Pillar 02 · Scope
S4 Third-Party Model Check
Know where your data goes before you send it.
Form Document
What it's for
The framework's Scope chapter asks for one check before any data is sent to an external model provider: confirm how long it is retained, whether it can be used for training, and where it is processed. This template turns that into a record you can file with the use case and show an auditor or investor.
Enterprise terms often differ from a provider's consumer terms, and they change. The check confirms which terms apply to your contract, today, for the data you plan to send.
What you get
- The provider Who it is, how it is used and the highest data class requested.
- The checks Eighteen questions, five areas
- Decision The outcome, the highest data class approved, any conditions and four sign-offs.
How it connects
Run it for the model providers behind the S1 use cases, and for any feature S3 finds that sends data out; the highest data class approved goes back into S1 and S2, and C3's charter names the model as approved here.
A flavour of the worked example
| Provider | Collaboration suite vendor |
|---|---|
| Product and model(s) | Meeting recap (vendor-hosted model) |
| Check 01 · Excluded from training, by contract? | Yes (AI addendum, clause 3.1) |
| Outcome | Approved with conditions |
| Conditions | Recordings of HR and legal meetings excluded |
A few fields from one record of the toolkit's worked example, with long text shortened.
Next step
Guided build coming next.
Request access
Ask for access to the guided builds, including this kit's when it is ready.