Data retention policy
Amex Expense holds customer data while the customer maintains an active service relationship with American Express. Retention periods, including any extensions, are set out in the customer's service agreement and American Express privacy terms.
Data archiving and removal policy
Customer data is removed at the close of the service relationship, on the schedule set in the customer's service agreement. Removal is subject to the record-keeping obligations American Express must meet as a regulated financial institution.
Data storage policy
Customer data handled by Amex Expense resides in infrastructure operated by American Express, encrypted in transit and at rest, with access limited to the systems and staff needed to deliver the service. Storage terms are in the service agreement.
App/service has sub-processors
yes
Guidelines for sub-processors
App/service uses large language models (LLM)
yes
LLM model(s) used
Google Gemini, accessed through Google Cloud Vertex AI.
LLM retention settings
Prompts and responses serve only the user's immediate request. The model provider does not retain them for training or model improvement, and Amex Expense does not train or tune models on customer data. Evaluation uses non-production datasets.
LLM data tenancy policy
Each request is processed within a single customer organization. Conversations and expense records are scoped to one organization and one authorized user, and every retrieval uses that user's own credentials. Customer data never trains or tunes models.
LLM data residency policy
American Express stores Amex Expense data in its own United States infrastructure. Model inference is performed by Google Cloud Vertex AI over a private network connection rather than the public internet, and is not routed outside the United States.