PII, Compliance and Data Residency
How personal and regulated data flows through LLM systems, what to redact and where, vendor data terms, data residency, retention and deletion, and audit requirements.
Lesson 6 of 6 9 min
Where data goes in an LLM system
A user's message may end up in many more places than a classic request:
User input
Gateway logs
Model provider
prompt + output
Traces / analytics
Caches, memory, vector index
Eval sets, fine-tuning data
Draw this map for your design. Every box needs an answer to: what data, where, for how long, who can access it, and how is it deleted?
Minimising what the model sees
- Don't send what the task doesn't need. Summarising a support ticket rarely needs the customer's card number or address.
- Redact or pseudonymise before the call: replace names, emails and IDs with placeholders (
<PERSON_1>), keep the mapping in your system, and re-insert the real values in the output if needed. - Detection: combine pattern matching (emails, phone numbers, card numbers with checksums) with NER models for names and addresses. Accept that detection is imperfect, and layer other controls on top.
- Structured data: give the model IDs and let tools fetch the details only when necessary, under the user's permissions.
Provider and deployment choices
| Question | Why it matters |
|---|---|
| Is our data used for training? | Business and enterprise API terms typically say no. Verify it contractually |
| How long are prompts retained? | Standard retention for abuse monitoring vs zero-data-retention options for sensitive workloads |
| Where is data processed and stored? | Data-residency laws and customer contracts (EU, healthcare, government) |
| Certifications | SOC 2, ISO 27001, HIPAA BAA, FedRAMP as required |
| Sub-processors | Who else touches the data |
Options for stricter requirements: regional endpoints, cloud-hosted models in your own cloud account (managed endpoints), or self-hosting open models inside your boundary (see API vs self-hosted).
Data residency
If EU customers' data must stay in the EU:
- Route their requests to EU model endpoints at the gateway, based on tenant configuration.
- Keep their vector indexes, logs, traces and caches in EU regions too, not just the model call.
- Make sure failover doesn't send traffic across regions without permission. A US fallback for an EU tenant can be a compliance breach.
Retention and deletion
- Set retention periods per store: content logs short, metrics longer, eval sets curated and consented.
- Deletion requests (GDPR right to erasure and similar) must propagate to the source documents, vector index entries (with compaction), semantic caches and memory stores, traces and logs, and eval sets.
- Fine-tuned models can memorise training data, and you can't delete one person's data from weights. Avoid training on personal data unless you can retrain, or use RAG for personal and customer-specific knowledge instead.
Regulated domains
- Healthcare: PHI requires contracts such as a HIPAA BAA with every vendor in the path, plus audit logs of access.
- Finance: record-keeping and explainability. Keep prompts, sources and outputs for decisions.
- Children's data, biometrics, employment decisions: extra legal constraints in many jurisdictions. AI-specific rules such as the EU AI Act add risk classification and transparency duties for some uses.
Audit
- Log who asked what, which data was retrieved, which model answered, and what actions were taken, with tamper-evident storage for regulated use.
- Provide users and admins with transparency: what the AI can access, what it remembers, how to delete it.
Key takeaways
- Map every place user data goes, including the prompt to the provider, logs, traces, caches, vector indexes, eval sets and fine-tuning data.
- Redact or pseudonymise PII before it leaves your boundary when the task doesn't need it, and re-identify in your own systems.
- Choose providers and deployments by data terms (no training on your data, retention, zero-retention options) and region.
- Deletion must reach every derived copy, including vectors, caches, traces, eval sets and any fine-tuned model.
Go deeper
Finished reading? Mark it done to track your progress.