07/06/2026
In the wake of the recent scandal (the cross-instance data enrichment case), itās important to remind the enthusiastic public that unless you are running your AI platform locally (a 100%-controlled and contained, self-hosted LLM) , with ANY third-party LLM connected to your stack you are at the mercy of said LLMās privacy and data retention policy. Any subprocessor has them, at least on the paper; almost nobody actually reads them.
It does not matter how exactly the connection is executed: whether itās an MCP server, a simple API endpoint, or a third-party integration via Zoho Flow or Zapier, once your data leaves your platform, you depend on your subprocessorās policy and security.
It does not mean you should not use subprocessors; it means you have to read the fine print before the internet brings you unexpected news about your favorite LLM.
Practical implications:
1) Read your platformās privacy policy; I am dead serious, just open and read it.
2) read your favorite LLMās privacy and data retention policy;
3) understand what is turned on and what is turned off on both ends, and why;
4) talk to a cybersecurity pro, especially if your business model requires compliance, particularly with HIPAA;
5) Subscribe to the updates from your software vendor and actually read them (or build a simple AI pipeline to fetch them periodically and send you a digest).
Zoho users can start here: https://zurl.co/vh5jc . Users of other platforms are welcome to read it, too, and consider switching: just like any platform, Zoho has its pros and cons, but privacy is one of our superpowers.
If you are conscious of your data and do not perform token-heavy operations, deploy a local model: it might be enough for most of your tasks. Alternatively, Zoho Zia, Zoho's in-house AI, while certainly not omnipotent, is included and sufficient for most typical AI pipelines -- and your data does not leave the platform.
