Is any institutional data retained in AI processing?

This question is asking whether your AI systems store or keep any data from the educational institution during or after processing. 'Institutional data' refers to any information owned by or pertaining to the institution, which could include student records, research data, administrative information, or other sensitive data. This question is being asked in a security assessment because AI systems often need to process data to function, but retaining that data creates security and privacy risks. Educational institutions are particularly concerned about this because they handle sensitive information protected by regulations like FERPA (Family Educational Rights and Privacy Act) and may have research data with intellectual property implications. When AI systems retain institutional data, it creates several risks: 1. Data breach exposure if the AI vendor is compromised 2. Potential misuse of data for training other AI models without permission 3. Compliance violations if data retention exceeds authorized periods 4. Privacy concerns if personal information is stored longer than necessary To best answer this question, you should: - Be specific about what data is retained (if any) and for how long - Explain the purpose of any data retention - Describe security controls protecting retained data - Reference any data deletion processes or policies - Mention if you have a 'zero retention' policy where applicable