Palantir and Nvidia drew a harder line around model memory

01

WHAT ACTUALLY CHANGED

Reuters reported on September 14 that several large technology and consulting companies could restrict or stop using some advanced outside models unless providers offer stronger guarantees around intellectual property. Reuters attributed the account to The Information, which cited unnamed people familiar with the matter. According to that nested reporting, Palantir sought an irrevocable zero-data-retention commitment from Anthropic before making its models available through Palantir software. Palantir and Anthropic did not respond to Reuters requests for comment.

The same report said Nvidia limits Anthropic models to less sensitive work and uses its own Nemotron models for internal tasks. It also said Booz Allen barred employees from using Anthropic's commercial model for proprietary cybersecurity work. Nvidia, Booz Allen, Anthropic, and OpenAI did not comment to Reuters. Those restrictions are therefore reported claims based on unnamed sources, not company-confirmed policies or independently inspected controls.

Anthropic directly documents a narrower fact with broad consequences. Its current support page says prompts and outputs submitted to Mythos-class models and future models it designates as covered are retained for 30 days on every platform where those models are offered. The policy took effect June 9 and applies to affected zero-data-retention workspaces in Claude Console, Claude Code Enterprise, AWS Bedrock, Google Cloud Agent Platform, and Microsoft Foundry, with a separate safeguarded route for some eligible organizations using Fable.

Anthropic says the retained content supports safety detection across multiple requests, including repeated jailbreak attempts, state-sponsored espionage, and extortion campaigns. By default, company personnel cannot read the retained conversations. Human review can occur through a controlled path when content is flagged, access is limited to approved reviewers, and every access is logged. Anthropic says the data is deleted after 30 days unless it is flagged or must be kept for legal reasons. These are provider statements, not an outside audit of every implementation.

On September 10, Nvidia and Palantir announced a separate system that combines Palantir Foundry and AIP with custom Nvidia Nemotron open models for supply-chain operations. They say the stack was first deployed inside Nvidia, can run in cloud or on-premises infrastructure, can be tuned with an organization's own data, and keeps experts responsible for final decisions. The announcement confirms the architecture and intended controls. It does not confirm the internal Anthropic restrictions in the later report, prove that retention policy caused the Nemotron choice, or independently establish the system's security or performance.

02

WHY THIS MATTERS

The phrase not used for training answers only one question. A provider can promise not to update its models with a customer's prompt and still retain that prompt for abuse detection, troubleshooting, legal obligations, billing, or product analytics. A training opt-out is a rule about model improvement. Retention is a rule about copies. Metadata is a rule about records surrounding the interaction. Enterprises need all three answers separately.

Capability and confidentiality can now pull in opposite directions. A frontier model may be the strongest option for difficult analysis, but the most capable tier may also carry a safety-retention rule that a sensitive program cannot accept. A security team should be able to route public research to one model, ordinary internal work to another, and export-controlled, classified, client-confidential, or proprietary material to a tightly isolated system. One approved chatbot button is not a data strategy.

Platform names are not enough. The same model may be reached through a provider API, a cloud marketplace, an enterprise application, or an internal gateway. Content can remain inside AWS, Google Cloud, Microsoft Azure, or a company-controlled environment while still being retained under a model-specific rule. The meaningful unit of approval is the exact model, version, platform, workspace, subscription, region, setting, and purpose, not merely the vendor logo on the purchase order.

Open models and on-premises deployment can improve bargaining power because an organization may control the weights, infrastructure, logging, and update schedule. They do not magically create sovereignty. Operators still need to inspect model provenance, training and tuning data rights, network egress, administrator access, backups, telemetry, encryption, deletion, software supply chains, and incident response. A server rack in your building can still phone home, leak through a connector, or preserve more than anyone intended.

The dispute also makes provider substitution a security control. If a safety policy, acquisition, outage, government order, price change, or contract revision makes one model unacceptable, the organization needs a tested path to another. That means portable prompts, evaluation suites, access policies, source-linked outputs, and interfaces that do not weld critical work to one provider. Switching costs are not only a procurement concern when sensitive operations depend on the service.

03

WHERE IT COULD HELP

• Create a model-routing register that names the exact model and version, platform, workspace or subscription, approved data classes, geographic region, retention window, deletion exceptions, human-review path, metadata collected, and contract owner
• Separate training permission, prompt-and-output retention, metadata collection, safety review, product analytics, and legal preservation into distinct approval questions, with evidence for every answer
• Place a gateway in front of enterprise models that classifies the request, removes unnecessary sensitive fields, blocks prohibited content, selects an approved route, records the decision, and rejects work when no compliant route exists
• Test a locally controlled or open-model fallback on representative tasks before it is needed, measuring quality, latency, security, operating cost, failure severity, and the effort required to move prompts, evaluations, and audit records
• Require evidence beyond the word sovereign: an architecture diagram, data-flow inventory, network-egress test, key ownership, administrator list, access logs, backup and deletion behavior, model provenance, incident process, and an exercised exit plan