Is Perplexity Safe for Confidential Information? Free, Pro, Max, Enterprise, the API and Comet

Is Perplexity safe for confidential information? Not on Free, Pro or Max by default: the AI data retention setting is on, so your data can train Perplexity's models until you turn it off, and uploaded files are kept for 30 days. Enterprise Pro and Enterprise Max state no training and shorter file retention. The API does not train on customer content, but zero data retention needs a written agreement.

Perplexity is no longer one product. The answer engine at perplexity.ai and in the mobile apps comes in Free, Pro and Max plans for individuals. Perplexity Enterprise, sold as Enterprise Pro and Enterprise Max, adds an organisation, administrators and a different data policy. The API platform serves developers. Comet is a browser with an assistant that can act on web pages, and Perplexity Computer is an agent that carries out multi-step work across connected tools. Each has its own data practices, and one more party is always involved: the outside model providers that answer many of the queries.

Our reading date for every Perplexity page cited here is 14 November 2026. We used the privacy notice, the help centre’s privacy and data articles, the pricing page, the API documentation and Perplexity’s own post about Comet, and we give each page’s “last modified” date where it shows one.

Perplexity plans compared: training, retention and controls

“Not described” means what it says. Perplexity’s public pages do not state whether staff can read consumer or Enterprise conversations, or under what conditions. Ask before you sign.

Is Perplexity safe to use on Free, Pro or Max?

For public-interest research, yes. For anything your employer or clients would call confidential, the consumer plans have four problems.

Training is on by default. The help centre article on data collection, last modified on 31 August 2026, states that for Free, Perplexity Pro and Perplexity Max users, AI Data Retention is enabled by default. Paying for Pro or Max changes the limits and the models. It does not change this setting.

The privacy notice is broad. The notice, last updated on 23 October 2026, lists improving and creating services and products, its AI models included, among its purposes. It also describes sharing data with third parties to measure advertising. It says personal data is kept only as long as necessary, without giving a period, and that data may be processed in other countries, including the United States, with standard contractual clauses for transfers out of the EEA and UK.

Deletion is tied to the account. The retention article says personal information is kept as long as your account is active and removed from Perplexity’s servers within 30 days of account deletion. You can delete individual threads yourself.

Your employer has nothing. There is no data processing agreement between Perplexity and your organisation for a personal account, and no admin console or audit record. Nor does the notice apply to Enterprise and API data, which have their own terms.

Does Perplexity train on your data? How to switch it off

Perplexity documents the opt-out in five steps:

1. Open your Account settings.
2. Go to the Preferences page.
3. Find the AI data retention toggle.
4. If it is on, your data is being collected for AI training.
5. Switch it off.

The same article lists the limits, and they are stricter than on some rival services:

• The opt-out covers only data collected after you switch it off.
• Training data collected earlier cannot be deleted or removed.
• The setting belongs to the individual user; one person’s choice does not cover a team.
• Data may still be processed for running the service, legal compliance and product improvement.

Incognito is the per-session alternative. The privacy notice says it avoids saving your search activity across sessions, and the help centre says incognito sessions expire within 24 hours and cannot be recovered. That limits what sits in your library. It does not turn Perplexity into an offline tool: the query still goes to Perplexity and on to a model provider.

One more trap is the downgrade. Perplexity says that if an organisation moves from Enterprise to a Free or other non-Enterprise plan, the account falls back to the consumer policy with AI data retention on by default, and the opt-out has to be made by hand.

Is Perplexity AI safe for files and uploads?

Uploads are where confidential material most often ends up, so the retention rules are worth knowing exactly. From Perplexity’s file upload article:

After the period ends, the file can no longer be used for follow-up questions, but earlier answers keep whatever they drew from it. Deleting a session deletes its attachments. Immediate deletion from a session, project or organisation goes through a request form.

Sharing is the sharper risk. If a session is public, anyone with the link can see the files and images in it. Perplexity’s advice is to keep the session private, or to export the answer as a PDF when you want to share the text without the attachments. Enterprise administrators should note one dated change: the organisation file repository is being retired, and Perplexity told customers to download its contents by 1 October 2026.

Which model providers see your Perplexity queries?

Perplexity routes many queries to models built by other companies. Its help centre answers the obvious question directly: its agreements with third-party model providers such as OpenAI and Anthropic prohibit them from using Perplexity data to train their models. That article was last modified on 14 September 2026.

The stronger commitment is reserved for organisations. For Enterprise Pro and Enterprise Max, Perplexity states that it holds zero data retention and zero data training agreements with its AI providers. The consumer wording promises no training; it does not promise zero retention at the provider.

For a risk assessment this means the data flow has at least three parties: your user, Perplexity, and whichever provider serves the selected model. The Trust Center lists the subprocessors. If your AI acceptable use policy names approved vendors, a Perplexity approval is an approval of that chain.

Is Perplexity Enterprise safe?

For most confidential business data, Enterprise is the tier to use, with some terms to pin down in the contract.

What Perplexity states plainly:

• No training. Enterprise customers’ data is never used or retained for training AI models, and a lapsed subscription does not change that.
• Shorter file retention. Files attached to sessions are deleted after seven days.
• Provider agreements. Zero data retention and zero training agreements with AI providers cover Enterprise data.
• Sign-in and assurance. Single sign-on through your identity provider is included, and Perplexity says it has a SOC 2 Type II report, available through its Trust Center.
• Session retention. Administrators can set a retention period under Organization Settings, in the Data and privacy section, where they can also enforce incognito mode. Sessions older than the period become inaccessible at once and are permanently deleted within seven days. The clock runs from a session’s last activity, so a scheduled task that updates a session keeps it alive.

Where the documents disagree:

• The help centre says custom retention is open to organisations with 50 or more seats or at least one Enterprise Max seat.
• The pricing page, read the same day, marks SCIM, data retention configurability, audit logs, role-based access control and a separate Enterprise domain as “Contract required” for both Enterprise Pro and Enterprise Max, and lists them under a custom-priced security tier.

So do not assume audit logs or directory sync from the plan name. Get each control into the order form. The pricing page also claims compliance with SOC 2 Type II, HIPAA, GDPR and PCI DSS. Those are Perplexity’s statements. The API documentation is more specific about what exists on paper: a SOC 2 Type II report and a 2025 HIPAA gap assessment. If you handle health data, ask whether a business associate agreement is offered and get it signed first. For EU personal data, our guide to GDPR questions for AI tools lists what to request from any vendor.

Is the Perplexity API safe? Zero data retention is not the default

Older write-ups describe the Sonar API as zero retention by default. Perplexity’s current API privacy page says otherwise, in these words: “Zero Data Retention is not default”.

What the page states today:

• No training by default. Under the API terms of service, Perplexity does not use customer content to train generative AI models. Some APIs carry product-specific terms.
• ZDR by agreement only. It is available to eligible customers through an account-level configuration under a written agreement. Without it, the page tells you not to assume that Perplexity or its model providers apply zero retention.
• Not every model qualifies. Where ZDR is enabled for an Agent API account, only models whose providers support it can be used, and requests to other models return an error.
• Third-party terms apply. Some providers require limited retention as a condition of offering their models.
• Metadata is kept. Request and token counts, the model, timestamps, duration and the API key are collected to run and bill the service.

Personal data is processed under Perplexity’s data processing addendum. The page does not say where inference runs. If location matters to you, get the answer in writing; our zero data retention explainer lists what a ZDR clause should cover.

Is the Comet browser safe? Assistants, agents and prompt injection

Comet changes the question, because the assistant is no longer limited to what you paste. It can read the page you are on and act in sites where you are signed in.

Perplexity’s description of the data flow, from its Privacy Snapshot post of 31 October 2025 and its privacy notice:

• Credentials such as passwords and card details are stored locally on your device, and Comet keeps browsing data, site permissions and download records locally.
• When you ask the Comet Assistant a question, some data, such as your open tab and relevant browsing history, is transferred to Perplexity to complete the task.
• Queries Comet classes as personal are deleted from Perplexity’s databases in 30 days.
• With a synced Perplexity account, and depending on your settings, Perplexity records browsing history and tracks use and engagement.
• You can block the assistant on specific websites or turn off its ability to interact with sites and read history.

The security question is indirect prompt injection. On 20 August 2025, Brave published research showing that Comet passed web page content to its model without separating it from the user’s instructions. In Brave’s demonstration, hidden text in a Reddit comment made the assistant, asked only to summarise the page, find the user’s email address, trigger a one-time password and read it from the user’s Gmail. Brave reported the issue on 25 July 2025, and Perplexity shipped fixes. An update to Brave’s post says later testing found the class of attack was still not fully mitigated, and that it was reported again.

The same logic applies to Perplexity Computer and to connectors. An agent that can read your mail, files or company apps will also read whatever an attacker places in them. The Email Assistant has one clear rule: Perplexity says it does not use email content to train or fine-tune AI models. Our prompt injection prevention guide covers the defences that work at the organisation level.

Perplexity at work: a checklist for staff and IT

If you use Perplexity for work:

1. Use the organisation’s Enterprise workspace if there is one. Do not mix it with a personal account.
2. On a personal plan, switch off AI data retention before anything else, and remember it does not reach back.
3. Do not upload contracts, client files, source code or personal data to a consumer session. If you must test with a document, delete the session afterwards.
4. Check that a session is private before you paste its link anywhere, and share a PDF export instead when attachments are involved.
5. In Comet, block the assistant on banking, email, HR and admin sites, and do not ask it to summarise pages you do not trust while signed in to sensitive accounts.

If you run IT or security:

1. Decide whether Perplexity is approved, and for which data classes, and say so in writing.
2. For Enterprise, get SCIM, audit logs, retention settings and role-based access control named in the contract; set session retention and consider enforcing incognito mode.
3. For the API, sign the data processing addendum and, if required, a written zero data retention agreement; restrict use to models that support it.
4. Review each connector and each agent permission before enabling it, starting read-only.
5. Treat Comet as software to be approved, not a personal preference. Unapproved browsers and personal AI accounts are the usual gap.

The same questions come up for every assistant. We answer them for ChatGPT, Claude, Gemini and Microsoft Copilot in separate guides.

When Perplexity is not the right tool for the data

Perplexity is a hosted service that depends on other hosted services. An Enterprise contract can make that an acceptable processor chain for most business information. It cannot satisfy a rule that says the data never leaves infrastructure you control, and no Perplexity plan offers an on-premises deployment.

For that class of data the choice is a model you host, with retrieval over your own documents, behind your own access controls. Our private versus public LLM comparison covers the trade-offs, including what you give up in live web search.

How VDF AI fits

VDF AI does not run, host, resell or integrate with Perplexity, Comet or the Perplexity API. It is a separate, self-hosted platform for chat, retrieval over company documents and governed agents, deployed on-premises, in a private cloud or air-gapped, with conversation history and audit records held in the organisation’s own storage.

Where Perplexity answers from the public web, VDF AI Chat answers from sources the organisation connects, with retrieval that respects each source’s permissions and a model assigned per agent. VDF AI Router registers on-premises models and has an air-gap mode that restricts routing to them. Role-based access control applies on every plan. The two can sit side by side: public research in an approved cloud tool, confidential documents on models you run. To discuss your case, contact us.