Where does your data go when you use AI?
Europe, France or your own premises: where an AI agent processes your data, what processing in France really costs, and what to require in writing.
"Does our data go to the United States?" It is often a business leader’s second question, after the price. The answer depends on specific choices, which should be made with full knowledge of the facts.
Where your data goes
When an AI agent processes an invoice, an email or a customer request, the data goes through:
- the AI model, which reads and understands the text;
- the hosting of the agent and its records;
- monitoring and backup tools;
- your own tools, where the agent acts.
Many solutions go by default through services located outside Europe. It is not illegal (the GDPR governs these transfers), but it is a choice that should be made knowingly.
The three possible levels
| Level | Your data | What it implies |
|---|---|---|
| European | does not leave Europe | European or open AI models, hosted in the European Union |
| France | does not leave France | models and hosting in France, the whole chain checked, a written commitment |
| In-house | does not leave your premises | dedicated infrastructure, to be studied and priced before any quote |
What you really pay for to stay in France
Not a change of model: changing AI supplier is simple. What takes work, and has value, is checking the whole chain end to end (logs, backups, monitoring tools included), then providing a written commitment on where the data is located, re-checked every year.
Using a French model is not the same as guaranteeing that nothing leaves the country. That difference is what you pay for.
Who needs it?
- Professions bound by professional secrecy (lawyers, healthcare, accountancy depending on the case): the requirement goes beyond the GDPR.
- Companies whose customers require it, in a security questionnaire or a tender.
- Any business leader who chooses it: it is their right, and it should be priced clearly.
What to require in writing
A "where your data goes" page, before signing, attached to the proposal or the contract:
- where each processing operation takes place;
- which providers are involved;
- how long the data is kept;
- what never leaves.
And if, for a specific task, the right tool is outside the European Union: an exception in writing, justified and approved by you, stating for this task what leaves, where, and why.
What we do
By default, everything we put into service uses European or open AI models, hosted in the European Union, at no extra cost. Processing in France is an option, priced in your quote together with its annual check: it can be added to a Task Automation, a Process Agent, Business Agents or a Company Brain. Processing on your premises is subject to a study, with the Process Agent, Business Agents and the Company Brain. The details: Sovereignty.
The GDPR side is covered in AI and the GDPR: what to check.