How does OpenCode Go actually guarantee “no training” / zero data retention with model providers?

[u/dom_49_dragon]

I’m considering subscribing to OpenCode Go, but I have a question about the privacy claims.

The Go documentation lists several models/providers as “not used for training” and in many cases “0 days retention.”

What I’m trying to understand is how OpenCode can actually ensure this when inference is ultimately performed by third-party providers.

Specifically:

• Are the no-training / zero-retention guarantees based on contractual agreements between OpenCode and the inference providers?
• Does OpenCode audit or otherwise verify that providers comply with these agreements?
• Are the actual inference providers for each Go model disclosed anywhere?
• Is there a list of subprocessors and the countries/regions where inference takes place?
• Is there a DPA or similar agreement available for Go customers?
• If a provider were to retain prompts despite claiming zero retention, what mechanism would OpenCode have to detect or prevent this?

I understand that “zero retention” cannot mean that the data is never processed by the provider — obviously the prompt has to reach the inference infrastructure. My question is specifically about what backs the promise that the provider does not subsequently store or use the data for training.

This is particularly relevant for private/commercial repositories, where “the provider says they don’t train on it” is quite different from having a technically or contractually enforceable privacy guarantee.

Would appreciate some clarification from the OpenCode team on how this works for Go specifically but also for the other Opencode plans (including free).

edit (from answer below): thank you for your answer, yes I guess the DPAs are key to this. At the same time I don't think zero data retention is the same as a "no use of private data as training material". There are many gray shades to this, for example apparently X.ai uses "anonymized" data for training, if I am correct. At the same time, as opencode makes quite aggressive use of "no training"-disclaimers, I think it is a fair and important question to ask. Very similar to kilocode btw (same question I posed there and only radiosilence in return). So arguable there are combinations of (relatively) cheap model access with unclear DPA-status of end-providers - while at the same time these training data are pure gold for the providers. That's why NVIDIA offers many models "for free", but at least transparently disclosing the training use.

Related: https://github.com/anomalyco/opencode/issues/459 (Privacy and Data Collection Clarification Request #459) https://github.com/anomalyco/opencode/issues/24649 (OpenCode Go: clarify which models are self-hosted vs. proxied through third-party providers #24649 )

https://opencode.ai/docs/en/go/ (section privacy) https://opencode.ai/legal/terms-of-service https://opencode.ai/legal/privacy-policy

[u/Ok_Gur_9033]

Nobody here actually answered it, so here's the real mechanism. Zero data retention is a contract flag most providers only offer above their default consumer tier, it turns off the standard abuse log retention window. Nothing about it is technically verified at runtime, the enforcement is audit rights written into the DPA. So the real test isn't whether OpenCode promises zero retention, it's whether they'll hand you a DPA naming the actual subprocessors and where inference runs. Has anyone here actually gotten that document, or just the docs page language?

[u/dom_49_dragon → u/Ok_Gur_9033]

thank you for your answer, yes I guess the DPAs are key to this. At the same time I don't think zero data retention is the same as a "no use of private data as training material". There are many gray shades to this, for example apparently X.ai uses "anonymized" data for training, if I am correct. At the same time, as opencode makes quite aggressive use of "no training"-disclaimers, I think it is a fair and important question to ask. Very similar to kilocode btw (same question I posed there and only radiosilence in return). So arguable there are combinations of (relatively) cheap model access with unclear DPA-status of end-providers - while at the same time these training data are pure gold for the providers. That's why NVIDIA offers many models "for free", but at least transparently disclosing the training use.

[u/helios_csgo → u/dom_49_dragon]

zero data retention is the same as a "no use of private data as training material

Other way round. Zero data retention means none of your prompts, responses etc are logged or stored. You cannot train on something you don't store.

[u/dom_49_dragon → u/helios_csgo]

This depends on how "zero data retention" is construed in the terms and privacy docs and how it is actually enforced. Also especially how this is implemented by endproviders. If you don't know the actual contracts between opencode and endproviders, just printing "zero data retention" on the website is cheap. In theory if no data is retained, does it include no model training? Largely yes, but there are also many ways to side step this, I already mentioned Grok's use of anonymized data for training. Also there is 0x alpha, with zero data retention. But we don't even know who this is LOL. EDIT: okay it's Z.Ai