The Prompt Is the Data

Part of the pillar series Sovereign AI, Explained.

We spend enormous effort deciding where data lives: residency, encryption, key custody. Then we wire in an AI feature that takes the most sensitive record in the system, wraps it in a prompt, and sends it to a model running somewhere else entirely. The residency perimeter you built has a hole in it exactly the shape of an API call.

This post makes the technical case that AI inference is a data-processing event that has to happen on sovereign ground, and that this is not a nice-to-have but a consequence of how models actually work. It's the companion to our strategic piece on AI lock-in.

A prompt is a data transfer

Start with the obvious thing that's easy to forget. When you call an external model, you send it the prompt and whatever context you retrieved to ground the answer: the support ticket, the patient note, the contract clause. If that content contains personal or confidential data, then the API call is a transfer of that data to wherever the model runs, governed by that provider's jurisdiction.

And once it's there, its fate is out of your hands. Commercial providers typically retain API inputs for a window (often ~30 days for abuse monitoring) even under "we don't train on your data" terms, and retention means it can be compelled. In late 2025, a US court ordered a major AI provider to preserve and produce 20 million user conversation logs in a lawsuit; the provider objected that "more than 99.99%" of them had nothing to do with the case, and produced them anyway (OpenAI; Bloomberg Law). The lesson isn't about one company; it's structural. Prompts are retainable, discoverable data, governed by the legal system of the place the model runs.

Europe's regulators see it the same way. The European Data Protection Board's Opinion 28/2024 holds that an AI model can only be considered anonymous if the chance of extracting personal data "either directly or through queries" is negligible (EDPB). In other words, the query surface itself is a regulated processing surface. Inference is not a safe zone.

The embedding is a fingerprint of your text

Here's the part most people get wrong, and it's the crux of the whole argument. There's a comforting belief that embeddings (the vectors you compute to power retrieval and RAG) are "just numbers," anonymised, safe to compute anywhere. They are not.

An embedding is a lossy but recoverable fingerprint of the source text. Peer-reviewed research (Morris et al., EMNLP 2023) built a method, vec2text, that recovers 92% of short text inputs exactly from their embeddings alone, and, in their words, "can recover important personal information (full names) from a dataset of clinical notes" (ACL Anthology). The reason is a basic information-theory fact the authors invoke directly: a function "cannot add information to an input, [it] can only sustain or decrease" it (The Gradient). The embedding is a compression of your text. And compressions can be decompressed.

Two honest caveats, because overclaiming would undercut the point. The 92% figure is for short texts, roughly sentence- or chunk-length. Recovering a whole long document from one fixed-size vector is harder and, past some length, impossible. But note what that exception is: RAG systems store your corpus as exactly these short chunks. The unit that inverts cleanly is the unit vector databases are full of. And the attacks are getting cheaper: 2025 research demonstrated zero-shot embedding inversion that needs no model-specific training at all (ZSInvert, 2025). So "we only send embeddings to the foreign GPU, not the raw text" is not the safeguard it sounds like. Computing embeddings abroad exfiltrates the source by reduction.

Therefore: inference and embeddings must be regional

Put the two halves together. The prompt is a data transfer. The embedding is a recoverable copy. So if you're serious about keeping data in a jurisdiction, the model that processes it (for both inference and embedding) has to run in that jurisdiction too. There is no clever workaround, because the thing crossing the border is the data, in prompt form or vector form.

This is the sentence that trips up most "sovereign AI" stories: they region-lock the database and then send the prompt to a central GPU farm somewhere else. That defeats the entire design. Regional inference isn't a premium feature to bolt on; it's the load-bearing requirement. It does have a real cost (you duplicate inference capacity per region instead of pooling it globally), and we'd rather name that honestly than pretend it away. The prompt is the data; there's no free lunch.

The claim	Why it fails
"We only send anonymised embeddings"	Embeddings are invertible: ~92% of short text recovers, incl. names
"The provider doesn't train on our data"	Retention windows still apply, and retained data can be compelled
"Our data is in an EU region"	...but the inference runs elsewhere; the prompt still crosses the border
"It's just an API call"	An API call carrying personal data is a regulated transfer (EDPB 28/2024)

How the Soveryne Cloud Foundation keeps the prompt at home

We built the Soveryne Cloud Foundation around this exact constraint, which is why the platform states it plainly: AI and LLM inference run on EU-sovereign infrastructure, so you get the intelligence without sending your data to a foreign cloud. Both inference and embedding happen in-region, on infrastructure we operate ourselves, so the prompt, the retrieved context, and the vectors never leave the jurisdiction you chose. Combined with region-locked tenancy and EU-held keys, the AI feature sits inside your residency perimeter instead of punching a hole in it.

It's also why Counsel is designed the way it is: it answers from your own documents, grounded and cited, on sovereign infrastructure, and, as we cover elsewhere, keeps you off any single foreign model. For the strictest needs, the Soveryne tier provides dedicated GPUs for AI inference in your own environment. Same principle, all the way down: if the data has to stay home, so does the model that reads it.

FAQ

Is sending a prompt to an AI model a data transfer? Yes. If the prompt or the context retrieved to answer it contains personal or confidential data, calling an external model transfers that data to wherever the model runs, governed by that provider's jurisdiction, and subject to its retention and legal process.

Are embeddings personal data? They can be. Research shows text embeddings can be inverted to recover the source: around 92% of short texts exactly, including personal details like names. An embedding is a recoverable fingerprint of the text, not an anonymised token.

Why does AI inference need to run in-region? Because the prompt and the embedding are the data. Region-locking your database but running inference elsewhere still sends the sensitive content across the border. Sovereign AI requires regional inference and embedding.

Doesn't regional inference cost more? Yes, you duplicate inference capacity per region rather than pooling it globally. That's the honest trade-off. But it's the only way to keep the data in jurisdiction, because the prompt is the data.

---

If the data has to stay home, so does the model that reads it. See EU-sovereign inference that keeps your prompts and embeddings in jurisdiction: explore the Soveryne Cloud Foundation and Counsel.

Sources

• Morris et al., Text Embeddings Reveal (Almost) As Much As Text, EMNLP 2023: https://aclanthology.org/2023.emnlp-main.765/
• Jack Morris, "Do text embeddings perfectly encode text?", The Gradient (2024): https://thegradient.pub/text-embedding-inversion/
• Zhang, Morris, Shmatikov, Universal Zero-shot Embedding Inversion (2025): https://arxiv.org/abs/2504.00147
• EDPB, Opinion 28/2024 on AI models and personal data: https://www.edpb.europa.eu/system/files/2024-12/edpb_opinion_202428_ai-models_en.pdf
• OpenAI, "Fighting the New York Times' invasion of user privacy" (2025): https://openai.com/index/fighting-nyt-user-privacy-invasion/
• Bloomberg Law, OpenAI ordered to turn over 20M ChatGPT logs (2025): https://news.bloomberglaw.com/ip-law/openai-must-turn-over-20-million-chatgpt-logs-judge-affirms
• OpenAI, Enterprise privacy (retention terms): https://openai.com/enterprise-privacy/