What developers should actually ask AI security vendors before prompts start crossing borders

A vendor page that says "available in the UK" tells you almost nothing about where your prompts end up. It usually describes the platform, not the AI feature you are about to wire into production. Those are frequently different systems, with different storage backends and different telemetry pipelines.

This matters more for AI products than for the rest of your stack. A prompt is not a row in a database. It carries whatever the user pasted into it, plus retrieved context, plus tool output. Your logs then carry the same content a second time. So "where is our data" splits into at least four questions: inference, retrieval, logs, and support access.

Residency is not the legal control

The first thing to get straight is that UK GDPR does not regulate storage location directly. It regulates transfers. Hosting in London is evidence, not compliance.…