies to every account or remains current everywhere. Researcher analysis and update

Test the action, not the label

Use an invented document containing a name, a confidential plan, and conflicting dates. Before any model call, specify what stays local, what may leave, what is removed or sealed, and what source record remains for correction. Removing the name does not make the plan safe to disclose. If confidential content cannot be excluded without defeating the task, block the external route and use an authorized local process or a person. Ask for a draft with citations and prohibit sending. An unresolved date conflict must fail acceptance and stop or escalate. A record of the attempted action does not make an external disclosure reversible.

That is a proposed operating test, not a certification. It examines five boundaries:

• Context: permitted fields, exclusions, and the source of truth.
• Computation: local, managed, or hybrid execution and the actual transport path.
• Authority: read, draft, recommend, confirm, and execute permissions.
• Acceptance: reviewer, rubric, uncertainty threshold, and correction path.
• Evidence: sources used and excluded, retention, actor, timestamp, effect status, and last good state.

Local execution can reduce the number of recipients. It does not settle stale software, poisoned memory, excessive tool authority, incorrect output, or recovery. A hosted private instance can also exist without proving that it meets your security, quality, or compliance requirements. Test the operational gap before declaring a market category missing.

For regulated work, map the actual entity and activity. HHS says a cloud provider handling electronic protected health information for a covered entity or business associate is generally a business associate, with applicable risk analysis and agreements still required. Local processing is not a compliance declaration. HHS cloud guidance

The purchase question is therefore concrete: what may leave, what may act, who accepts the result, and what remains visible when the run fails? A privacy toggle can be one control inside that boundary. It cannot stand in for the boundary.

Read the full essay on Substack →

Publisher: Paciva. This is an operating framework, not a claim that a particular product passes every test.