When we use an AI agent, where does my company's data go, and can it stay in my country?
The short answer
Whatever the agent reads is sent to the model to be processed. Unless you run the model yourself, that means it goes to the company that runs the model, and is processed and often stored wherever that company does it. Some providers now let business clients choose the region. Whether that is enough depends on which of your data is sensitive, and on the law in your country and your sector.
What actually leaves your company
To answer a question, the agent first reads your data: a contract, an invoice, a client’s history. To think about it, it sends what it read to the model. If the model runs at a provider, that text travels to the provider’s servers and is processed there.
Your own connection does not change this. At OdooTec we built our own connector to our ERP system and run it on our own server. That decides what the agent is allowed to read. It does not decide where the model processes what it read.
Three questions, not one
“Where is our data?” is really three questions:
- Where is it processed? The place where the model reads it and writes the answer.
- Where is it stored, and for how long? Conversation history, uploaded files and records the provider keeps.
- Is it used to train the provider’s models? Some major providers state that the data of their business products is not used for training by default. Consumer products can have different terms. Read the terms of the exact product you use, not the provider’s general promises.
Not all your data is the same
Sort your data before you choose a product:
- Personal data about people, such as employees and clients. Many countries have data protection laws, and many of them limit sending this data abroad.
- Data your sector regulates, such as banking, health or government work, which may carry stricter rules of its own.
- The rest of your business data. Here the decision is about your own appetite for risk.
Your options
- Choose a product that keeps the data where you need it. Some providers now offer business clients a choice of region. Check whether that choice covers processing, or only storage.
- Keep the most sensitive data out of the agent’s reach. If the agent’s account cannot read it, it never leaves.
- Run a model yourself, on your own servers or in a cloud region you choose. Openly available models make this possible, and the gap between them and the leading closed models has narrowed. The price is that you run, secure and maintain it yourself.
The question to ask your team
“For each kind of data the agent will read, where is it processed, where is it stored, and for how long?” If the answer is the same for every kind of data, nobody has sorted the data yet.
I am not a lawyer. The rules on sending data abroad differ by country and by sector, so ask a lawyer about yours.