Private AI: where your data goes when you talk to an AI

What "private" means, and what it does not

The word is used for three very different things, and the confusion is expensive at decision time.

Private AI describes a use where your content stays yours: nobody else reads it, it is not used to improve a model, and it is kept only as long as you decided. Local AI describes a model running on your own machines. Open model describes a model whose weights are published.

The three overlap without being the same. An open model installed on your premises may still send detailed logs to an outside service. And a third-party hosted service may offer stronger contractual guarantees than a badly configured in-house setup. Where the computation runs is an architecture detail; what matters is who is allowed to read.

The three questions that settle it

• Who can read my content? The vendor, its subcontractors, its support teams. The answer must be written down, not spoken.
• Is my content used to train a model? The most important question, and the one most often sidestepped. A "no" belongs in the contract, with its exceptions if any.
• How long is it kept, and can I have it deleted? A professional conversation contains names, amounts, sometimes whole case files.

Three questions, three written answers. If one is missing, the matter is not settled.

What leaves and what stays

In professional use, data moves at several moments: the question asked, the documents the assistant reads to answer, the answer itself, and the technical logs that keep a trace of the exchange.

People reason about the first and forget the other three. Yet it is often the log, kept "for debugging", that holds the most for the longest. Private AI in a company is judged on control over those four flows, not on the promise printed on a home page.

When it is your customers' data

When the assistant talks to your customers, you become responsible for content that is not yours. A tenant describing a problem at home, a patient asking a question, a candidate sending their background: these exchanges demand more rigour than internal use.

Two reflexes cover most of it: collect only what the assistant needs to answer, and set a short retention period by default, extending it only for the cases that justify it.

What compliance actually asks for

The European framework does not say you must install a model in your basement. It asks you to know which data is processed, why, by whom, for how long, and to be able to demonstrate it. A well-contracted, well-documented outside service meets those requirements; an in-house setup nobody keeps a record of does not.

Confidentiality is a matter of organisation and evidence before it is a matter of servers.

Key takeaway

Judge an offer on what it puts in writing about reading, training and retention. Where the model sits is one means among others, never the guarantee itself.