About and methodology

CanWeUseIt.ai answers one question for IT and security teams: can our people use this AI tool for work, and if not, how do we stop them?

Rules we follow

  1. Vendor sources only. Every fact links to the vendor's own policy, help center or documentation page. We don't cite news articles or third-party blogs as evidence.
  2. Dated. Every fact shows the date we last checked it.
  3. Never guess. If we can't verify something from a vendor page, we mark it Unknown. Unknown doesn't mean “no”.
  4. Per plan. Free and Enterprise tiers of the same product often have opposite answers, so we track each plan separately.
  5. Enforcement first. For each tool we document how to allow only your company tenant (header injection, for example), what to block, and which admin-console or MDM switch applies.

Field definitions

Trains on your data?
No: not used for training by default. Yes – opt-out: used by default, but the user or admin can turn it off. User's choice: the user is asked. Yes: used, with no documented opt-out.
Retention
How long prompts and outputs are kept, as the vendor states it.
SSO / SCIM
Whether that plan includes SAML/OIDC single sign-on or SCIM provisioning.
Audit logs
Whether admins get a log of user and admin activity for that plan.
Data residency / DPA
Documented regional processing or storage commitments, and whether a Data Processing Addendum is offered.

Change detection

A script fetches every source URL, normalizes the text, hashes it (SHA-256) and compares it with the previous run. A changed hash flags the page for human review. The tracker itself is only updated after someone has read the change.

Corrections

Found something wrong or out of date? A corrections address is coming soon. Until then, please treat this site as a starting point and confirm against your vendor contract.