Resources

AI Data Privacy: Where Your Customer Data Goes When Your App Uses AI

AI data privacy comes down to a question most teams never stop to ask: when your app hands something to a model, where does that data actually travel, and who holds on to it afterward?Behind a simple AI feature is an invisible step. A user types a request, and that text often leaves your servers entirely, crossing the internet to a third party model provider you do not own and cannot see inside. Whatever was in that request, a name, a medical detail, a contract clause, went along with it.

Cloud or on the device

The first real privacy decision here is where the model runs. Cloud models are the most capable, yet every request leaves the user’s device and your control to reach them. On device inference, using frameworks like Apple’s Core ML, keeps sensitive data local and never puts it on the wire. Choosing between the two is not only a performance question. It is a privacy question about how far your customers’ data should have to travel.

What the provider does with your data

Sending data to a model is not the end of its journey. Many providers log the requests they receive, some retain them for a period, and their terms differ on whether your inputs can be used to train future models. Reading those terms, and negotiating them where the stakes are high, is a core part of protecting that data, and teams routinely skip it.

The cost of skipping it shows up in the breach data. IBM’s 2025 report found that shadow AI, the unsanctioned use of AI tools, was a factor in 20 percent of breaches and added roughly $670,000 to the average cost. More striking, 27 percent of organizations said that over 30 percent of the data flowing into their AI systems contained private information, while only 17 percent had any technical control capable of stopping a confidential upload. Breaches that involved shadow AI also exposed customer records at a higher rate than the global average.

Where the law lands

Regulation treats this data seriously even when teams do not. Under the European Union’s GDPR, a single mishandled breach can cost up to 4 percent of worldwide revenue, and health data carries its own obligations under rules like HIPAA. Those penalties attach to exactly the customer information that an AI feature quietly ships to a third party, which makes AI data privacy a compliance problem as much as an engineering one.

Staying in control

Control is a design choice, and it starts before the first request is sent. Keep inference on the device when the feature allows it. Send the model only the data it truly needs rather than the whole record. Ask providers for zero retention terms so your inputs are never stored or reused. Encrypt data both in transit and at rest, route calls through private endpoints, and tell users plainly what leaves their device. Handled this way, AI data privacy stops being a liability hiding inside a convenient feature and becomes something you can stand behind.

Want AI features that respect your customers’ data?

Tepia builds AI into apps with data privacy engineered in, from on device inference to zero retention model calls and private endpoints. We design the data flow so your customers’ information goes only where it must, and no further.

Plan a privacy first AI build with Tepia

What is AI data privacy?

AI data privacy is about controlling what happens to personal or sensitive data when an app uses AI, especially the moment that data leaves your servers for an external model. It covers where the model runs, what the provider does with the data, how long it is retained, and whether it is used for training. Strong AI data privacy means the data only ever goes where it needs to and is protected the whole way.

Where does my data go when my app uses a cloud AI model?

With a cloud model, the request typically leaves the user’s device and your servers and travels to a third party provider that runs the model. Depending on that provider’s terms, the request may be logged, retained for a period, or even used to improve future models. This is why reading the provider terms and weighing on device options is central to AI data privacy.

Is on device AI more private than cloud AI?

Generally yes. On device inference keeps the data on the user’s device and never sends it across the internet to a provider, which removes an entire category of AI data privacy risk. The trade off is that on device models are usually less capable than the largest cloud models, so the right choice depends on the feature and the sensitivity of the data involved.

How much do AI data leaks actually cost?

According to IBM’s 2025 Cost of a Data Breach Report, breaches involving shadow AI added roughly $670,000 to the average cost, and only 17 percent of organizations had controls able to stop employees from uploading confidential data to public AI tools. The report also found that shadow AI breaches exposed more customer records than the global average, making uncontrolled data flows an expensive AI data privacy failure.

How does Tepia protect data privacy in AI features?

Tepia designs the data flow before building the feature, favoring on device inference where possible, sending models only the minimum data required, negotiating zero retention terms, and routing calls through private endpoints. The goal is an AI feature where customer data goes only where it must, so privacy is built in rather than assumed.

This is Part 2 of a 3 part series on AI features and app security.

Read the rest of the series: AI App Security: Adding Intelligent Features Without Opening a Hole (Part 1) · Secure AI Integration: The New Attack Surface and How to Close It (Part 3)