Is Kimi K3.1 Pro Safe? Data, Training and Where It Is Stored

Short answer: Kimi K3.1 Pro is a strong model with a privacy question attached, and the question is not about the model. It is about which Kimi you use. In the chat app, Moonshot’s privacy policies say what you type can be used to train its models, and there is no in-app switch to stop that. Through the API, Moonshot says Zero Data Retention is available. Those are very different deals for the same model.

Moonshot AI released K3.1 Pro on 23 October 2026. This post sticks to Moonshot’s announcement, its two published privacy policies and launch coverage, and says plainly where those stop. We have not tested the model, and nothing here is legal advice.

What Kimi K3.1 Pro is

K3.1 Pro is a post-trained upgrade of Kimi K3, which Moonshot released in July, and the first model in a new K3.1 series. It has a context window of a million tokens, and a faster sibling, K3.1 Pro Highspeed, ships alongside it. The Decoder reports that it placed fourth on the Artificial Analysis Intelligence Index, and that API prices fell by a third, to $2 per million input tokens and $10 per million output tokens. The Kimi API platform lists the same US-dollar prices.

At launch it is in the Kimi website and mobile apps, the Kimi Work desktop app, Kimi Code and the API. Moonshot says the full model weights will be published by 4 November 2026. Until then, the only way to use it is on Moonshot’s own servers, and that is where the privacy policy starts to matter.

What the privacy policies say

There are two. The launch post links to the kimi.ai privacy policy, last updated 13 August 2026, whose operator is named as NOVASCENT PRIVATE LIMITED. The kimi.com privacy policy, effective 31 August 2026, is issued by Beijing Moonshot Technology Co., Ltd. Read the one for the site you actually sign in to.

• —Training. The kimi.ai policy says user content is used for purposes including training and optimising its AI. The kimi.com policy says input and output are used to optimise its models after de-identification.
• —Opting out. Neither policy describes a setting for this. The kimi.com policy says that if you do not want your content used for training, you contact customer service. The kimi.ai policy points to its privacy contact for withdrawing consent.
• —Storage. The kimi.ai policy says your information may be stored on servers outside your country of residence, without naming the country. The kimi.com policy says personal information is stored within the People’s Republic of China.
• —Retention. Both say data is kept only as long as necessary, with no fixed period for chats.
• —Regional rules. The kimi.ai policy has a section for US residents. We found no section for the EU, the UK, Japan or Korea in either text.

None of that is unusual for a consumer chatbot, and it is not proof of misuse. It does mean the default for the app is that your conversations can feed the next model. If you would not paste a document into a public forum, do not paste it into a consumer chatbot whose training opt-out is an email.

The API and business plans are a different deal

Moonshot’s launch post says Zero Data Retention is available for API customers, and that in Kimi Enterprise the new model is switched off by default until an administrator turns it on. Kimi Business accounts are described as having enterprise-grade data privacy, with personal and organisation accounts kept separate. The post does not link the terms behind any of this, so a company should get the data terms in writing before relying on them.

There is a third route coming. Once the weights are out, anyone can run the model on hardware they control, and then Moonshot’s policies do not apply at all. Meta’s open release raised the same trade-off, covered in is Muse Spark Open safe, and so did the small open coding model in Recursive Flint.

The safety work Moonshot does describe

Moonshot says it removed cyber-related data from both mid-training and reinforcement learning, so that the open weights would not push the frontier of hacking ability. On its own vulnerability test, a checkpoint without that filtering solved 90.5% of tasks, against 81.0% for the released model. SiliconANGLE adds that its scores on public cyber benchmarks trail GPT-6 Astra and Claude Opus 5.5. Google took a different route with its frontier model, releasing it to vetted defenders first, as is Gemini 4 Argon safe explains.

It also reports fewer made-up claims on an internal stress test, down from 23.4% for K3 to 8.3%, and says plainly that those rates do not represent everyday error rates. That caveat is worth keeping. A model that is wrong less often is still wrong sometimes, and how to check an AI answer when you are not the expert is the habit that covers it.

What the launch post does not say

• —No system card or model card for K3.1 Pro, and no licence name for the coming weights.
• —Which privacy policy applies to which app, if you use both kimi.ai and kimi.com.
• —How long API requests are kept when Zero Data Retention is not switched on.
• —Whether conversations in Kimi Work or Kimi Code are treated differently from chat.

A practical way to use it

1. 01Try it in the app with public material only: published reports, your own non-confidential drafts, open code.
2. 02For anything a client, employer or patient would not want shared, use the API with Zero Data Retention confirmed, a business plan with written data terms, or wait for the weights.
3. 03If your company has an AI policy, check whether it covers models from this vendor before you sign in with a work account.
4. 04Compare it against the open models you can already run. Is Mistral Large 4 safe covers a European open-weight option with its own preview terms.

Coursium is a mobile app that teaches people to use AI at work, and it is on the App Store. Models like K3.1 Pro will keep arriving every few weeks. Knowing what a privacy policy actually says, choosing the right way in and checking the output carry over to whatever ships next. If that is what you want to practise, have a look at Coursium.