AI Compliance Hub

Youngstown State University · IT Governance & Procurement
Last verified: October 12, 2026
8
Models evaluated
6
Policy approved
2
Do not procure

This dashboard tracks AI subscription services against YSU’s AI Policy for individual Pro/paid tiers. Procurement verifies compliance before processing a purchase request. Each model is scored on data-training risk and encryption posture, 1–5; a combined score of 7 or higher is approved.

Model compliance review

Individual / Pro tier subscriptions
Score key (out of 5) 5 – no training by default 4 – easy opt-out 3 – standard / moderate friction 2 – legacy / high friction 1 – mandatory / high risk
Filter
Claude AI
Anthropic
Approved
YSU Team Plan
Data training5/5
Encryption4/5
Combined 9 / 10meets the ≥ 7 threshold
Required action
No action required — YSU Team plan
Claude for Work (Team plan) runs under Commercial Terms, which exclude model training by default.
AES-256 at rest · TLS 1.2 or better in transit · SOC 2 Type II.
Data-training policy
ChatGPT
OpenAI
Approved
Config required
Data training4/5
Encryption3/5
Combined 7 / 10meets the ≥ 7 threshold
Required action — configure before use
Training is enabled by default. The user must opt out.
Settings → Data Controls
Turn off “Improve the model for everyone”
Opt-out is also available through the vendor privacy portal.
How to opt out of training
Copilot Pro
Microsoft
Approved
YSU Enterprise Agreement
Data training4/5
Encryption4/5
Combined 8 / 10meets the ≥ 7 threshold
Required action
No action required — enterprise agreement
Security and data privacy are built into the YSU enterprise contract.
Manual opt-out configuration is not required.
Data-training policy
Gemini
Google
Approved
Config required
Data training4/5
Encryption4/5
Combined 8 / 10meets the ≥ 7 threshold
Required action — configure before use
“Keep Activity” is used for training and human review by default.
Gemini Settings → Your Data in Gemini
Turn off “Keep Activity”
How to opt out of training
Grok
xAI / X Corp
Approved
Config required
Data training3/5
Encryption4/5
Combined 7 / 10meets the ≥ 7 threshold
Required action — configure before use
Trains on X posts and Grok chats by default. January 2026 X terms broadened the training license over prompts and outputs.
X Settings → Privacy and safety → Data sharing and personalization → Grok & Third-party Collaborators
Turn off “Data Sharing”
How to opt out of training
Perplexity AI
Perplexity
Approved
Config required
Data training4/5
Encryption3/5
Combined 7 / 10meets the ≥ 7 threshold
Required action — configure before use
AI data retention is enabled by default for Pro accounts. The user must opt out.
Account → Preferences
Turn off “AI data retention”
How to opt out of training
Meta Llama 4
Meta AI
Denied
Data training2/5
Encryption3/5
Combined 5 / 10below the ≥ 7 threshold
Procurement action
Do not purchase — policy violation
Opt-out requires the high-friction “Right to Object” form (region-limited).
Combined score 5 falls below the institutional threshold.
DeepSeek AI
DeepSeek
Denied
Data training1/5
Encryption2/5
Combined 3 / 10below the ≥ 7 threshold
Procurement action
Do not purchase — policy violation
Training scored 1 under the country-of-origin rule — the service is operated by a China-registered entity and data is stored in China.
Encryption is described only in general terms, with no specified protocols.

Data verification log

Sources audited October 12, 2026
Monthly source audit. Changes are compared against the prior cycle (verified July 29, 2026).
DateModelSource verifiedStatusNotes / changes found
10/12/2026Claude AI (Team)privacy.claude.com VerifiedNo score change. Privacy Center article updated August 18, 2026 confirms that inputs and outputs from commercial products (Team, Enterprise, API) are not used for training by default. Certifications article lists SOC 2 Type II, ISO 27001:2022 and ISO 42001:2023.
10/12/2026ChatGPTopenai.com/policies/privacy-policy VerifiedEncryption 4→3: OpenAI's Product Compliance Status page (updated August 4, 2026) lists SOC 2 Type 2 scope by product and names only the Business, Enterprise, Education, Healthcare, Teachers, API, Codex and Presence products; individual ChatGPT plans are not in scope. Content is documented as encrypted at rest and in transit. Training unchanged at 4; privacy policy updated September 10, 2026 keeps the in-settings opt-out.
10/12/2026Copilot Prolearn.microsoft.com/copilot/microsoft-365 VerifiedNo score change. Microsoft 365 Copilot documentation states that prompts, responses and Microsoft Graph data are not used to train foundation models, and that stored interaction data is encrypted at rest and in transit. Coverage continues under the YSU Enterprise Agreement.
10/12/2026Geminisupport.google.com/gemini/answer/13594961 VerifiedNo score change. Privacy Hub updated September 24, 2026; Privacy Notice updated June 29, 2026. With Keep Activity off, future chats are not used to train models. With it on, chats and imported chats from other AI platforms are used for training and a subset is reviewed by humans.
10/12/2026Grokx.ai/security VerifiedNo score change. Opt-out path updated: the toggle now sits under Data sharing and personalization → Grok & Third-party Collaborators. Security page documents server-side encryption at rest (SSE-S3) and TLS in transit; vendor pages now carry SpaceXSI / SpaceXAI branding.
10/12/2026Perplexity AIperplexity.ai/hub/security VerifiedNo score change. Privacy Notice reissued July 8, 2026 at a new URL (hub/legal/privacy-notice); the help center continues to document the AI data retention toggle for Free, Pro and Max accounts. Security page updated August 21, 2026 and still documents SOC 2 Type 2 and SSL/TLS in transit.
10/12/2026Meta Llama 4facebook.com/privacy/genai VerifiedNo score change. Training opt-out remains limited to a Right to Object request through Meta's Privacy Center. The prior assessment carries forward this cycle.
10/12/2026DeepSeek AIcdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html VerifiedNo score change. Privacy policy still dated February 10, 2026: data controller is Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and personal data is stored in the People's Republic of China. Security section describes commercially reasonable measures without naming encryption protocols.

Procurement quick reference

Purchase approved
  • Claude AI (Team plan)
  • ChatGPT (post-config)
  • Copilot Pro (Enterprise Agreement)
  • Gemini (post-config)
  • Grok (post-config)
  • Perplexity AI (post-config)
Do not purchase
  • Meta Llama 4
  • DeepSeek AI
Policy basis

YSU AI Policy — individual-tier requirements. Subscriptions must score ≥ 7 for institutional approval.

Contact

YSU IT Governance. For questions on this report, contact the Office of Information Technology.