Data residency

Data residency is the question of where data physically lives and is processed. In cloud services this often stays invisible; data may be replicated across regions and processing may happen in another geography entirely.

For some organisations that is unacceptable. In public procurement, defence, and certain financial contracts, keeping data inside national borders is an explicit obligation.

Even without an obligation there may be customer demand. Enterprise customers routinely ask this during vendor assessment and want the answer written into the contract.

In AI products the question goes one layer deeper: not only where documents are stored but where model calls go. If query context is sent to a model provider, that context is a data transfer too.

Two separate questions therefore belong in any evaluation: where are documents stored, and what data goes where at query time? The second is often skipped and is usually more decisive.

On the KobiGPT side, a self-hosted deployment answers both together: infrastructure, model, and embedding provider configuration all remain under your control.

Data residency is a contract clause, not a product feature. Storage geography, processing geography, sub-processors, and notification duties when those change should all be written explicitly.

The second clause is deletion behaviour: on request, data must be removed from both the source store and the vector index. That is a contractual commitment, not a technical detail.

This page is not legal advice; consult your legal adviser for contract wording and compliance assessment.

A useful way to evaluate data-residency is to follow one real question from the source document to the final answer. Record which file was selected, what context reached the model, and what a reviewer would need to verify. This turns a definition into an operational check and makes the result comparable across teams.

The same check should include ownership and change management. Decide who updates the relevant documents, how an outdated result is reported, and which access boundary applies. KobiGPT can provide the assistant and the cited document context, but the organisation still owns the source material, permissions, and the decision made from the answer.