What Is Data Residency for AI Training Data?

Footage of people is personal data, and where it sits can bring in the rules of that place. Security and legal reviewers therefore ask where raw footage, delivered datasets and backups are stored, and whether any copy leaves a region. A vague answer can stall a pilot at contract review.

The /dpa and /privacy pages state no storage region, country or hosting provider. The /dpa page says data transferred across borders will rely on an appropriate transfer mechanism, such as Standard Contractual Clauses, attached to the signed agreement, and that a sub-processor list covering storage and delivery is available on request. Both pages are drafts, and the signed agreement controls.

Data residency is the place where data is held: the country or region of the servers and storage that keep a dataset. Data localisation is a stricter idea, where rules require data to stay inside a place.

For AI training data, three locations can differ: where footage is captured, where it is stored and processed, and where it is delivered. This page is general information, not legal advice; your counsel decides what applies to your use.

They answer different questions, and the first table compares them. Residency asks where. Retention asks how long, and what happens at the end. A data processing agreement is the contract that governs handling. A transfer is a movement of data between places, and it makes residency a live question whenever capture and storage are in different countries.

Do not assume that a stated transfer mechanism means a stated region.

Ask for the storage region of raw footage, delivered datasets and backups, and for the location where de-identification and quality checks run. Ask whether data crosses borders between capture and storage, which sub-processors hold storage, who can reach the data and what is deleted, and when. Put the answers in writing in the order form. The second table sets them against what the draft legal pages state.

Four things appear on /dpa. Personal data is processed only to collect, de-identify, quality-check and deliver the datasets in the order form. Firsthand maintains access controls and encryption in transit and at rest. A sub-processor list for storage, delivery and de-identification tooling is available on request, with notice of material changes. Cross-border transfers will rely on an appropriate mechanism, such as Standard Contractual Clauses, attached to the signed agreement.

The /dpa page says a SOC 2 Type II audit is in progress, so no completed certification is stated. Read the delivery page alongside this one: it describes the transfer path and states its own storage and retention rules.

Not stated: the storage region or country, the hosting provider, where de-identification and quality checks run, the names of sub-processors, retention periods, and deletion or return at the end of an engagement. The signed agreement controls over every page on the site, including this one.

Put location in the spec, not the aftermath. Where coverage is deep, a first validated batch lands in a median of 48 hours from signed spec; thinner environments typically take three to four weeks. Residency questions raised after that first batch compete with delivery, so ask legal to read /dpa, /privacy and /provenance while the skill spec is written, and record the region in the order form.

What is data residency for AI training data?

The geographic location where a dataset is stored and processed. For training data that shows people, it covers raw footage, delivered datasets and backups, and the borders data crosses between capture, storage and delivery. This is not legal advice.

Does Firsthand state where data is stored?

The /dpa and /privacy pages state no storage region, country or hosting provider. The /dpa page says a sub-processor list for storage and delivery is available on request. The signed agreement controls, so ask for the region in writing.

Is data residency the same as data retention?

No. Residency asks where data is held. Retention asks how long it is kept and when it is deleted or returned. The site states discard and deletion-request rules but no retention periods.

How does Firsthand handle cross-border transfers?

The /dpa page says that where data is transferred across borders, the parties will rely on an appropriate transfer mechanism such as Standard Contractual Clauses, attached to the signed agreement. The page is a draft.

What should a buyer ask a data vendor about residency?

Where raw footage, delivered datasets and backups are stored, where processing and quality checks run, which sub-processors hold storage, which borders data crosses, and what is deleted and when. Get the answers in writing before the order form is signed.