What is the difference between storage and processing?
Your customer data is stored in your Zoho environment. That is the place where it lives permanently.
As soon as you ask an AI model a question about that data, a portion of it is sent to that model to be processed. That processing takes place on the AI vendor's infrastructure, not in your Zoho environment.
For the GDPR, both count. For many tenders and internal policies, the latter is particularly important, and this is often overlooked during discussions.
What does Zoho refer to?
Zoho offers multiple regions, including European data centers, for customers requiring data localization. Which region applies to your environment is determined when creating the account and cannot be easily changed afterwards.
So check that before you start anything. You can find it in your Zoho account settings. If your environment is in a different region than you thought, that is a migration issue and not a setting.
| Ask | Short answer | Floor |
|---|---|---|
| What is the difference between storage and processing? | Your customer data is stored in your Zoho environment. | Read more |
| What does Zoho refer to? | Zoho offers multiple regions, including European data centers, for customers requiring data localization. | Read more |
| Where does the AI model process? | This varies by supplier and order quantity. | Read more |
| What stays within your own environment? | This is the part you are in control of, and where the most profit is to be made. | Read more |
| How do you document this? | Three documents, and none of them need to be long. | Read more |
Where does the AI model process?
This varies by supplier and by purchase. Some providers offer regional processing, others do not, and sometimes only for certain subscription types.
The questions you ask: in which region does the processing take place, can I capture this, are prompts and responses stored and if so, for how long and where, and are sub-processors engaged.
All those questions should be answered in writing. Check with the supplier themselves and not with the implementation partner, because conditions change.
What stays within your own environment?
This is the part you are in control of, and where the most profit is to be made.
In the setups I perform, knowledge sources remain within the client's Zoho environment. Documentation, procedures, product information, and historical tickets are not stored elsewhere. They are accessed on a question-by-question basis, and only the relevant part is carried over to the model.
That limits what goes out to what is needed for that one question, instead of your entire knowledge base.
How do you document this?
Three documents, and none of them need to be long.
An overview of which data is located where and where processing takes place, including the regions. The data processing agreements with both your software vendor and your AI vendor. And a brief note stating which choices you have made and why.
The latter is what you grab when a client asks for it in a tender. Without that document, the conversation starts with research.
For which organizations is data localization a major factor?
Government, healthcare, and financial institutions generally have strict requirements in this regard. If you work for those sectors, this is not a minor detail, but a condition for being allowed to provide services at all.
In that case, it pays to define the region choice before building the connection, not afterwards.
Where do you start?
Check which region your Zoho environment is running in. That takes five minutes and determines the rest of the conversation.
Sources and product information
- Zoho Security FAQ, official product information
- Anthropic Privacy Center, official product information