Every AI vendor says some version of "trained on your data." It sounds reassuring. On its own it means almost nothing, because it does not tell you where your information goes, how long it stays there, or whose system can see it.
Those are the questions that matter to a business owner about to hand over invoices, client calls or financial records. This piece explains what the phrase actually means in plain terms, using how Keystone actually builds rather than a generic definition.
What "trained on your data" does not mean
The worry behind the question is specific. You hand over your invoices, your client calls and your financial records, and they get folded into a public AI model that other companies' systems then draw on. Your figures end up shaping someone else's answers.
That is not what it means in a properly built custom system. A business's data stays inside a system built specifically for that business. It is referenced to do the job at hand — matching an invoice, summarising a call, drafting a reply — not absorbed into someone else's product.
In practice, the system is grounded in your own documents and records rather than relying on generic training data. A general AI trained on the wider internet does not know your pricing, your clients or your processes. Your data is what lets the system do your work.
"Trained on your data" should mean the system knows your business. It should not mean your business becomes part of someone else's system.
What actually happens to the data in a Keystone build
The facts are the same ones set out in our guide to AI and GDPR in Ireland. Here they are framed around the question a business owner actually asks: what happens to my data once it goes in?
- EU-hosted infrastructure by default Every Keystone build runs on EU-hosted infrastructure. Nothing is sent outside the EU or EEA, so there is no cross-border transfer to justify and no third-country jurisdiction to explain to your own clients.
- Data minimisation A system built to transcribe a call and produce an action list does not keep the recording afterward. A system built to reconcile invoices processes the transaction; it does not stockpile a duplicate financial archive. The system handles what the task needs and nothing more.
- The system serves one business Unlike a shared SaaS platform, where the same underlying model serves every customer, a Keystone build is scoped, built and run for one operation. There is no cross-contamination between what one client's system sees and another's.
Every engagement also comes with a written Data Processing Agreement, setting out what data is processed, for what purpose, on what legal basis, and for how long. If you want to see what a build involves from scoping to go-live, custom AI development sets out the scope, timeline and fixed price.
Why this matters more in some sectors than others
The principles are the same everywhere. The stakes are not.
Healthcare
Special category data under Article 9 of GDPR, which carries higher protection.
The bar is higher, not unreachable — it is cleared with the right architecture and a valid Article 9 condition.
Legal
Client-privileged information runs through legal call recordings.
Privilege is not special category data under GDPR, but it carries professional obligations that overlap heavily with GDPR principles, so retention and audit trails matter.
Finance
Transaction-level personal data is what a reconciliation system handles.
Transaction data is personal data, and a Xero or Salesforce reconciliation build processes significant volumes of it.
Lawful bases, Data Protection Impact Assessments and what the EU AI Act adds are covered in detail in AI and GDPR in Ireland: What Irish Business Owners Actually Need to Know.
This is a plain-language explanation written from build experience, not legal advice. Your obligations depend on your specific processing. For a system handling special category data at scale, take advice from a data protection professional as well.
The questions worth asking any AI provider about your data
Whether you work with Keystone or anyone else, four questions tell you most of what you need to know. The answers should be specific, and they should be in writing.
Where is the data actually hosted?
Not where the company is registered — where the infrastructure that processes and stores your data sits. EU or EEA hosting is the simple baseline. If the answer is anywhere else, ask what transfer mechanism covers it.
Does the system keep a copy of raw inputs like call recordings, or only the output?
A system that needs an action list from a call does not need the audio once the list exists. If raw inputs are kept, ask why, for how long, and who can reach them.
Is a Data Processing Agreement provided as standard, or does it need to be requested?
Under Article 28, a provider processing personal data on your behalf needs a written contract with you. A provider that has one ready has thought about this before you asked.
Is the same underlying system shared across other clients, or built specifically for this business?
On a shared platform, your data and every other customer's pass through the same system. That is not automatically a problem, but you should know which one you are buying, what keeps your data separate, and whether anything you send is used to train or improve the provider's models.
If you want those four questions answered for a specific system in your business, that is one of the things the Discovery Call covers. It is free and takes twenty minutes.