{"course":{"slug":"choosing-your-tools","title":"Choosing and Using the Tools","url":"https://addaly.com/learn/choosing-your-tools","level":"beginner","track":"work"},"lesson":{"slug":"what-a-business-agreement-buys","title":"What a business agreement actually buys","url":"https://addaly.com/learn/choosing-your-tools/what-a-business-agreement-buys","position":50,"of":76,"minutes":8,"answer":"A business tier buys a contract rather than a better model (a training commitment, a data processing agreement, a sub-processor list.","keyIdea":"A business tier buys a contract rather than a better model (a training commitment, a data processing agreement, a sub-processor list, retention controls and regional processing) and none of it makes the output correct or moves the responsibility off you."},"body":{"format":"markdown","text":"## The tier difference is mostly contractual\n\nMoving from a consumer plan to a business, team or enterprise plan rarely buys you a better model. It buys you a different contract, and for anyone handling other people's information that contract is the product.\n\nFive things typically appear.\n\n**A commitment not to train on your content**, as a term of the agreement rather than a setting you can toggle. The practical difference is that breaking a contract has consequences that changing a default does not.\n\n**A data processing agreement.** Under European and several other regimes, when you handle other people's personal data you are the *controller* and the service is your *processor*, and the law requires a written agreement between you setting out what the processor may do. Consumer terms are not that agreement. If you handle client data professionally, this document is the reason to upgrade.\n\n**A sub-processor list.** Who else touches the data: cloud hosts, moderation vendors, analytics. Usually with a commitment to notify you before adding one.\n\n**Retention controls.** Options ranging from a shorter default to zero retention for qualifying customers, meaning inputs are not stored after the response is returned.\n\n**Regional processing.** A choice of where computation happens, which is what makes a residency requirement satisfiable.\n\n## Certifications, and what they mean\n\nYou will see SOC 2 Type II, ISO 27001, sometimes ISO 42001 for AI management systems, and sector schemes such as HIPAA arrangements in the United States.\n\nRead them accurately. A certification says an auditor checked that the company follows the security processes it says it follows. It does not say the product is safe, that the model will not make things up, or that your data cannot leak. It is meaningful evidence about organisational discipline and nothing at all about model behaviour.\n\nFor most small organisations the certification matters mainly because a customer or an insurer asks for it. That is a legitimate reason to want it, and it is worth being clear that is what it is.\n\n## Reading a sub-processor list\n\nThe list is usually a linked page and it is more informative than the policy. It names every other company involved: the cloud provider running the hardware, any model provider if this one resells, moderation and support vendors, analytics, and payment processing.\n\nTwo things to look for. First, whether a model provider appears, because a product built on somebody else's model means your data reaches two companies and you should read both sets of terms. Second, where each sub-processor operates, since that is what determines whether data leaves your region. A provider whose page is current and specific is telling you something about how it is run, quite apart from what the list contains.\n\n## What no agreement gives you\n\n**It does not make the output correct.** No contract addresses hallucination.\n\n**It does not remove your responsibility.** If you feed a client's confidential material into a service, you are the one who decided to, and the agreement is your evidence of due diligence, not a transfer of liability.\n\n**It does not survive the model.** A commitment about training is about the future. Anything already used in a completed training run cannot be extracted from the resulting weights.\n\n**It does not bind a reseller.** If you reach the model through a wrapper, a router or an agency, your contract is with them and theirs may be different.\n\n## The realistic version for a small operation\n\nMost readers are not negotiating enterprise agreements. The practical equivalent is short:\n\n1. Use the API or a business tier where the default terms are better, rather than a consumer free tier.\n2. Turn off training in settings wherever it exists, and screenshot it.\n3. Redact by role so that the sensitive material largely does not arrive in the first place.\n4. Keep confidential material on a local model.\n5. Write one paragraph for your own records saying which tools you use, for what, and on what terms.\n\nThat last paragraph takes ten minutes and is what you will be asked for if a client, an employer or a regulator ever enquires. Almost nobody has one, and having one changes a difficult conversation into an easy one."},"check":{"question":"An organisation upgrades to an enterprise plan and treats the SOC 2 report as evidence that the tool's answers can be relied on. What is the error?","options":[{"text":"An audit attests the company follows its stated security processes, not that answers are right.","correct":true},{"text":"The report describes the previous audit period, so it says nothing about the current version of the model.","correct":false,"tempting":"Notes a genuine limitation of audit timing while accepting the false premise that a current report would establish answer quality."},{"text":"SOC 2 covers security rather than privacy, so a separate privacy audit is required before the tool can be relied on.","correct":false,"tempting":"Splits audit scopes as if that were the gap, when no audit of either kind speaks to whether an answer is correct."},{"text":"SOC 2 applies to the provider's infrastructure and not to the customer's own configuration, which is where most failures occur.","correct":false,"tempting":"Correctly limits the scope to the provider, then still treats the report as bearing on output reliability."}]},"prev":{"slug":"reading-terms-in-ten-minutes","title":"Reading the terms in ten minutes","url":"https://addaly.com/learn/choosing-your-tools/reading-terms-in-ten-minutes"},"next":{"slug":"your-country-your-rules","title":"Your country, your rules","url":"https://addaly.com/learn/choosing-your-tools/your-country-your-rules"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'What a business agreement actually buys', in Choosing and Using the Tools. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/choosing-your-tools/what-a-business-agreement-buys (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"What a business agreement actually buys","courseTitle":"Choosing and Using the Tools","module":{"index":6,"slug":"data-terms-and-law","title":"Data, terms and the law"},"answer":null,"keyIdea":"A business tier buys a contract rather than a better model (a training commitment, a data processing agreement, a sub-processor list, retention controls and regional processing) and none of it makes the output correct or moves the responsibility off you.","hero":{"kind":"plate","image":null,"alt":null,"caption":null},"blocks":[{"t":"h2","id":"the-tier-difference-is-mostly-contractual","runs":[{"text":"The tier difference is mostly contractual"}]},{"t":"p","runs":[{"text":"Moving from a consumer plan to a business, team or enterprise plan rarely buys you a better model. It buys you a different contract, and for anyone handling other people’s information that contract is the product."}]},{"t":"p","runs":[{"text":"Five things typically appear."}]},{"t":"p","runs":[{"text":"A commitment not to train on your content","b":true},{"text":", as a term of the agreement rather than a setting you can toggle. The practical difference is that breaking a contract has consequences that changing a default does not."}]},{"t":"p","runs":[{"text":"A data processing agreement.","b":true},{"text":" Under European and several other regimes, when you handle other people’s personal data you are the "},{"text":"controller","i":true},{"text":" and the service is your "},{"text":"processor","i":true},{"text":", and the law requires a written agreement between you setting out what the processor may do. Consumer terms are not that agreement. If you handle client data professionally, this document is the reason to upgrade."}]},{"t":"p","runs":[{"text":"A sub-processor list.","b":true},{"text":" Who else touches the data: cloud hosts, moderation vendors, analytics. Usually with a commitment to notify you before adding one."}]},{"t":"p","runs":[{"text":"Retention controls.","b":true},{"text":" Options ranging from a shorter default to zero retention for qualifying customers, meaning inputs are not stored after the response is returned."}]},{"t":"p","runs":[{"text":"Regional processing.","b":true},{"text":" A choice of where computation happens, which is what makes a residency requirement satisfiable."}]},{"t":"h2","id":"certifications-and-what-they-mean","runs":[{"text":"Certifications, and what they mean"}]},{"t":"p","runs":[{"text":"You will see SOC 2 Type II, ISO 27001, sometimes ISO 42001 for AI management systems, and sector schemes such as HIPAA arrangements in the United States."}]},{"t":"p","runs":[{"text":"Read them accurately. A certification says an auditor checked that the company follows the security processes it says it follows. It does not say the product is safe, that the model will not make things up, or that your data cannot leak. It is meaningful evidence about organisational discipline and nothing at all about model behaviour."}]},{"t":"p","runs":[{"text":"For most small organisations the certification matters mainly because a customer or an insurer asks for it. That is a legitimate reason to want it, and it is worth being clear that is what it is."}]},{"t":"h2","id":"reading-a-sub-processor-list","runs":[{"text":"Reading a sub-processor list"}]},{"t":"p","runs":[{"text":"The list is usually a linked page and it is more informative than the policy. It names every other company involved: the cloud provider running the hardware, any model provider if this one resells, moderation and support vendors, analytics, and payment processing."}]},{"t":"p","runs":[{"text":"Two things to look for. First, whether a model provider appears, because a product built on somebody else’s model means your data reaches two companies and you should read both sets of terms. Second, where each sub-processor operates, since that is what determines whether data leaves your region. A provider whose page is current and specific is telling you something about how it is run, quite apart from what the list contains."}]},{"t":"h2","id":"what-no-agreement-gives-you","runs":[{"text":"What no agreement gives you"}]},{"t":"p","runs":[{"text":"It does not make the output correct.","b":true},{"text":" No contract addresses hallucination."}]},{"t":"p","runs":[{"text":"It does not remove your responsibility.","b":true},{"text":" If you feed a client’s confidential material into a service, you are the one who decided to, and the agreement is your evidence of due diligence, not a transfer of liability."}]},{"t":"p","runs":[{"text":"It does not survive the model.","b":true},{"text":" A commitment about training is about the future. Anything already used in a completed training run cannot be extracted from the resulting weights."}]},{"t":"p","runs":[{"text":"It does not bind a reseller.","b":true},{"text":" If you reach the model through a wrapper, a router or an agency, your contract is with them and theirs may be different."}]},{"t":"h2","id":"the-realistic-version-for-a-small-operation","runs":[{"text":"The realistic version for a small operation"}]},{"t":"p","runs":[{"text":"Most readers are not negotiating enterprise agreements. The practical equivalent is short:"}]},{"t":"ol","start":1,"items":[[{"text":"Use the API or a business tier where the default terms are better, rather than a consumer free tier."}],[{"text":"Turn off training in settings wherever it exists, and screenshot it."}],[{"text":"Redact by role so that the sensitive material largely does not arrive in the first place."}],[{"text":"Keep confidential material on a local model."}],[{"text":"Write one paragraph for your own records saying which tools you use, for what, and on what terms."}]]},{"t":"p","runs":[{"text":"That last paragraph takes ten minutes and is what you will be asked for if a client, an employer or a regulator ever enquires. Almost nobody has one, and having one changes a difficult conversation into an easy one."}]}],"check":{"question":[{"text":"An organisation upgrades to an enterprise plan and treats the SOC 2 report as evidence that the tool’s answers can be relied on. What is the error?"}],"options":[{"text":[{"text":"An audit attests the company follows its stated security processes, not that answers are right."}],"correct":true,"tempting":null},{"text":[{"text":"The report describes the previous audit period, so it says nothing about the current version of the model."}],"correct":false,"tempting":[{"text":"Notes a genuine limitation of audit timing while accepting the false premise that a current report would establish answer quality."}]},{"text":[{"text":"SOC 2 covers security rather than privacy, so a separate privacy audit is required before the tool can be relied on."}],"correct":false,"tempting":[{"text":"Splits audit scopes as if that were the gap, when no audit of either kind speaks to whether an answer is correct."}]},{"text":[{"text":"SOC 2 applies to the provider’s infrastructure and not to the customer’s own configuration, which is where most failures occur."}],"correct":false,"tempting":[{"text":"Correctly limits the scope to the provider, then still treats the report as bearing on output reliability."}]}],"order":[3,0,1,2],"why":null},"prev":{"slug":"reading-terms-in-ten-minutes","title":"Reading the terms in ten minutes","minutes":8},"next":{"slug":"your-country-your-rules","title":"Your country, your rules","minutes":9}}}