Where does my clients’ data go with AI?

What is the honest answer to this question?

The honest answer fits on a sheet, not in a slogan. Agentica makes no claim about where data is hosted; instead, it hands over a data-protection sheet stating what is verifiable: who hosts each system in use, who can access what, what is logged, and that client data is never used to train AI. Each of those statements can be checked at the source, in the documentation the systems’ own providers publish, rather than taken on the word of a brochure. A reassuring line like “your data stays here” cannot be verified; a sheet that names the systems and points to their published commitments can. That is the whole difference between a promise and an answer, and this question deserves an answer. Anyone selling AI for financial work should be able to produce the equivalent; a vendor who hesitates at that request has already answered the question, just not in writing.

What does the data-protection sheet actually contain?

The data-protection sheet answers four questions, one per line of trust. Who hosts: every system in the setup is named, with its provider, so the firm or business knows exactly who it is dealing with. Who accesses: access is granted per employee, with individual accounts rather than a shared password, so it is always possible to know who saw what. What is logged: system activity is recorded, so checking after the fact is possible rather than theoretical. And training: client data is never used to train AI, a commitment serious providers publish in plain sight, where anyone can go read it. The sheet is handed to the client, who keeps it; it is written to be shown onward, to an end client, an external accountant, or an advisor who asks the question. A data answer that cannot be shown onward is not much of an answer. The sheet is short on purpose; a trust document that needs a lawyer to parse defeats its own point.

Where do the official numbers live in all this?

The official numbers do not move: the accounting software remains the system of record for amounts, remittances and filings, exactly as it was before AI arrived. The AI and the automations work around it: they read documents, sort, chase, prepare drafts; they never become the reference. Access to the systems is granted person by person, which applies to the client’s team and to the team operating the systems alike: every action has an identifiable author. Nothing critical goes out to a client without a person on the team approving it. And the client’s external accountant receives what an external accountant has always wanted: clean, complete numbers, on time, pulled from the same accounting software that has always counted. So the question “where does the data go?” has a short answer: the numbers stay where they have always been. That short answer is the point: adding AI did not move the books.

How do you judge a vendor promising “local servers”?

By asking the same four questions, word for word: who hosts each system? who can access what? what is logged? is the data used to train AI? A vendor who answers “Canadian servers” and stops there has given a slogan, not an answer: a server’s location says nothing about who can open the files, what gets recorded, or whether the data trains someone’s models. A serious vendor, Agentica included, should be able to answer all four with verifiable documents; that is the test, and it is the same test for everyone. A single unverifiable claim destroys the trust everything else was trying to build. The habit worth keeping is simple: when a vendor makes a promise about data, ask for the sheet; if there is no sheet, there is no answer, whatever the brochure says.