How to test if an AI vendor keeps your data: plant a unique canary string, delete it with the vendor's own controls, then search exports, logs and memory.