Document management software data terms
8 of 14 document management software vendors whose terms we read reserve the right to use their customers' data in aggregated or anonymised form, read 28 October 2026.
Vendor keeps aggregated or anonymised use
Who owns the business's data
Training AI on the business's data
Export at exit
The full board, one vendor per row
Every row is a single vendor, and every answer expands to the wording it was taken from, the document it came from and when it was read. "Not stated" is used when the document says nothing on the point.
| Vendor | Who owns the business's data | Vendor keeps aggregated or anonymised use | Training AI on the business's data | Export at exit |
|---|---|---|---|---|
| Atlassian (Confluence) | the business | not statedNot addressed in Atlassian Customer Agreement | not statedNot addressed in Atlassian Customer Agreement | not statedNot addressed in Atlassian Customer Agreement |
| Box | the business Not addressed in AI Principles Not addressed in AI Acceptable Use Policy and Guiding Principles | not statedNot addressed in Terms of Service Not addressed in AI Principles Not addressed in AI Acceptable Use Policy and Guiding Principles | will not train Not addressed in AI Acceptable Use Policy and Guiding Principles | 14 days Not addressed in AI Principles Not addressed in AI Acceptable Use Policy and Guiding Principles |
| Dropbox | the business Not addressed in Privacy Policy Not addressed in AI Principles | not statedNot addressed in Terms of Service Not addressed in Privacy Policy Not addressed in AI Principles | will not trainNot addressed in Terms of Service Not addressed in Privacy Policy | no export promised Not addressed in Privacy Policy Not addressed in AI Principles |
| Egnyte | the business | reserved Not addressed in MSP End Customer Agreement | no export promised | |
| iManage | not statedNot addressed in Terms of Service | reserved | not statedNot addressed in Terms of Service | on request |
| Iron Mountain | not statedNot addressed in InSight DXP: AI model training, security and compliance (whitepaper) | not statedNot addressed in InSight DXP: AI model training, security and compliance (whitepaper) | may train | not statedNot addressed in InSight DXP: AI model training, security and compliance (whitepaper) |
| M-Files | the business | reserved | may train | 30 days |
| monday.com | the business | reserved | not statedNot addressed in Terms of Service | no export promised |
| NetDocuments | the business | reserved | not statedNot addressed in Software as a Service Agreement (2025) | 30 days |
| pCloud | the business | not statedNot addressed in Terms and Conditions | not statedNot addressed in Terms and Conditions | not statedNot addressed in Terms and Conditions |
| Progress ShareFile | the business | reserved | will not train | 30 days |
| Smartsheet | the business | reserved | not statedNot addressed in User Agreement | 30 days |
| Sync.com | the business | not statedNot addressed in Terms of Service | not statedNot addressed in Terms of Service | no export promised |
| Wrike | the business | reserved | will not train | no export promised |
Where each answer was read (76)
- Atlassian (Confluence), Atlassian Customer Agreement, read 2026-10-12, Who owns the business's data:
As between the parties, Customer owns all intellectual property and other rights in Customer Data and Customer Materials provided to Atlassian or used with the Products.
- Atlassian (Confluence), Atlassian Customer Agreement, read 2026-10-12, Vendor keeps aggregated or anonymised use: The document is silent here; it was read in full on 2026-10-12, 63,733 characters long.
- Atlassian (Confluence), Atlassian Customer Agreement, read 2026-10-12, Training AI on the business's data: The document is silent here; it was read in full on 2026-10-12, 63,733 characters long.
- Atlassian (Confluence), Atlassian Customer Agreement, read 2026-10-12, Export at exit: The document is silent here; it was read in full on 2026-10-12, 63,733 characters long.
- Box, AI Acceptable Use Policy and Guiding Principles, read 2026-10-28, Who owns the business's data: The document is silent here; it was read in full on 2026-10-28, 11,915 characters long.
- Box, AI Acceptable Use Policy and Guiding Principles, read 2026-10-28, Vendor keeps aggregated or anonymised use: The document is silent here; it was read in full on 2026-10-28, 11,915 characters long.
- Box, AI Acceptable Use Policy and Guiding Principles, read 2026-10-28, Training AI on the business's data: The document is silent here; it was read in full on 2026-10-28, 11,915 characters long.
- Box, AI Acceptable Use Policy and Guiding Principles, read 2026-10-28, Export at exit: The document is silent here; it was read in full on 2026-10-28, 11,915 characters long.
- Box, AI Principles, read 2026-10-28, Who owns the business's data: The document is silent here; it was read in full on 2026-10-28, 10,937 characters long.
- Box, AI Principles, read 2026-10-28, Vendor keeps aggregated or anonymised use: The document is silent here; it was read in full on 2026-10-28, 10,937 characters long.
- Box, AI Principles, read 2026-10-28, Training AI on the business's data:
Box won’t train AI models using customer content without the customer’s explicit authorization (for example, if a customer wants to create a customized AI model based on some of their content, they will need to explicitly agree to allowing this application of AI to their content).
- Box, AI Principles, read 2026-10-28, Export at exit: The document is silent here; it was read in full on 2026-10-28, 10,937 characters long.
- Box, Terms of Service, read 2026-10-08, Who owns the business's data:
All Content uploaded by you into your account is yours!
- Box, Terms of Service, read 2026-10-08, Vendor keeps aggregated or anonymised use: The document is silent here; it was read in full on 2026-10-08, 501,031 characters long.
- Box, Terms of Service, read 2026-10-08, Training AI on the business's data:
Notwithstanding the above, Box will not train Box AI using your queries or outputs without explicit consent.
- Box, Terms of Service, read 2026-10-08, Export at exit:
You must make such request within fourteen (14) days following termination otherwise, any Content you have stored with the Services may not be retrievable and we will have no obligation to maintain Content stored in your account after this fourteen (14) day period.
- Dropbox, AI Principles, read 2026-10-28, Who owns the business's data: The document is silent here; it was read in full on 2026-10-28, 3,009 characters long.
- Dropbox, AI Principles, read 2026-10-28, Vendor keeps aggregated or anonymised use: The document is silent here; it was read in full on 2026-10-28, 3,009 characters long.
- Dropbox, AI Principles, read 2026-10-28, Training AI on the business's data:
We will not build generative AI models using customer content without consent.
- Dropbox, AI Principles, read 2026-10-28, Export at exit: The document is silent here; it was read in full on 2026-10-28, 3,009 characters long.
- Dropbox, Privacy Policy, read 2026-10-12, Who owns the business's data: The document is silent here; it was read in full on 2026-10-12, 22,284 characters long.
- Dropbox, Privacy Policy, read 2026-10-12, Vendor keeps aggregated or anonymised use: The document is silent here; it was read in full on 2026-10-12, 22,284 characters long.
- Dropbox, Privacy Policy, read 2026-10-12, Training AI on the business's data: The document is silent here; it was read in full on 2026-10-12, 22,284 characters long.
- Dropbox, Privacy Policy, read 2026-10-12, Export at exit: The document is silent here; it was read in full on 2026-10-12, 22,284 characters long.
- Dropbox, Terms of Service, read 2026-10-12, Who owns the business's data:
Your Stuff is yours. These Terms don’t give us any rights to Your Stuff except for the limited rights that enable us to offer the Services.
- Dropbox, Terms of Service, read 2026-10-12, Vendor keeps aggregated or anonymised use: The document is silent here; it was read in full on 2026-10-12, 29,973 characters long.
- Dropbox, Terms of Service, read 2026-10-12, Training AI on the business's data: The document is silent here; it was read in full on 2026-10-12, 29,973 characters long.
- Dropbox, Terms of Service, read 2026-10-12, Export at exit:
Once we suspend or terminate your access to the Services, you will not be able to access or export Your Stuff.
- Egnyte, MSP End Customer Agreement, read 2026-10-28, Who owns the business's data:
As between Customer and Egnyte, Customer or its licensors own all right, title and interest in and to the Content.
- Egnyte, MSP End Customer Agreement, read 2026-10-28, Vendor keeps aggregated or anonymised use: The document is silent here; it was read in full on 2026-10-28, 37,282 characters long.
- Egnyte, MSP End Customer Agreement, read 2026-10-28, Training AI on the business's data: The document is silent here; it was read in full on 2026-10-28, 37,282 characters long.
- Egnyte, MSP End Customer Agreement, read 2026-10-28, Export at exit:
Customer is responsible for exporting its Content prior to termination, and Egnyte shall have no obligation to retain Content beyond the termination date unless required under applicable law.
- Egnyte, Terms of Service, read 2026-10-28, Who owns the business's data:
As between Customer and Egnyte, Customer or its licensors own all right, title and interest in and to the Content provided, transmitted or processed through, or stored in, the Services.
- Egnyte, Terms of Service, read 2026-10-28, Vendor keeps aggregated or anonymised use:
Customer hereby grants Egnyte the right to transmit, use, modify, adapt, reproduce, display or disclose the Content solely (i) to provide the Services to Customer or any User, (ii) to comply with any request of a governmental or regulatory body (including subpoenas or court orders) or as otherwise required by law, (iii) for statistical use (provided that such data is not personally identifiable), and (iv) as necessary to monitor and improve the Services and corresponding support.
- Egnyte, Terms of Service, read 2026-10-28, Training AI on the business's data: The document is silent here; it was read in full on 2026-10-28, 43,067 characters long.
- Egnyte, Terms of Service, read 2026-10-28, Export at exit:
Within ninety days of termination of the Agreement for any reason, Egnyte will destroy all copies of Content that remain within Egnyte’s Services infrastructure.
- iManage, Terms of Service, read 2026-10-28, Who owns the business's data: The document is silent here; it was read in full on 2026-10-28, 24,272 characters long.
- iManage, Terms of Service, read 2026-10-28, Vendor keeps aggregated or anonymised use:
iManage may use usage information derived from the use of the Services (this does not include Your Content) to benchmark, develop and improve our services in locations globally and in accordance with our Privacy Notice.
- iManage, Terms of Service, read 2026-10-28, Training AI on the business's data: The document is silent here; it was read in full on 2026-10-28, 24,272 characters long.
- iManage, Terms of Service, read 2026-10-28, Export at exit:
We will provide you with reasonable advance notice via the email address associated with your account to remedy the activity that prompted us to contact you and give you the opportunity to export Your Content from our Services.
- Iron Mountain, InSight DXP: AI model training, security and compliance (whitepaper), read 2026-10-28, Who owns the business's data: The document is silent here; it was read in full on 2026-10-28, 15,473 characters long.
- Iron Mountain, InSight DXP: AI model training, security and compliance (whitepaper), read 2026-10-28, Vendor keeps aggregated or anonymised use: The document is silent here; it was read in full on 2026-10-28, 15,473 characters long.
- Iron Mountain, InSight DXP: AI model training, security and compliance (whitepaper), read 2026-10-28, Training AI on the business's data:
Iron Mountain utilizes a diverse range of data sources for AI model training, including the customer’s document repository, open-source data, internal data, and simulated data, based on the customer’s scope of work.
- Iron Mountain, InSight DXP: AI model training, security and compliance (whitepaper), read 2026-10-28, Export at exit: The document is silent here; it was read in full on 2026-10-28, 15,473 characters long.
- M-Files, General Terms and Conditions 2025 (United States), read 2026-10-28, Who owns the business's data:
Except for the license rights granted in this Agreement, as between Customer and M-Files , Customer retains ownership of all right, title and interest in and to all Customer Data.
- M-Files, General Terms and Conditions 2025 (United States), read 2026-10-28, Vendor keeps aggregated or anonymised use:
Customer acknowledges and agree that during the term of this Agreement and thereafter, M-Files may collect, analyze, copy, display and use Usage Data for the purposes of providing, operating, analyzing, and improving the Services and other M-Files products and services.
- M-Files, General Terms and Conditions 2025 (United States), read 2026-10-28, Training AI on the business's data:
Customer acknowledges that when Customer Data is run through the software and artificial intelligence models, such Customer Data teaches, trains, and improves the software, artificial intelligence models, and Services to Customer, and any such learning cannot be “unlearned”.
- M-Files, General Terms and Conditions 2025 (United States), read 2026-10-28, Export at exit:
During the Subscription Period and for thirty (30) days thereafter (the “Retrieval Period”), Customer may request a backup copy of the Hosted Data (defined in the Additional Software Service Terms), which M-Files will make available for Customer within thirty (30) days from Customer's written request on a medium or system to be determined by M-Files.
- monday.com, Terms of Service, read 2026-10-28, Who owns the business's data:
Customer retains all right, title, interest and control, in and to the Customer Data, in the form submitted to the Services.
- monday.com, Terms of Service, read 2026-10-28, Vendor keeps aggregated or anonymised use:
Notwithstanding any other provision of these Terms, we may collect, use and publish Anonymous Information (defined below) relating to, or generated by your use of the Services and/or Sites, and disclose it for the purpose of providing, operating, improving and publicizing our products and services, including the Sites and Services, and for other business purposes.
- monday.com, Terms of Service, read 2026-10-28, Training AI on the business's data: The document is silent here; it was read in full on 2026-10-28, 81,612 characters long.
- monday.com, Terms of Service, read 2026-10-28, Export at exit:
It is Customer’s sole liability to export the Customer Data prior to such termination or expiration.
- NetDocuments, Software as a Service Agreement (2025), read 2026-10-28, Who owns the business's data:
NetDocuments disclaims ownership of Intellectual Property rights in Customer Repository Data.
- NetDocuments, Software as a Service Agreement (2025), read 2026-10-28, Vendor keeps aggregated or anonymised use:
NetDocuments may use anonymized, aggregated Platform Data for benchmarking or other internal purposes, including generating reports regarding Service usage and customer data trends generally.
- NetDocuments, Software as a Service Agreement (2025), read 2026-10-28, Training AI on the business's data: The document is silent here; it was read in full on 2026-10-28, 76,123 characters long.
- NetDocuments, Software as a Service Agreement (2025), read 2026-10-28, Export at exit:
To the extent any Customer Repository Data remains on the ND Network 30 days after the termination or expiration of this Agreement (including any applicable Transition Period) NetDocuments may: (a) delete and permanently destroy all Customer Repository Data stored on the ND Network; or (b) at Customer’s request, charge Customer for the continued storage of Customer Repository Data at a rate equal to the Subscription Fees previously applicable to the relevant Order Form(s).
- pCloud, Terms and Conditions, read 2026-10-28, Who owns the business's data:
All User Content shall be owned by you or the person who made it available to you to store or upload via the Site or Services.
- pCloud, Terms and Conditions, read 2026-10-28, Vendor keeps aggregated or anonymised use: The document is silent here; it was read in full on 2026-10-28, 40,458 characters long.
- pCloud, Terms and Conditions, read 2026-10-28, Training AI on the business's data: The document is silent here; it was read in full on 2026-10-28, 40,458 characters long.
- pCloud, Terms and Conditions, read 2026-10-28, Export at exit: The document is silent here; it was read in full on 2026-10-28, 40,458 characters long.
- Progress ShareFile, ShareFile and Podio End User Agreement (15 Dec 2025), read 2026-10-28, Who owns the business's data:
Customer Content and Personal Data is and remains the property of Customer; except for a limited, non-exclusive, worldwide license to Company to provide any services or otherwise fulfill its obligations under this Agreement.
- Progress ShareFile, ShareFile and Podio End User Agreement (15 Dec 2025), read 2026-10-28, Vendor keeps aggregated or anonymised use:
Logs may be used for purposes not specified in this Section only in an aggregated, anonymized form.
- Progress ShareFile, ShareFile and Podio End User Agreement (15 Dec 2025), read 2026-10-28, Training AI on the business's data:
Customer Content is not used to train AI models that are used by AI Products.
- Progress ShareFile, ShareFile and Podio End User Agreement (15 Dec 2025), read 2026-10-28, Export at exit:
Company has no obligation to maintain Customer Content following termination of the Agreement except that, to the extent available, Customer shall have thirty (30) days to download Customer Content after termination and must contact Company technical support for download access and instructions.
- Smartsheet, User Agreement, read 2026-10-12, Who owns the business's data:
As between the parties, Customer retains all its right, title, and interest in and to Customer Content and Customer’s Confidential Information, and all intellectual property and proprietary rights therein.
- Smartsheet, User Agreement, read 2026-10-12, Vendor keeps aggregated or anonymised use:
Before any System Data generated or created from the processing of Customer Content is used for any purpose, Smartsheet will ensure such System Data has been aggregated, de-identified, or anonymized such that it does not identify Customer, any individual User, or any Customer-specific information, and cannot reasonably be used to re-identify any of the foregoing.
- Smartsheet, User Agreement, read 2026-10-12, Training AI on the business's data: The document is silent here; it was read in full on 2026-10-12, 89,923 characters long.
- Smartsheet, User Agreement, read 2026-10-12, Export at exit:
Upon Customer’s written request at the time of termination or expiration of any Term, Customer will be permitted read-only access to an Online Service for thirty (30) days following such date of termination or expiration for the sole purpose of downloading a backup copy of Customer Content.
- Sync.com, Terms of Service, read 2026-10-28, Who owns the business's data:
You own Your Data. You are solely responsible for maintaining and protecting Your Data.
- Sync.com, Terms of Service, read 2026-10-28, Vendor keeps aggregated or anonymised use: The document is silent here; it was read in full on 2026-10-28, 32,108 characters long.
- Sync.com, Terms of Service, read 2026-10-28, Training AI on the business's data: The document is silent here; it was read in full on 2026-10-28, 32,108 characters long.
- Sync.com, Terms of Service, read 2026-10-28, Export at exit:
IT IS YOUR DUTY TO RETRIEVE YOUR DATA PRIOR TO THE EFFECTIVE DATE OF TERMINATION OF YOUR ACCOUNT. UPON TERMINATION, YOUR DATA WILL BE SET FOR DELETION IN ACCORDANCE WITH OUR STANDARD RECURRENT DELETION PROCEDURE, WHICH MAY OCCUR AS EARLY AS 30 DAYS AFTER SUCH DATE OF TERMINATION.
- Wrike, Terms and Conditions, read 2026-10-28, Who owns the business's data:
Customer retains all rights to any and all of its Customer Data, subject to a non-exclusive, transferable, sublicensable, worldwide, royalty-free license to Wrike as necessary to provide the Service hereunder.
- Wrike, Terms and Conditions, read 2026-10-28, Vendor keeps aggregated or anonymised use:
The Aggregated Anonymous Data will be deemed Wrike’s proprietary technology, and Customer acknowledges that Wrike may use the Aggregated Anonymous Data, both during and after the Term; (i) for its own internal, statistical analysis; (ii) to develop and improve the Service; and (iii) to create and distribute reports and other materials regarding use of the Service.
- Wrike, Terms and Conditions, read 2026-10-28, Training AI on the business's data:
Wrike does not use Customer Data or permit others to use Customer Data to train the machine learning methods and data models underlying Wrike AI.
- Wrike, Terms and Conditions, read 2026-10-28, Export at exit:
Customer may not be able, or may have limited ability, to export Customer Data after deactivation of its Customer Account or conversion to a Free Customer Account and it is Customer’s sole liability to export the Customer Data from its Customer Account prior to cancelation, expiration, or termination of its paid-for Subscriptions or the Agreement.
Read and excluded
After reading, 4 named documents were excluded as off the board's subject; the reasons sit below. They count as read but give no answers.
- NetDocuments, Legal: an 883-character legal index page with navigation links and no terms text
- Laserfiche, Terms of Use: the stored read is only the website terms' table of contents (2,441 chars); the section bodies were not captured
- Laserfiche, Legal: a 1,028-character legal index page of links, no terms text
- Access (records management), Terms of Use and Privacy Policy: website terms of use and privacy policy covering visitors to accesscorp.com, not the records-management service customers store archives under; nothing on customer records
The method in full
Each vendor's own published terms were read through estate-fetch and stored whole (sha256 on every row).
For every document, four questions were answered from the vendor's own words: who owns the business's data, vendor keeps aggregated or anonymised use, training AI on the business's data, export at exit.
Every stated answer carries the sentence it rests on, checked against the stored text; 'not stated' means the document read does not address the question.
A vendor with several documents reads 'varies' where they disagree.
14 vendors, 19 documents.
1 named document has not been read and is excluded from the counts.
Where we looked (24)
- Box, Terms of Service (from the vendor's own published terms; reproduced for comment)
- Box, AI Principles (from the vendor's own published terms; reproduced for comment)
- Box, AI Acceptable Use Policy and Guiding Principles (from the vendor's own published terms; reproduced for comment)
- Box, Legal (not yet read)
- Dropbox, Terms of Service (from the vendor's own published terms; reproduced for comment)
- Dropbox, Privacy Policy (from the vendor's own published terms; reproduced for comment)
- Dropbox, AI Principles (from the vendor's own published terms; reproduced for comment)
- Egnyte, Terms of Service (from the vendor's own published terms; reproduced for comment)
- Egnyte, MSP End Customer Agreement (from the vendor's own published terms; reproduced for comment)
- iManage, Terms of Service (from the vendor's own published terms; reproduced for comment)
- NetDocuments, Service Agreement (2025) (from the vendor's own published terms; reproduced for comment)
- NetDocuments, Legal (read, set aside)
- M-Files Inc., Agreement Terms and Conditions 2025 (US) (from the vendor's own published terms; reproduced for comment)
- Progress ShareFile, End User Agreement (15 Dec 2025) (from the vendor's own published terms; reproduced for comment)
- Atlassian (Confluence), Customer Agreement (from the vendor's own published terms; reproduced for comment)
- monday.com, Terms of Service (from the vendor's own published terms; reproduced for comment)
- Smartsheet, User Agreement (from the vendor's own published terms; reproduced for comment)
- Wrike, Terms and Conditions (from the vendor's own published terms; reproduced for comment)
- pCloud, Terms and Conditions (from the vendor's own published terms; reproduced for comment)
- Sync.com, Terms of Service (from the vendor's own published terms; reproduced for comment)
- Laserfiche, Terms of Use (read, set aside)
- Laserfiche, Legal (read, set aside)
- Iron Mountain, InSight DXP: AI model training, security and compliance (from the vendor's own published terms; reproduced for comment)
- Access (records management), Terms of Use and Privacy Policy (read, set aside)
Reference or embed these figures
8 of 14 document management software vendors whose terms we read reserve the right to use their customers' data in aggregated or anonymised form, read 28 October 2026.
Who owns the business's data, by vendor: the business 12 of 14, not stated 2 of 14 (document management software terms, read 28 October 2026).
Vendor keeps aggregated or anonymised use, by vendor: reserved 8 of 14, not stated 6 of 14 (document management software terms, read 28 October 2026).
Training AI on the business's data, by vendor: not stated 8 of 14, will not train 4 of 14, may train 2 of 14 (document management software terms, read 28 October 2026).
Export at exit, by vendor: a number of days 5 of 14, no export promised 5 of 14, not stated 3 of 14, on request 1 of 14 (document management software terms, read 28 October 2026).
Citation: "Document management software data terms", updated 2026-10-28, https://sellcompanyarchivetoai.com/datasets/document-management-software-data-terms/.
Download as CSV (76 answers, worked out 2026-10-28)