Data residency for AI agents: where your prompts, documents and records actually live

Your security team asks a simple question: where does our data go when the agent runs? The honest answer has four parts. Your systems of record, where it starts. The agent's working state, where it sits between steps. The model provider, which reads it to decide. And the record, which keeps what happened. Each can be in a different country, under different terms, for a different length of time.

In one sentence: data residency for agents means knowing all four locations, and the retention and training terms at each.

/01Where it comes from

Data residency started with databases and cloud storage: which country the disks are in. Agents add two new stops. The model provider sees every document the agent reads. And the agent often keeps state (a plan, a scratchpad, retrieved files) outside both your systems and the provider's.

Model providers now publish their terms in detail. The trouble is that each one splits the question differently. Training, retention, abuse monitoring and region are four separate answers, and "we don't train on your data" covers only the first.

/02How it works: the four places

1. Your systems of record. The ERP, the claims platform, the mailbox. Nothing new here. The question is what the agent's credentials let it copy out.

2. The agent's working state. Where the orchestration layer keeps the run: messages, tool results, retrieved documents. This is often the vendor's cloud. Ask where, and for how long.

3. The model provider. What the docs of four major providers say, in their words:

"See its docs" means we did not find the answer on the page we cite. Do not read it as "no".

Three things stand out. Retention and training are separate. "Zero data retention" is usually by approval: OpenAI says its controls "are subject to prior approval"¹. Anthropic's 30-day rule has exceptions, including a zero data retention agreement and enforcing its usage policy². And region choice can quietly change with the deployment type. Azure's global deployments may process outside your chosen geography³.

4. The record. What the run leaves behind for your auditor. If the AI Act applies, deployers must keep the logs "to the extent such logs are under their control"⁵. That phrase is the reason to hold the record in your own store. If it sits only in the vendor's platform, it is under their control, not yours.

/03What it is good at, and what it is not

Good at. Private or regional deployment shrinks the list of places your data goes. Running a model through your own cloud account (Azure, Bedrock, Vertex) brings it under an agreement you already have. It lets your existing data processing terms apply.

Not good at. Removing the agent vendor. A regional model endpoint does nothing if the agent's working state sits in another region. Ask about all four places. The model is only one.

Not the same as privacy. Residency is about location. An agent in the right country can still send a claimant's medical history to a tool that did not need it. Scope what the agent reads, as well as where it goes.

/04What to check

1. /01

   Draw the four places for your agent. Name the country and company at each.

2. /02

   For the model provider: training, retention, abuse monitoring and region. Four separate answers, in writing.

3. /03

   Is zero data retention in place, or merely available? Which features fall outside it?

4. /04

   Where is the agent's working state kept, and for how long?

5. /05

   Where is the record kept? Can you export it, and read it without the vendor?

6. /06

   Is every provider on the vendor's sub-processor list, with location?

/05Where it is going

Providers are adding regional endpoints and zero-retention options quickly, often at a price. OpenAI's docs mention a 10% uplift on data residency endpoints for newer models¹. Our view: within two years, regional processing will be standard for enterprise contracts. The harder question will move to the agent layer. Buyers will ask where the plan, the scratchpad and the record live, and many vendors will not have a clean answer.

/06Gatehouse fit

Surehand keeps engagement data and website data apart. Material reaches a model provider only inside the scope set in the signed rules, under API terms that exclude training, and each crossing is logged. Your business material stays in your own store. The record holds links to it, not copies, and exports in open formats. Model providers are named in each deployment's rules. The Trust page lists the sub-processors, their roles and locations.

/07At a glance