For regulated buyers this is the question underneath every analytics evaluation. Not where the bytes sit, but whose law reaches them and who can be compelled to hand them over. It is the reason self-hosting exists as a category.
More in Privacy
- AnonymizationIrreversibly stripping data of anything that could identify a person. Unlike pseudonymization, there is no key that brings the identity back.
- CCPACalifornia privacy law giving residents the right to know what is collected about them, to delete it, and to opt out of its sale.
- Consent managementRecording what each user agreed to and enforcing it at collection, so consent is a property of the pipeline rather than a banner.
- Data minimizationCollecting only what a stated purpose needs. The cheapest way to reduce risk is not to hold the data at all.
- Data residencyThe requirement that data physically stays in a given jurisdiction. On Flex you pick the region; on Enterprise it is wherever you deploy.
- GDPREU regulation governing personal data, covering the lawful basis for collection, rights to access and erasure, and real consequences for ignoring both.