// TECHNOLOGY
Where is your data processed? Mapping the whole chain
7 min readnijitech
“Our data is in Europe” usually describes the first link in the chain. The real question is who that link depends on. A practical way to build a processing inventory.
Full post
One of the most common questions in a procurement conversation is “where is our data processed?” The most common answer is a single sentence — a region name. That answer is usually true and usually incomplete, because it describes only the first link in the chain.
An AI product does not run on a single server. The model provider, object storage, email delivery, error tracking, analytics — each is a separate link that can touch the data. Building an inventory amounts to writing those links down one by one.
1. A region is not a company domicile
A service running in the Frankfurt region does not change which country’s law the company operating it answers to. These are two separate questions and contracts often use one in place of the other. The right question is: where does the data physically sit, and in which country is the legal entity with access to it established?
2. A subprocessor list has to be a document
A provider list recited verbally means nothing in an audit. What matters is the subprocessor list published as an exhibit to the data processing agreement: which company, for what purpose, in which region. If that list does not exist, the next question is why.
3. Logs, backups and support access
These are the three most frequently skipped items. The main database can sit in the right region while error tracking records travel to another continent; backups may live with a different provider; the temporary copies a support team makes to solve a problem may not be written down anywhere.
What belongs in the inventory
- Primary data store — which region, which provider
- Backups and snapshots — where, how often, retained how long
- Logs and error tracking — do they contain personal data?
- Model calls — what goes inside the prompt, does the provider retain it?
- Support access — who, under what circumstances, is it logged?
4. A model call is a transfer too
A prompt sent to an external model provider is a data transfer if it carries a customer name or a contract detail inside it. A "we do not store it" commitment does not change that; the transfer itself has happened. In the inventory that line matters as much as the database line.
The practical consequence: trimming what you put in the prompt lowers your transfer surface as well as your cost. Data you do not send is data you do not transfer.
What running on your own hardware changes
Running the infrastructure on your own hardware shortens the chain but does not remove it — the backup target, the update source and remote access still look outward. What changes is who decides about each of those links. That is a claim about control, not a claim about security.
In short
Four questions for a provider
- Where is your subprocessor list published in writing?
- Are logs, backups and support access included in it?
- What leaves the system in a model call, and how long is it retained?
- How are we notified when the list changes?
If all four have a written answer, the claim can be verified. If they do not, you have a claim and no verification.
From the glossary: EU data residency · End-to-end encryption