Data residency
Definition
Data residency defines in which jurisdiction company data is stored and processed. For AI systems it covers the hosting region of the application, the database, the model endpoint and any logs, plus whether prompts may be used for provider training.
It is a contractual and architectural question at once: EU-hosted endpoints, no training on customer data, defined retention periods and clear sub-processor lists.
Data minimisation reduces the problem: send the field that is needed for the decision, not the entire record.
In practice
- Covers application, database, model endpoint and logs
- Contract must exclude provider training on company data
- Minimise the data sent per request by design
Related terms
- AI governanceAI governance is the set of rules defining which AI systems a company operates, on what data, with which permissions, under whose responsibility, and how outcomes are reviewed. It makes AI use auditable towards management, auditors and regulators.
- EU AI ActThe EU AI Act is the European regulation that classifies AI systems by risk and attaches obligations accordingly — from transparency duties for ordinary business applications to strict requirements for high-risk uses such as employment decisions or creditworthiness.
- HallucinationA hallucination is a confident but false output from a language model — an invented figure, clause or reference. It is a property of statistical text generation, which is why production systems verify outputs against source data instead of trusting them.