Skip to content
A closed bank vault door in a dark basement, a thin line of light along its edge.

Data Privacy & Residency

Your data stays where your contract says

Most AI rollouts start by sending data out. You choose the vendor, model and region, and the contract decides.

Book a readiness reviewAI Security
  • Vendor, model and region chosen against your contract
  • Self-hosted weights where the contract requires it
  • Personal data refused before it reaches a prompt
  • One process, whichever option you choose

Example record

What your boundary caught

Each prompt is checked before it leaves your network. You see what went out and what stayed.

Each refusal is logged with the rule that caught it.

prompt checks · outboundSample log

  • Support ticket summary

    no personal data found

    Sent

  • Ticket containing a card number

    credential-shaped string

    Refused

  • Call to an unpinned region

    outside the contract region

    Refused

  • Batch to the self-hosted model

    stays on your infrastructure

    Sent

Where data leaves without anyone deciding

Data rarely leaves through a decision. It leaves through a default nobody revisited.

  • A provider default that retains prompts

  • A test environment wired to a production key

  • A document pasted into context with a customer name in it

  • A region chosen by whoever set up the account

Capabilities

Where your boundary sits

So your security team reviews it like code, in your repository.

01Provider and region pinnedThe contract names a region. The configuration holds to it, and a call outside it is refused.
02Self-hosted weightsOpen-weight models on your infrastructure where the contract rules out a hosted API.
03Context checked on each promptCredential-shaped strings and personal data caught before they enter the model.
04Retention set by youZero-retention terms where the provider offers them. Logs stay on your side.

Model

What we fix, and what you decide

What we fix

  1. F1Data rules written down before a prompt is sent
  2. F2Checks on each prompt, configured in your repository
  3. F3Refusals logged with their reason

What you decide

  1. C1Vendor, model and region
  2. C2Hosted API or self-hosted weights
  3. C3Which data classes may enter a prompt

Related

Where to go next

Next step

Tell us where your data has to stay.

We map what leaves today. You get a list of changes your legal team can check against the contract.

Book a readiness review →