Spellbook

Spellbook explicitly states that customer data transmitted to third-party LLMs is NOT used to train those models, and they have opted out of all available training options. This is a strong, clear commitment protecting enterprise data from being used for model improvement.

“[ToS] 'No Third Party LLM Model Training. Customer Data transmitted by Spellbook to Third Party LLMs is not used to train the AI models of those Third Party LLMs. Spellbook has opted out of (and will opt out of) all available options to do so.'”

While Spellbook retains ownership of outputs and grants customers ownership of their inputs, the license granted to Spellbook is broad (non-exclusive, royalty-free, worldwide) and permits use, copy, store, modify, distribute, transfer and display. The license is limited to providing the service but the scope of permitted uses is somewhat expansive.

“[ToS] 'Customer grants to Spellbook a non-exclusive, royalty-free, worldwide license to use, copy, store, modify, distribute, transfer and display Customer Data solely for the purpose of providing the services of the Spellbook AI Platform to Customer.'”

Spellbook explicitly restricts third-party sharing to essential infrastructure providers under data processing agreements. They maintain a published subprocessor list, do not share with advertising networks or data brokers, and confirm customer data is not visible to other customers. This is enterprise-friendly.

“[ToS] 'Customer Data stored and processed for a Customer and its Users will not be visible or accessible to other Spellbook customers or other third parties (except for Spellbook's listed data subprocessors for specified purposes as per section 4.3(a) below).'”

While Spellbook states data is processed only as necessary and for specified purposes, retention periods are not explicitly defined in the ToS. Abuse monitoring data is retained for up to 30 days, but general data retention timelines and deletion procedures upon account termination are not clearly detailed.

“[ToS] 'Spellbook may collect, retain for up to 30 days (or longer if required for ongoing investigations or legal compliance), and use Customer Data (including Inputs) to detect and prevent malicious, abusive, or illegal activity.'”

Spellbook explicitly states that customers own all outputs generated by the platform. Spellbook retains no rights to outputs and customers can use them for any purpose, including commercial use. This is clearly favorable to enterprises.

“[ToS] 'As between the Parties, the Customer owns: (i) all Customer Data uploaded by Customer or its Users to the Spellbook AI Platform; and (ii) all Outputs.'”

Spellbook explicitly claims SOC 2 Type II and HIPAA compliance, maintains a published security trust center at https://trust.spellbook.legal/, and provides detailed data security protocols and subprocessor information. These are strong compliance credentials.

“[ToS] 'Spellbook maintains a data security trust center available at https://trust.spellbook.legal/, which (i) sets out all of Spellbook's data security protocols, (ii) provides information on the data processing commitments of the LLMs used by Spellbook, and (iii) provides a list of Spellbook's data subprocessors and related processing purposes.' Footer indicates 'SOC 2 Type II' and 'HIPAA' compliance.”