Once a prompt or file has been sent, you cannot see or verify where it is processed or stored. What you have is the provider's documentation and contract, and those commitments come with documented exceptions. What has been sent cannot be recalled. The one thing you control with your own means is what leaves your device in the first place.
- After you press send, you cannot observe where a prompt is processed; you rely on the provider's documentation and contract.
- Data location commitments have documented limits: they often cover storage only, apply to certain plans, or exclude particular features.
- Contracts and certifications are real safeguards, but they are assurances you can read, not something you can check yourself.
- Deleting a chat or switching a setting off acts on the future; for example, turning training off does not delete saved chats.
- What you control is what you send: send less, leave out or replace identifying details, and back that with plan, settings and internal rules.
Where does the data go when you send it to an AI assistant?
To the provider's servers, possibly via further service providers, and possibly to a country other than yours. Exactly where, you cannot observe once you have sent it. What you have is the provider's documentation and contract. Both are a real basis, but they are commitments: you can read them, you cannot measure them.
This page walks through the path of a prompt, sets out in one table what four widely used providers and one European example commit to and where those commitments end according to their own pages, and then says plainly what follows. It is not a criticism of any provider and not evidence that any of them breaks its commitments. It describes where verifiability stops. All facts are as of 13 November 2026; providers change their pages often.
The path of a prompt: what happens after you press send?
A prompt passes through several stations. At each one, the useful question is: what can I see or set myself, and what can I only read about?
- Your device. You decide what is typed, pasted or uploaded. This is the only station fully in your hands, including your browser history and local files.
- The provider's service. The prompt is transmitted and processed. You see the answer, but not which data centre produced it. On location you can only read what the provider documents.
- Possible sub-processors. A processor may engage further processors with the controller's authorisation and must impose the same obligations on them (Art. 28(2) and (4) GDPR).[14] You are dealing with a chain, not one company. What you can inspect is the list the provider publishes, and the chain can change.
- Storage. Chat history, and logs kept for abuse monitoring and safety. You can see the history in your account, not the logs. For those you have the provider's statements, for example up to 30 days for OpenAI API abuse-monitoring logs.[3]
- Human review and training. Depending on plan and settings, inputs may be used for training or read by people. You can see and change the setting; what lies behind it you read about.
- Possibly a third country. If processing or a sub-processor sits outside the EU, the rules on transfers apply. Where that is the case is stated in the contract and the sub-processor list, not in your interface.
The pattern is the same at every station: you see the setting, not the process.
What the providers commit to, and where the commitment ends
The table reproduces only what the providers write on their own pages. Where the sources we checked say nothing, the cell says so. That is not a statement that nothing exists.
| Data location commitment | Documented exceptions or limits | Training and human review | Source | |
|---|---|---|---|---|
| ChatGPT (OpenAI) | Eligible Enterprise, Edu, Healthcare and API customers can store content at rest in the US, Europe, the UK and other regions.[1] | ChatGPT Business is not listed; regional GPU inference is a separate option; the residency commitment itself is about storage at rest. API abuse-monitoring logs up to 30 days; temporary chats up to 30 days.[1][2][3] | Business, Enterprise, Edu, Healthcare and API: no training by default. Free, Plus, Pro: data sharing on by default; a thumbs rating can put the whole conversation into training. Human review: not described in the sources we checked.[1][2] | [1], [2], [3] |
| Microsoft Copilot | According to Microsoft, EU traffic stays within the EU Data Boundary.[4] | Worldwide traffic may be processed elsewhere. Anthropic models in Copilot are currently excluded. Web search queries go to Bing, with Microsoft as independent controller, and the Data Boundary does not apply to them. Model calls can reach regions with spare capacity under high utilisation.[4][5] | Prompts, responses and Graph data are not used to train foundation models; Microsoft says human review for abuse monitoring is opted out.[4] | [4], [5] |
| Claude (Anthropic) | Europe is named via AWS Bedrock and Google Vertex.[9] | The page names no European legal entity and no native EU region for Anthropic's own apps.[9] | Consumer products: users choose whether chats may be used for training; if allowed, retention of up to five years. A thumbs rating stores the conversation for up to five years. Commercial products: no training by default.[6][7][8] | [6], [7], [8], [9] |
| Gemini (Google) | For Workspace: not described in the sources we checked.[10] | For some features, such as Gemini Notebook, the page describes no data-region control.[10] | Workspace: content is not used for training outside the customer's domain without permission and is not read by human reviewers. Consumer Gemini Apps: a subset of chats is read by reviewers, de-linked from the account and kept for up to three years.[10][11] | [10], [11] |
| Mistral (European example) | The passages we read name no hosting location. Transfers rest on adequate safeguards or standard contractual clauses.[12] | Not described in the sources we checked. | Under the data processing addendum, Mistral may process as controller for training unless the customer has opted out. Thumbs feedback, with the associated input and output, is used as controller. API abuse monitoring is automated except where zero data retention is active. Human review: not described.[12][13] | [12], [13] |
A note on reading it: a documented exception is not a malfunction. It is the provider describing honestly what it commits to, which is why it is worth reading. How plans differ is set out in AI assistants compared on privacy.
What you cannot verify
You cannot see from the outside in which data centre or country your input was processed. In detail:
- Processing locations. As a customer you have no way to observe them. You can ask the provider for documentation and audit reports.
- Residency does not cover everything. Commitments often concern storage at rest. Processing, add-on features and integrations can behave differently; at OpenAI, for example, regional processing is a separate option next to storage.[1]
- Routing exceptions. Microsoft describes that web search queries and Anthropic models are excluded, and that model calls can reach other regions under high utilisation (details in Microsoft Copilot and GDPR).[4][5]
- Changing chains. Sub-processors can change; you read the current state, not the future.
- Retention. How long logs and backups actually exist, you cannot inspect; you can only read stated periods.
- No recall. An input cannot be called back from the service. Deleting a chat and switching off training act on the future; OpenAI states that turning off data sharing does not delete saved chats.[2]
What this does not mean: it is not a sign that any provider breaks its commitments. Contracts, certifications and audit reports are real safeguards; OpenAI, for instance, names SOC 2 Type 2 and ISO/IEC 27001.[1] The point is different: these are assurances that you read and weigh, not something you can check yourself. Anyone responsible for personal data should know that gap and include it in the decision.
What about transfers to the United States?
The EU–US Data Privacy Framework is currently valid; the EU's General Court dismissed the challenge against it on 3 September 2025 (Case T-553/23).[18] An appeal is pending (C-703/25 P) and has not been decided.[19] The framework only helps if the provider is certified under it; otherwise standard contractual clauses and an assessment apply, which come through the provider's contract. We have not checked the certification status of individual providers.
What is in your own hands?
Everything that happens before you send. The table is ordered by how much control each lever gives you.
| Lever | What it does | Limit |
|---|---|---|
| 1. Send less (data minimisation) | What is not sent cannot end up anywhere. Data must be limited to what is necessary (Art. 5(1)(c) GDPR).[15] | Costs effort; some tasks need the context. |
| 2. Replace identifying details (pseudonymisation) | Names, numbers and addresses are swapped for placeholders before sending. The GDPR names pseudonymisation as a measure (Art. 25 and 32).[16][17] | See below. |
| 3. Plan and contract | Business plans name a contract and no training by default. | Commitments with exceptions (see table). |
| 4. Settings | Training, history and feedback can be controlled depending on the plan. | Acts on the future; does not delete what is stored. |
| 5. Rules and training | Internal rules on what may go into which tool, and staff training. | Works only if they are followed. |
Pseudonymisation comes with honest limits. Pseudonymised data remain personal data for whoever holds the key; the Court of Justice said in 2025 that pseudonymised data need not be personal data in every case and for every person, in a case decided under a different regulation and looking at the specific holder.[21] Context can also identify: the German Data Protection Conference writes that removing names and addresses is regularly not enough.[20] No automatic detection finds everything, so a human check before sending stays necessary. Pseudonymisation replaces neither a contract nor a legal basis; it reduces what is exposed.
One tool for this is Ainym, a browser extension in closed beta with pilot teams: it detects personal data on your own device, shows you every match to confirm before anything is sent, and replaces real details with realistic pseudonyms that are put back into the answer. The how-to is in anonymise data before ChatGPT.
Further reading: the plan-by-plan comparison, the AI acceptable use policy template and the overview use AI at work without leaking data.
Frequently asked questions
Where are ChatGPT's servers, and is my data stored in the EU?
OpenAI says eligible ChatGPT Enterprise, Edu, Healthcare and API customers can store content at rest in Europe. ChatGPT Business is not listed, and the sources we checked name no residency option for the consumer plans. The commitment covers storage, not every processing step.
Can I find out where my prompt was processed?
Not from the outside. The path of a prompt is not visible to the sender. You can read the provider's documentation, contract, sub-processor list and audit reports, and you can ask the provider questions.
Does deleting a chat delete it at the provider too?
The sources we checked do not allow a blanket answer. OpenAI describes that switching off data sharing does not delete saved chats, and that temporary chats may be kept for up to 30 days for safety purposes. Check the retention terms of your own plan.
Is a European provider such as Mistral the answer?
Not automatically. Under Mistral's data processing addendum the company may process data as a controller to train its models unless the customer has opted out, and the passages we read name no hosting location. A European base does not replace checking the terms.
Does a business plan solve it?
It improves the starting position without solving the problem. Business plans name a contract and no training by default, but location commitments have documented exceptions, and what has been sent cannot be recalled.
What can I do if I cannot control the path?
Control what leaves your device. Send only what is needed, leave out or replace identifying details, and check the input before sending.
Where Ainym fits in
Once a prompt is with the AI provider, you can no longer see which servers it is processed on; all you have is the provider's commitments. Ainym works one step earlier: it replaces personal data with pseudonyms in the browser before a prompt or file goes to the AI chat, and puts the real details back into the answer. That reduces what you disclose. Your own data-protection assessment is still needed.
Sources
- OpenAI: Business data privacy, security, and compliance (OpenAI)
- OpenAI Help Center: Data controls FAQ
- OpenAI Developers: Data controls in the OpenAI platform (Your data)
- Microsoft Learn: Data, Privacy, and Security for Microsoft Copilot
- Microsoft Learn: Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat
- Anthropic: Updates to Consumer Terms and Privacy Policy
- Anthropic Privacy Center: Is my data used for model training? (consumer products)
- Anthropic Privacy Center: Is my data used for model training? (commercial products)
- Anthropic: Regional compliance
- Google Workspace Admin Help: Generative AI in Google Workspace Privacy Hub
- Google Gemini Help: Gemini Apps Privacy Hub
- Mistral AI: Data Processing Addendum
- Mistral AI: Privacy Policy
- Regulation (EU) 2016/679 (text copy on gdpr-info.eu): Art. 28 GDPR: Processor
- Regulation (EU) 2016/679 (text copy on gdpr-info.eu): Art. 5 GDPR: Principles relating to processing of personal data
- Regulation (EU) 2016/679 (text copy on gdpr-info.eu): Art. 25 GDPR: Data protection by design and by default
- Regulation (EU) 2016/679 (text copy on gdpr-info.eu): Art. 32 GDPR: Security of processing
- Court of Justice of the European Union: Press release No 106/25: Case T-553/23, Latombe v Commission
- EUR-Lex: Appeal C-703/25 P, notice in the Official Journal C/2025/6610
- German Data Protection Conference (DSK): Orientierungshilfe Künstliche Intelligenz und Datenschutz, version 1.0 of 6 May 2024
- Court of Justice of the European Union: Press release No 107/25: Case C-413/23 P, EDPS v SRB
This article is general information and not legal advice. It does not replace an assessment of your own case by your data protection officer or a lawyer. Last updated: 13 November 2026.