Every AI assistant that gets past the demo meets the same question in its first security review: where does our data go?

There are three common answers:

  1. Shared service (SaaS). The provider runs everything, inside a data-residency boundary.
  2. Control/data split. The customer runs the whole data plane in their own cloud account. The provider keeps only signing, licences and support.
  3. Isolated site. Everything, models included, runs in the customer's building, with no route to the internet.

I wrote each one up as a reference architecture, with the diagram, the request flow hop by hop, exactly what crosses the boundary, and the trade-offs. A reader here already found a gap: name lookups can carry data out of a network that has no internet route. That fix is now in all three parts.

I'd like to hear from people who run these in production:

  • Which pattern does your team run today: 1, 2 or 3? Why that one?
  • What does your security review ask that these designs don't answer?
  • If you run an isolated site: how do you handle patches and model updates?

The series: