6 ms·

If you call this "spying", you should read the TOS of the OpenAI API again. If you, as a "hacker", still use their API, it's your own fault: > OpenAI may secur

If you call this "spying", you should read the TOS of the OpenAI API again. If you, as a "hacker", still use their API, it's your own fault: > OpenAI may securely retain API inputs and outputs for up to 30 days to provide the services and to identify abuse. After 30 days, API inputs and outputs are removed from our systems, unless we are legally required to retain them. You can also request zero data retention (ZDR) for eligible endpoints if you have a qualifying use-case. For details on data handling, visit our Platform Docs page. Source: https://openai.com/enterprise-privacy https://openai.com/enterprise-privacy

binarymax 3y ago
Azure's TOS are different. You can also opt-out of data retention: https://learn.microsoft.com/en-us/legal/cognitive-services/openai/data-privacy https://learn.microsoft.com/en-us/legal/cognitive-services/o...
- gpjanik 3y ago
  I'd assume Azure's TOS does not allow foreign secret services to use it for its operations. I remember TOS of iTunes mentioned you can't use it to build nuclear bombs. In that sense, there's no way that what Microsoft did was illegal.
- blackoil 3y ago
  It also lists "30-days retention window" for Asynchronous Abuse Monitoring.
  - binarymax 3y ago
    Yes, but you can opt-out of the data retention and abuse monitoring if you go through a vetting process and are deemed low risk.
    - ftkftk 3y ago
      That is correct. The process is manual and definitely has humans in the loop. It is also required for every individual subscription in your account.
      - bugbuddy 3y ago
        That’s the catch every little thing is a subscription on their platform.
      - Spooky23 3y ago
        It’s also not failure evident. I’ve managed a very large tenant with a number of carve out T&C. I’m aware of at least a dozen times that settings reverted during upgrades or migrations. O365 is a huge service with a lot of humans and duct tape holding things together. Unless you’re auditing them, you have no idea.
        deleted 3y ago
        [deleted]
infecto 3y ago
These are not all that unique and pretty common across all cloud services, GCP, AWS, Azure included. Especially in the spectrum of their ML/AI services. I don't think these TOS are out of this world.
blueblimp 3y ago
It's still an exceptionally poor privacy policy compared to pre-LLM online services. Compare with the Google Docs privacy policy, for example: https://support.google.com/docs/answer/10381817?hl=en https://support.google.com/docs/answer/10381817?hl=en > Google respects your privacy. We access your private content only when we have your permission or are required to by law. I think it is reasonable to expect the same from LLM API providers. The fact that they all currently do mass surveillance on users is bad.
- blackoil 3y ago
  > only when we have your permission or are required to by law That can be very vague. does TOS gave them the permission? Does law can eb interpreted to require them to check for CSAM and pirated material? What about access by Iran or North Korea agents? If you are pushing things to cloud, these questions will be asked.
  - judge2020 3y ago
    Anyone who cares will heed this language and not use them in the first place. For everyone else, Google's reputation as a "secure" place to host your proprietary files, docs, and emails will be flushed away if they cooperate with (foreign, mostly) law enforcement or have such a glaring security vulnerability that allows an org's files to leak from Google servers.
- notso411 3y ago
  [dead]

binarymax 3y ago

Azure's TOS are different. You can also opt-out of data retention: https://learn.microsoft.com/en-us/legal/cognitive-services/openai/data-privacy https://learn.microsoft.com/en-us/legal/cognitive-services/o...

gpjanik 3y ago
I'd assume Azure's TOS does not allow foreign secret services to use it for its operations. I remember TOS of iTunes mentioned you can't use it to build nuclear bombs. In that sense, there's no way that what Microsoft did was illegal.
blackoil 3y ago
It also lists "30-days retention window" for Asynchronous Abuse Monitoring.
- binarymax 3y ago
  Yes, but you can opt-out of the data retention and abuse monitoring if you go through a vetting process and are deemed low risk.
  - ftkftk 3y ago
    That is correct. The process is manual and definitely has humans in the loop. It is also required for every individual subscription in your account.
    - bugbuddy 3y ago
      That’s the catch every little thing is a subscription on their platform.
    - Spooky23 3y ago
      It’s also not failure evident. I’ve managed a very large tenant with a number of carve out T&C. I’m aware of at least a dozen times that settings reverted during upgrades or migrations. O365 is a huge service with a lot of humans and duct tape holding things together. Unless you’re auditing them, you have no idea.
      - deleted 3y ago
        [deleted]

infecto 3y ago

These are not all that unique and pretty common across all cloud services, GCP, AWS, Azure included. Especially in the spectrum of their ML/AI services. I don't think these TOS are out of this world.

blueblimp 3y ago

It's still an exceptionally poor privacy policy compared to pre-LLM online services. Compare with the Google Docs privacy policy, for example: https://support.google.com/docs/answer/10381817?hl=en https://support.google.com/docs/answer/10381817?hl=en > Google respects your privacy. We access your private content only when we have your permission or are required to by law. I think it is reasonable to expect the same from LLM API providers. The fact that they all currently do mass surveillance on users is bad.

blackoil 3y ago
> only when we have your permission or are required to by law That can be very vague. does TOS gave them the permission? Does law can eb interpreted to require them to check for CSAM and pirated material? What about access by Iran or North Korea agents? If you are pushing things to cloud, these questions will be asked.
- judge2020 3y ago
  Anyone who cares will heed this language and not use them in the first place. For everyone else, Google's reputation as a "secure" place to host your proprietary files, docs, and emails will be flushed away if they cooperate with (foreign, mostly) law enforcement or have such a glaring security vulnerability that allows an org's files to leak from Google servers.
notso411 3y ago
[dead]