Data security
& AI FAQ
How your data moves through Wenti, where it is stored, and what the AI provider’s policies mean for your organization.
References reviewed
Your systems remain
the destination.
How does extracted data reach our systems?
Wenti connects to WhatsApp through approved API access, processes the information within its AWS environment, and delivers output to your designated SharePoint site through Microsoft Graph API. Autodesk Forma is an alternative destination through the applicable Autodesk Platform Services APIs. API connections use TLS encryption in transit.
You nominate the destination and approve access permissions. The supported WhatsApp connection, Forma product and project, file formats and permission scope are agreed during onboarding. Your internal AI can consume the delivered data in your own systems.
References: Wenti architecture brochure · Microsoft Graph file uploads · Autodesk Data Management API
What does dedicated customer tenancy mean?
Each customer has customer-specific access, configuration and output routing. The integration uses the permissions approved for that customer’s systems.
Dedicated tenancy describes the customer’s isolated service context. A separate physical server, AWS account or VPC is an additional deployment choice that must be expressly agreed.
Reference: Wenti architecture brochure
Does Wenti keep a copy of our business data?
For the API-only extraction workflow shown in the brochure, business data is processed in memory and delivered to your systems without a permanent business-data copy at Wenti. Service configuration and operational metadata are managed separately. The deployment agreement should specify payload handling in logs, temporary files, queues, retries and backups.
AI provider retention is separate. OpenAI’s default API abuse-monitoring logs may include prompts and responses and be retained for up to 30 days, with exceptions for legal requirements or protection from harm. Some API features also retain application state. Zero Data Retention requires approval and has feature limitations; it is not assumed for every deployment. OpenAI’s data controls documentation explains these rules.
You control access and retention in the designated SharePoint or Forma destination. Wenti’s Privacy Policy also describes its general retention practices.
Six questions.
Clear answers.
“Input Data” means prompts, attached files and other content submitted to the AI service. The answers below refer to OpenAI’s API business service when enabled for the workflow.
Can generative AI be disabled so users cannot re-enable it?
An extraction-only workflow can be scoped to deliver data for your organization’s internal AI. However, the current public website and terms do not document an administrator-enforced AI disable switch that ordinary users cannot override.
This requirement must be confirmed for your tenant before sign-off: which AI calls are disabled, who can change the configuration, and whether users can re-enable the integration. Role-based access alone does not establish that guarantee.
References: Wenti enterprise features · Wenti Terms of Use
Could our prompts or attached files be used for model training?
OpenAI states that API inputs and outputs are not used to train its models unless the customer explicitly opts in. Wenti’s website also states that customer data is not used to train shared models.
For your deployment, confirm that optional data sharing is disabled and that any customer-requested fine-tuning is separately agreed. This no-training policy does not mean zero retention; see the retention answer above.
References: OpenAI API data controls · Wenti enterprise features
Is there a risk around exclusive ownership or unauthorized use of our data and outputs?
For a strict Yes/No assessment, treat this as Yes, pending contractual confirmation. Wenti’s published terms retain customer input ownership, but also contain content licences and provisions about usage-derived information and platform IP. They do not, by themselves, establish exclusive customer ownership of every output.
OpenAI assigns output rights to its contracting customer, where legally permitted, and retains no ownership of that customer’s inputs. Its permitted content use is limited, with service improvement requiring explicit agreement. If Wenti holds the API account, your Wenti agreement must specify how output rights pass to your organization.
Agree ownership of customer-specific outputs, permitted processing, any derived-data use and the distinction between your data and Wenti’s platform software before sign-off.
References: Wenti General Conditions, sections 4–6 · Wenti Terms of Use, sections 7–8 · OpenAI Services Agreement, sections 4 and 9
Could an output infringe intellectual property or portrait rights?
OpenAI states that outputs may not be unique and other users may receive similar content. Ownership of an output does not establish that it is free of third-party copyright, design, trademark or likeness rights.
Review material before external publication or commercial use, especially designs, logos and identifiable people. Obtain the necessary permissions for inputs and likenesses. These references do not establish a “high likelihood” of infringement for this workflow, or guarantee zero risk.
References: OpenAI Services Agreement, sections 4.3–4.4 · OpenAI Service Terms, API and image/video provisions
Could inappropriate training datasets create reputational risk?
OpenAI describes training-data filters for unwanted material, including hate speech and adult content. Its public overview does not certify that every training item is free of child sexual abuse material, discriminatory content or hate speech.
A zero-risk answer is therefore not supported by the public documentation. Assess the selected model’s safety documentation and the intended external use, and review generated material before publication.
Reference: How OpenAI’s foundation models are developed
Do the AI provider’s terms explicitly assume liability for AI risks?
OpenAI’s business agreement and API Service Terms provide an indemnity for certain third-party IP claims, subject to conditions and exclusions. They do not transfer all AI-related risks to OpenAI.
API exclusions include missing input rights, ignored safety features, modified or combined outputs, third-party offerings and trademark claims involving use in trade or commerce. Beta services are excluded from indemnity.
The protection applies under the API account holder’s agreement. Your contract must establish any benefit to your organization. Wenti’s current Terms of Use separately address third-party integrations, liability limits and customer indemnification; this FAQ does not extend those commitments.
References: OpenAI Services Agreement, sections 12–14 · OpenAI Service Terms, sections 1–2 · Wenti Terms of Use, sections 10, 12 and 14
Confirm the details
for your deployment.
The current website and terms cover some of these topics. This FAQ brings the references together and identifies where customer-specific confirmation is needed. It explains the workflow and published policies; contractual commitments are set out in the applicable customer agreement.
Confirm the enabled AI features, provider and model, permissions, retention settings, output ownership and applicable liability provisions with Wenti before proceeding.
Contact Wenti