Shadow AI: check the specific data flow
Shadow AI arises when employees use AI services outside what their company has approved. What matters are the data entered, the account used and the settings that apply. The brand name of a service alone does not answer the data protection question.
Editorially updated on 19 September 2026, supplemented on 23 September 2026 with the optionally connectable AI providers. Nexoria is itself a provider of an AI platform; this article describes our selection criteria.
Company headquarters is not the processing location
A German user interface does not prove German hosting. Conversely, a US headquarters does not automatically mean that every request is processed on US servers. Check separately: contracting party, model provider, hosting infrastructure, storage, inference, logging and enabled integrations.
For eligible customers, OpenAI describes European data residency and regional processing, subject to product-specific requirements (OpenAI: Introducing data residency in Europe). For services deployed via the Azure model catalogue, Microsoft describes processing that depends on the deployment geography (Microsoft Learn: Data, privacy, and security for models through the Model Catalog). Whether a specific installation uses these options must be demonstrated by the platform provider.
Training and retention are different questions
According to its own documentation, OpenAI does not use content from its business offerings and the API for model training by default, unless customers explicitly make data available for this purpose (OpenAI: Business data privacy, security, and compliance). A blanket statement that OpenAI trains on all company data would therefore be wrong. Rules for personal accounts, business accounts and APIs must be considered separately.
Moreover, a training exclusion does not automatically mean that no data is stored. Check retention for chat histories, abuse detection, support and backups, as well as the actual deletion rules for each service.
Five questions for choosing a provider
- 1.Which services are used? Ask for the model providers, infrastructure and subcontractors to be named for your specific scope of features.
- 2.Where is data stored and processed? Ask about the active region and the exceptions, not just the billing address.
- 3.Is content used for training? Ask for the contract and settings of every service involved to be explained to you.
- 4.What is retained, and for how long? Distinguish between content data, logs and backups. Clarify deletion and support access.
- 5.How are permissions enforced? Test roles, revocation of permissions and the answer sources with a small dataset of your own.
This review provides a traceable basis for your decision. Neither a European headquarters nor a single contract is in itself proof of suitability for every use case.
How Nexoria splits the processing
Files, the knowledge index and semantic search are located on servers in Germany. Answer generation is handled by Mistral AI in France. The data transmitted by Nexoria to Mistral AI is not used for model training. This exclusion is agreed in the data processing agreement between Nexoria and Mistral AI, as confirmed by Nexoria as the operator on 9 September 2026. The statement refers to the Nexoria configuration and the contract with Mistral AI; it is not a general statement about all of Mistral AI's offerings.
For the optional VoiceBot, Telnyx provides the telephone connection in Frankfurt. According to Nexoria as the operator, speech recognition and speech synthesis are performed via Voxtral from Mistral AI in France, and the answers are also generated by Mistral AI in France. Error monitoring, optional mailbox integrations and website analytics with PostHog subject to consent are listed separately. Some providers are headquartered in the USA, such as Telnyx for the telephone connection and Sentry for error monitoring.
ChatGPT (OpenAI), Claude (Anthropic), Gemini (Google) and Langdock can optionally be connected to Nexoria. Nexoria also works without these integrations. When connected, shared content is transferred to the respective provider. That provider's terms, processing locations and settings apply.
The components and contracts are described under Security, Privacy and in the processing register . Practical selection criteria can be found on the page Enterprise Search.