Ask Your AI Vendor Where the Data Sleeps

When you hand a vendor student data, that data goes to sleep somewhere — on servers in a specific place, under specific laws, managed by specific people. Most schools have never asked where.

"Where is student data stored, and where are your backups?" is a question every school can ask and every serious vendor can answer. You're listening for specifics: data centers in named regions, not "the cloud." The cloud is not a place; it's someone else's computer, and you deserve to know whose and where.

Why does location matter? Because data is governed by the laws of where it sits. Data stored in another country may be subject to that country's government access rules. Data scattered across subcontractors multiplies every risk you thought you had with one vendor.

Then ask the follow-up: who at your company can access identifiable student data, and how is that access logged? A vendor that can't describe its own access controls doesn't have meaningful ones.

None of this requires technical expertise. It's the same instinct as asking a field-trip company where the buses are maintained. You're not being difficult; you're being responsible for other people's children.

Add the answers to your vendor file, next to the contract. If the vendor won't answer, that silence is also an answer — and it's telling you to keep shopping.

I explain frameworks; I don't give legal counsel.