The question that usually gets a non-answer
Every business owner asks it, right after the price: where does my data go?
What comes back is usually a reassurance rather than a description. Something about bank-grade encryption, something about certifications, and no actual account of what travels where. That is not necessarily dishonesty. Often the salesperson genuinely does not know, because nobody framed the architecture that way internally.
But you need the description, not the reassurance. "We take security seriously" tells you nothing you can act on. "Your invoices stay on your server and we receive only totals" tells you everything.
The three shapes an AI tool can take
Almost every AI product you will be offered falls into one of three patterns, and they differ enormously in what you are exposing.
- Fully hosted: you upload or sync your data to the vendor's platform, and everything is processed there. Most convenient, most exposed.
- Fully on-premise: everything runs on your own hardware. Most private, and you now operate an AI platform, with the cost and maintenance that implies.
- Split: the intelligence is hosted, a small component on your server fetches data locally, and only computed results travel. Practical privacy without becoming an operator.
What a split design looks like in practice
The split pattern is worth understanding, because it is the one most likely to suit a Kenyan business that wants both privacy and someone else to keep the system running.
The hosted part holds the reasoning: how questions map to business measures, how advice is generated, how reports are phrased. The part installed on your server is deliberately simple. It authenticates, receives a plan describing what to fetch, runs that plan against your own database, and returns the result.
So the direction of travel is: your question goes up, a plan comes down, your own server does the work, and a small table of totals goes back up to be phrased into an answer. Your invoices, customer records and individual transactions never make the trip - because there is no code path that would send them.
Why structure beats promises
Any vendor can promise not to look at your data. The promise is worth what the company is worth, and companies get acquired, run short of money, and change their terms.
A structural guarantee is different. If the software installed on your server has no capability to transmit raw records, then no policy change at the vendor's end alters what happens on your premises. You could have it reviewed and confirm it for yourself.
There is a second thing to look for, and it is a good sign when you find it: does the architecture also protect the vendor? In a split design, the valuable intellectual property stays on the vendor's servers where it cannot be copied. That means their commercial interest points the same direction as your privacy interest - and arrangements built on shared interest survive pressure far better than ones built on goodwill.
The questions to put in the email
Send these to any AI vendor you are evaluating and ask for written answers. The quality of the replies will sort your shortlist faster than any demonstration.
- Which specific data fields leave my premises, and in which direction?
- Is any customer personal data transmitted or stored on your infrastructure?
- Where is that infrastructure physically located?
- How long is anything retained, and can I have it deleted?
- Is my data used to train or improve anything, for any customer?
- If part of the system is installed on my server, may I have it reviewed?
The compliance angle you own
It is worth being clear about who carries the risk. Under Kenya's Data Protection Act, the business holding personal data has obligations about how it is processed and where it goes. Your vendor has obligations too, but the exposure does not transfer away from you by signing a contract.
This makes the architecture question a compliance question rather than a preference. If customer personal data never leaves your premises, a large part of the assessment simply does not arise. If it is being shipped to a platform abroad, you need a lawful basis, a processing agreement, and a clear view of what happens to it - and you need those before the tool goes live, not after.
How Upeosoft builds this
We build business systems that run on our clients' own infrastructure, and when we add AI to them we keep the same principle: the reasoning can be hosted, the records stay home.
In practice that means the component we install on your server does data access and nothing else - no intelligence, no storage of your data elsewhere, only computed results going back. You can read it. Several of our clients have.
If you are weighing an AI tool and cannot get a straight answer about where your data goes, talk to us. We will tell you what to ask, and if the honest answer is that the tool you are looking at is fine for your situation, we will say that too.
