Where is our data stored, and who can see it?

A prospect asked me this twice in the same meeting. Where is our data going to be stored if we were to work with you? Then, twenty minutes later, okay, data privacy, where is our data going to be stored?

Asking twice means I answered badly the first time. So I rebuilt the answer.

The short version

Your data sits in infrastructure you own or rent, in a region you choose, under an account with your name on the invoice. Not mine. If our relationship ended tomorrow you would keep everything without needing my cooperation.

The part people are really asking about

The worry is almost never the database. It is the AI. Somebody put it to me directly: if you give all your CRM data to something like OpenAI, what can anybody do about that?

It is a good question and the answer has changed as the industry has matured. Business API tiers from the major providers do not train on your data by default, and enterprise agreements make that contractual rather than a setting. That is different from a consumer chat app, where the terms are not written for you.

What matters more is design. A well-built system sends the model the minimum it needs to do the job and nothing else. If a tool needs to summarise one order, it does not need your customer list.

What to ask any supplier

• Which account holds the infrastructure, and whose name is on it?
• Which region is the data in?
• What exactly leaves your network, to whom, and when?
• Is there a contractual commitment that your data is not used for training?
• If we part company, how do we get everything back — and have you ever actually done that?

If a supplier gets vague on the last one, that is your answer.