Where your data goes once you send it to an AI model
The important question about an AI application is not which model you use, but which data leaves your system. And what happens to it there.
The important question about an AI application is not "which model", but "which data leaves our system, and who can reach it". That question has a technical answer and a legal one, and you need both.
When an application sends a question to a language model, it sends everything in the prompt along with it. That includes the source material you added so the model would answer precisely. A customer's name, a contract number, the body of an email.
Plenty of companies notice this only when an auditor asks.
What actually leaves your system
Not the whole database. What leaves is exactly what you put in the prompt — and that is a matter of design, not chance. The difference between "send the entire customer record" and "send the three fields the model needs" is one you make, not the model provider.
So it is worth knowing where the prompt is assembled, and having a single place it passes through. When prompt construction is scattered across an application, "what do we send out" cannot be answered except by searching the code.
Three things to check with the provider
- Whether your inputs are used for training. Business and API terms commonly differ from consumer ones here. Do not assume; check the terms of your own contract.
- Where processing physically happens. Some providers can confine it to European regions, others cannot. Transfers outside the EU carry their own rules.
- How long inputs are retained. There is usually some window for abuse monitoring and security, even where data is not trained on.
These are contractual questions, not technical ones. The answers belong in a processor agreement, not in API documentation.
What can be done technically
Quite a lot — and it is cheaper than dealing with it later:
- Stripping sensitive fields before anything is sent. A model does not need a national ID number to summarise a complaint.
- Separate environments. Test traffic has no business touching live data. That single step heads off a large share of the trouble.
- Logs without prompt bodies. Logging the full prompt is convenient while debugging, and it is also a second copy of personal data somewhere nobody expects one.
- Encryption in transit and at rest, with access granted only where it is needed.
Where our work ends and a lawyer's begins
We can design and deploy the technical measures. Judging whether a particular processing activity has a legal basis, which one, and whether it needs an impact assessment belongs to your lawyer — and that holds even when the answer looks obvious. We prepare what they need to decide: what is processed, where it goes, how long it is held.
Related to this is the question of where not to deploy AI at all. Sometimes the cheapest safeguard is not using a model for that particular task. If you are weighing up the operation as a whole, see what AI application hosting involves, or simply get in touch.
Are you solving something similar in your company?
I want a free consultation