⏱ 5 min read
When information cannot leave an organization, or can only leave under conditions someone signed, text transformation techniques stop being the answer. Two paths remain: processing on your own infrastructure, or processing under a contract that establishes enforceable obligations.
The two previous articles in this series described a four-layer framework for working with artificial intelligence and sensitive information, and examined the second of them in detail: substituting identifiers.
That examination concluded that substitution genuinely reduces exposure but does not produce an anonymous document, and that its margin of error is measurable. For routine work with moderately sensitive information, it suffices. For everything else, two layers operate differently: processing on your own infrastructure, or processing under conditions a third party signed and answers for.
This article covers those two.
Why they differ in nature
The minimization and substitution layers share one characteristic: information leaves the organization. What makes them protective is how well it was transformed before leaving. That is a reasonable bet with a known margin of error.
The layers of in-house processing and contracted processing change the premise. In the first, information does not leave. In the second, it leaves, but under enforceable obligations and with an identified responsible party.
That difference matters especially when the obligation is contractual rather than legal. A contract prohibiting the sharing of documentation with third parties, drawing no distinction between channels, is not satisfied by transforming the document. What was sent, was sent. It is satisfied only if processing occurs within the perimeter or under an agreement the counterparty accepted.
Your own model: what it solves and what it does not
Running a language model on your own infrastructure is considerably more accessible today than two years ago. Tools exist that install and run open models with minimal configuration, and a mid-range server suffices for medium-sized models.
It is worth being precise about what is gained and what is given up.
**What is gained.** Information never leaves the organization’s network. No external provider, no terms to review, no international transfer to document. For strict contractual obligations, this is the only thing that fully satisfies them.
**What is given up.** A medium-sized open model does not match a frontier model in complex reasoning. The difference shows immediately in tasks requiring multiple hypotheses, extended context, or detection of subtle contradictions. And inference without hardware acceleration is slow: tolerable for occasional queries, impractical at volume.
**What must be assumed.** Maintenance falls to you. Updates, backups, server security, and responsibility for the service being available when needed.
Hence the correct framing is not implementing an in-house model for everything, but identifying the tasks where it performs. Field extraction from documents, classification by type, duplicate detection, name normalization, first-pass summarization at high volume: performance is sufficient for all of these, and no information leaves the perimeter.
There is also a use that tends to be overlooked and that resolves a circular problem. Identifier detection for the substitution layer can run locally. That way the raw document never leaves, and what is sent outward is already the transformed version. Sending the complete document to an external service so that it can identify what is sensitive exposes precisely what was meant to be protected.
Contracted processing: here the protection is legal
Artificial intelligence providers offer arrangements in which information is not used for training and is not retained beyond processing. It is also possible to run models within the cloud infrastructure the organization already controls, so data does not transit third-party systems beyond those already in use.
The central point of this layer is that what protects is not the architecture. It is what was signed.
A provider may have excellent security practices and still reserve the right to use information to improve its services. Another may have more modest infrastructure but precise contractual obligations. For compliance purposes, the second protects more.
What to review before signing
Seven points worth verifying expressly rather than assuming:
**Use for training.** Whether information is used to train or fine-tune models. Check whether the answer differs between the free plan, the paid individual plan and the enterprise plan, because it frequently does.
**Retention period.** How long information is kept after processing, and whether a zero-retention mode exists. Distinguish operational retention from abuse-review retention, which usually carry different terms.
**Processing location.** Which jurisdiction it occurs in. This determines which international transfer regime applies and which authority would have jurisdiction.
**Subprocessors.** Whether the provider may delegate processing to third parties, under what conditions, and whether notice is required. A subprocessor chain without visibility makes the commitment unauditable.
**Government access.** Under what circumstances the provider would disclose information to an authority, and whether it is obligated to notify its client when that occurs.
**Termination.** What happens to information when the relationship ends. Deletion timeline, whether certification of deletion is provided, and in what format anything returnable is returned.
**Audit.** Whether the organization has the right to verify compliance with the above, or depends exclusively on certifications the provider obtains for itself.
The Mexican element
A provider processing personal data on an organization’s behalf acquires the status of processor under Mexican law, with specific obligations flowing from that condition.
The law in force since March 2025 broadened the notion of controller to any natural or legal person carrying out processing of personal data, without requiring that they make decisions about such processing. The universe of obligated parties widened and expressly incorporates processors.
When processing occurs outside national territory, the transfer regime must also be reviewed. This is not a formality: it determines whether the processing is lawful.
And it bears remembering that these obligations coexist with contractual ones rather than replacing them. Complying with data protection law does not excuse breaching a confidentiality clause covering information that is not personal data.
How they combine in practice
No organization operates on a single layer. The usual combination distributes work by type of information and task:
What admits abstract formulation is resolved without sending the document. Routine work of moderate sensitivity is processed with identifiers substituted. Repetitive volume not requiring deep reasoning runs on in-house infrastructure. And analysis requiring full capability over complete content is processed under verified contractual conditions.
Deciding what belongs in each layer is not a technical decision. It rests on a prior classification of information that must account both for what the law requires protecting and for what the organization committed not to disclose.
That classification is the work no tool does on its own, and the work worth doing before choosing any of them.