Where your data goes when an AI agent answers

Where your data is stored

Team Two runs on AWS in Stockholm (eu-north-1). Your workspace data, including documents, their search index, conversations, agent configurations, and audit logs, is stored there, encrypted at rest. Connections are encrypted in transit.

What happens when an agent answers

To produce an answer, an agent sends a request to a language model. That request contains the agent's instructions, the recent conversation, and the passages retrieved from your documents. If you use a cloud model from Anthropic or OpenAI, that request is processed by them, in the United States.

Some other steps also involve external services:

• Documents are turned into embeddings, a numerical representation used for search, by a model provider when you upload them.
• If an agent uses the web search tool, the search query goes to a web search provider.
• Billing goes through Stripe.

Every one of these providers is listed, with what they do and where, on our sub-processor page.

How those transfers are covered

Transfers to providers outside the EU rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework. We don't use your data to train models, and our provider agreements are for API use, where your inputs are not used to train their models either.

For your own compliance documentation, we sign a Data Processing Agreement where you are the controller and we are the processor. A summary is on the sub-processor page. The full DPA is available on request.

Options if some data should never leave

For some companies, or some kinds of work, the answer above isn't good enough. Team Two gives you three levers:

1. Run a local model. Team Two can use a model you host yourself with vLLM. Requests to that model stay inside your own infrastructure.
2. Bring your own keys. Connect your own Anthropic or OpenAI account, so model calls run under your own agreement with that provider.
3. Set a policy. Gateway settings let you disallow cloud models, allow them only for certain agents, or force sensitive work to a local model.

You can mix these. A common setup is a cloud model for general questions and a local model for agents that handle HR or finance data.

What we'd ask any AI vendor

Whether or not you choose Team Two, these questions separate honest answers from marketing:

• Where is my data stored at rest?
• Which model providers receive my prompts, and in which country?
• Is there a published sub-processor list, and how am I told when it changes?
• Can I use a local model or my own provider account?
• Is my data used for training, by you or by your providers?

If a vendor says nothing ever leaves the EU but uses a US-hosted frontier model, ask them to explain how.