amadan
Close the ZDR terms question; record what the published record corrects
Paul supplied the trust page and confirmed an account in use. §8.3's "no account exists, no terms have been read" is false on both halves. The retention claim is published and specific — prompts and completions held in volatile memory for the lifetime of the request, never stored, not logged, not used for training — and a GDPR DPA exists, incorporated into the ToS. So the 2026-09-19 ruling rests on a citable claim rather than an adjective. §7 is new and lists what the record corrects. Two cities, not three: the vendor claims Dublin and Helsinki, and §8.3 names Paris. §8.3's guess that a young vendor is "plausibly renting" its infrastructure is confirmed and should be stated as fact — AWS eu-west-1, Scaleway, Verda, Digital Realty, G-Core, Cloudflare. Certifications are in progress or planned with no auditor named, so nothing is third-party attested. The open gap is narrower than the DPA item it replaces: the subprocessor page says no customer data is shared with model developers or providers, which is a statement about model providers and not about subprocessors, and G-Core is listed for CDN, DDoS and WAF. A WAF inspects request bodies. One direct check on this date shows the API resolving straight to a Scaleway address with no CDN CNAME, which is evidence and not proof. §3's proposed honest claim now says we have read the terms, that nobody has audited them, and that subprocessors see what passes through them.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1 file changed,
+93
−9
ZDR-TREAT-AS-LOCAL.md+93 −9
CI passed — run details
diff --git a/ZDR-TREAT-AS-LOCAL.md b/ZDR-TREAT-AS-LOCAL.md| index 95513d3..b8593fb 100644 |
| --- a/ZDR-TREAT-AS-LOCAL.md |
| +++ b/ZDR-TREAT-AS-LOCAL.md |
| @@ -42,7 +42,26 @@ the ruling's force comes from ZDR closing *persistence* — the copy that |
| outlives the request and cannot be forgotten, which is the leak decision 8 |
| exists for — not from closing transmission. |
| -## 2. ANSWERED 2026-09-19 — Paul: "TensorX is zero-retention" |
| +## 2. CLOSED 2026-09-20 — the terms are published, read, and cited |
| + |
| +Paul, 2026-09-20, pointing at `https://tensorx.ai/trust-security/` and the |
| +account in use at `seapointish`. **§8.3's "no account exists, no terms have |
| +been read" is now false on both halves and must be rewritten.** §7 below |
| +lists everything the published record corrects. |
| + |
| +The retention claim, quoted rather than paraphrased: |
| + |
| +> "Prompts and completions are held in volatile memory only for the lifetime |
| +> of the request and are never stored." |
| + |
| +Also stated: not logged, not used for training. A **GDPR DPA exists**, |
| +automatically incorporated into the Terms of Service, published rather than |
| +request-only. **Paul's 2026-09-19 ruling rests on a published, specific |
| +claim rather than a marketing adjective**, which is what §2 was asking for. |
| + |
| +### 2.0 The original framing |
| + |
| +*Was: "ANSWERED 2026-09-19 — Paul: TensorX is zero-retention"* |
| Stated as fact, not as advertising. **That settles the internal posture and |
| §1 governs the design.** What it does not by itself settle is the |
| @@ -91,16 +110,27 @@ The clause under change is the last paragraph's middle sentence. Today: |
| > and cannot verify them, and content sent before you deleted something |
| > cannot be recalled. |
| -**Proposed, under Paul's 2026-09-19 ruling and §2's constraint:** |
| +**Proposed, now that §2 is closed:** |
| -> The provider can read what it receives while it answers, and their terms |
| -> say they keep none of it. We cannot audit that. Content sent before you |
| -> deleted something should not have been kept, and we cannot prove it |
| -> wasn't. |
| +> The provider can read what it receives while it answers. Their published |
| +> terms say prompts and completions are held in memory only for the lifetime |
| +> of the request — never stored, never logged, never used for training. We |
| +> have read those terms. Nobody has audited them: their ISO 27001 is in |
| +> progress rather than achieved, and no auditor is named. Their |
| +> infrastructure is run by named subprocessors — cloud and data-centre |
| +> providers listed on their site — and a subprocessor sees what passes |
| +> through it. |
| -**The clause deliberately absent is "we have read those terms."** Add it the |
| -day someone has. **What this sentence still may not say is "no document |
| -leaves this instance"** with the assistant on — see below. |
| +**Three clauses are load-bearing and must travel together.** "We have read |
| +those terms" is now true and was not on 2026-09-19. "Nobody has audited |
| +them" replaces the weaker "we cannot verify", because §7 establishes |
| +*specifically* that the certification is in progress and unattributed. |
| +And the subprocessor sentence is new: §7 turns §8.3's speculation into |
| +fact, and an honest claim that says "the provider" singular is now |
| +understating the count. |
| + |
| +**What this sentence still may not say is "no document leaves this |
| +instance"** with the assistant on — see below. |
| **What neither variant may say is "no document leaves this instance"** with |
| the assistant on. The README records a code review catching that exact |
| @@ -141,3 +171,57 @@ sense §3.2 means. |
| Not a blocker for an instance with one user and no real data. It becomes |
| one the day a second team runs fichas over real prospects. |
| + |
| + |
| +--- |
| + |
| +## 7. What the published record corrects in §8.3 |
| + |
| +Read 2026-09-20 from `tensorx.ai/trust-security/` and |
| +`tensorx.ai/sub-processors/`, plus one direct check of the API endpoint. |
| + |
| +**Corrections of fact:** |
| + |
| +- **Two cities, not three.** §8.3 says "Dublin, Helsinki and Paris". The |
| + page says "All GPU infrastructure is physically located in the EU, in |
| + Dublin and Helsinki." **Paris is not claimed by the vendor.** |
| +- **"Plausibly renting" is now confirmed, and §8.3 should say so as fact.** |
| + It reads: *"a vendor this young on infrastructure in three cities is |
| + plausibly renting it, and a subprocessor sees content in exactly the sense |
| + §3.2 means. That is a DPA question and the DPA is unread."* The DPA is now |
| + read and the list is published: **AWS EMEA (eu-west-1), Scaleway SAS, |
| + Verda (Helsinki colo), Digital Realty (Dublin colo), G-Core Labs (CDN, |
| + DDoS, WAF), Cloudflare (Turnstile)**. The speculation was right; it is no |
| + longer speculation. |
| +- **Certifications are not achieved.** ISO 27001 "in progress |
| + (infrastructure partner certified)" — i.e. the *partner*, not TensorX. |
| + SOC 2 Type II and ISO 42001 planned. **No auditor is named for any of |
| + them**, so nothing here is third-party attested. |
| + |
| +**The gap that matters most, and it is not closed.** The subprocessor page |
| +states *"No customer data (including prompts and completions) is shared with |
| +model developers or providers."* **That sentence is about model providers, |
| +not about subprocessors**, and the page does not say whether any |
| +subprocessor can see prompt or completion content. **G-Core Labs is listed |
| +for "CDN, network security, DDoS protection, WAF"** — and a WAF inspects |
| +request bodies by definition, which for an inference API means prompts. |
| +Whether it terminates TLS in front of `api.tensorx.ai` is unstated. |
| + |
| +**One direct check, 2026-09-20, and it is evidence rather than proof.** |
| +`api.tensorx.ai` resolves to a single A record, `51.15.214.55`, in |
| +Scaleway's range, with no CDN CNAME; the marketing site resolves elsewhere. |
| +The certificate verifies and its SAN covers both `api.tensorx.ai` and |
| +`api.tensorix.ai` — the vendor holds both spellings, so the name that looks |
| +wrong is not a finding. **So on this date, from one network, the API appears |
| +to go straight to Scaleway and not through G-Core.** That is one resolution |
| +at one moment, it does not bind the vendor, and a CDN can be switched on |
| +without telling anyone. |
| + |
| +**Replacing §13's closed DPA item, and it is narrower and answerable:** |
| +*does any subprocessor terminate TLS in front of `api.tensorx.ai`?* Ask |
| +them; the answer belongs in §3.2 either way. |
| + |
| +**None of this reopens Paul's ruling.** ZDR is published and specific, and |
| +the ruling turns on persistence. What it changes is the honest claim's |
| +arithmetic: the number of organisations that can see a prompt in flight is |
| +not one, and §3.6 now says so. |