If a customer has signed data processing terms, sending records to a model vendor may or may not be covered; this must be clarified before building, and when not covered, options include zero-retention vendor terms, specific processing regions, self-hosted models, and stripping sensitive fields before calls.