# AI deployment architecture, data handling and security | tracee > Compare five AI deployment patterns, from standard API to self-hosted model, on data handling, isolation, retention and operating burden, with an interactive explorer. Source: https://traceegroup.com/ai/deployment --- # Where your data goes is a design decision. How a model is reached, where it runs and what the provider keeps matter as much as which model you choose. We separate questions that are often blurred together, compare deployment patterns on their merits, and document the choice so your IT, security and data protection leads can check it. ## Five questions that are often confused. "Is it secure?" is not one question. These five have different answers, different owners and different evidence. ### 1. Data classification: what is the data? Public, internal, personal or restricted. We use these four classes as a design heuristic, not as a legal classification. The class decides who may see the data and how much justification its processing needs. ### 2. Processing location: where is it computed? Including inference, logging and support access. EU data at rest is not the same as EU inference processing. A provider may store your data in the EU and run the model elsewhere, or the reverse, and the answer can differ by model and by feature. Check both, per service, in the contract and the data processing terms. ### 3. Infrastructure and network isolation: how does traffic get there? Over the public internet with encryption, over a private link from your cloud, or entirely inside your own environment. Private network access does not equal dedicated compute. A private endpoint can sit in front of a shared, multi-tenant model service. ### 4. Provider retention and training policy: what is kept? Prompts, outputs, logs and abuse-monitoring copies: how long each is kept, who can access it, and whether it can be used to train models. These differ between consumer, standard and enterprise terms and they change over time. They are contractual facts to verify at the date of signature, not assumptions. ### 5. Human consequence: what if the output is wrong? A wrong summary of a public report and a wrong decision on a person's file need different controls whatever the deployment. This question often matters more than the other four, and no hosting choice answers it. Pseudonymization is not anonymization. Replacing names with tokens reduces exposure. But if your organization holds the key, or a record can be re-identified by combining fields, the data is still personal data and data protection law still applies. Treat "anonymized" as a claim that has to be demonstrated, not a label. ## Five deployment patterns, no universal ranking. Each pattern moves a different risk. None removes risk, and the order below is by operating burden, not by safety. - Pattern - Advantages - Limitations - Operating burden - Vendor dependency - Standard APIProvider's public API under standard terms, shared infrastructure. - Fastest start, latest models, nothing to operate. - Standard retention and processing terms; little contractual leverage; data leaves your perimeter. - Low - High, reduced by an abstraction layer - Enterprise APISimilar models under enterprise or negotiated terms. - Data processing agreement, retention controls where offered, single sign-on, administration and audit logs. - Cost and commitments; compute still shared; regional options vary by model. - Low to moderate - High - Private connectivityModel service reached through a private link from your cloud. - Traffic stays off the public internet; your network policy applies; fits existing cloud controls. - Does not by itself mean dedicated compute or different retention; needs network skills. - Moderate - High, on the cloud provider - Dedicated environmentReserved capacity, or a managed model deployed into your cloud account. - Isolated compute, predictable capacity, stronger residency control. - Higher fixed cost; narrower model choice; capacity planning. - Moderate - Moderate to high - Self-hosted modelOpen-weight model on infrastructure you operate. - Full control of the data path, retention and versions; no per-call provider. - You own patching, scaling, monitoring, evaluation and updates; open models may underperform on some tasks; hardware cost. - High - Low on model vendors, high on your own team Self-hosting moves risk; it does not remove it. A model on an unpatched server, with no logging and one engineer who understands it, can be less safe than an enterprise API with strong contractual terms and good access control. The deployment postures guide works through that counterexample in detail. ## Screen the patterns against your situation. Choose three inputs. The explorer re-ranks the five patterns and explains each result. It is a deterministic set of rules written by tracee, not an AI system, and it records nothing you select. Illustrative technical screening, not a legal or security determination. It does not replace a data protection impact assessment, a security review or your counsel's reading of your contracts and obligations. - Standard APITrade-off: fastest and cheapest to start, least contractual control. - Enterprise APITrade-off: stronger terms and administration, same shared compute. - Private connectivityTrade-off: controls the network path, not the processor or the compute. - Dedicated environmentTrade-off: isolated compute and residency control, higher fixed cost. - Self-hosted modelTrade-off: full control, full operating burden. ## The law sets the frame; it does not choose the architecture. Data protection law applies to personal data whatever the deployment pattern. The EU AI Act entered into force on 1 August 2024 and applies in stages. According to the European Commission's overview, consulted on 22 October 2026, an amending regulation in force since 27 July 2026 moved the application date for high-risk systems listed in Annex III to 2 December 2027. Whether a given use is high-risk depends on its purpose, not on where the model runs. We do not give legal opinions. We document the facts your counsel or data protection officer needs to form one: data flows, processors and sub-processors, processing locations, retention, and the role of human review. Primary sources: - CNILIntelligence artificielle : le guide, the French data protection authority's guidance on AI systems and personal data. - European CommissionAI Act: regulatory framework for AI, including the current application timeline. - NISTAI Risk Management Framework (AI RMF 1.0, January 2023) and its companion documents. ## What a deployment assessment delivers. ### Data flow map Every flow to and from a model, with its data class, processor, location and retention. ### Pattern assessment The candidate patterns compared on isolation, retention, operating burden and dependency, for your case. ### Supplier term review Retention, training use, processing location and sub-processors, read against your constraints and dated. ### Security and access design Network path, identities, secrets handling, logging and role-based access, ready for your security review. ## Unsure what your provider actually keeps? Send us the use case and the service you are considering. We will tell you which terms to check and what to ask for.