An admin is reviewing how Agentforce and Prompt Builder handle a user's request. A prompt template includes CRM record data through grounding, sends the request to the large language model (LLM), and returns a generated answer. The compliance team asks the admin which part of the Einstein Trust Layer ensures that the data sent to a third-party LLM is NOT stored or used to train the external model. Which capability should the admin point to?