What it shows
When an employee opens an AI tool (ChatGPT, Claude, Cursor, etc.), an arc animates onto the globe within ~3 seconds. The arc starts at the employee's country and ends at the country where the vendor stores user data, for ChatGPT free, that's the United States.
The page lives at /dashboards/data-sovereignty in your Aona dashboard. It includes:
- 3D globe with animated arcs (toggle to a 2D map for printing).
- Live feed: "ChatGPT, 8 seconds ago, US → AU [Verified]".
- Per-tool table: which AI tools your employees use, where each one's data goes, and how confident we are.
Honest framing
This is "where the vendor stores employee data, by their stated residency." It is not a real-time network packet path. Each arc carries a confidence label so you're never misled about how we know.
End-to-end data flow
Five steps, from your employee's browser to the arc on the globe:
- 1
Browser plugin detects the AI tool
The Aona browser plugin recognizes the domain (chatgpt.com, claude.ai, etc.) and sends a visit event to api.aona.ai.
- 2
API extracts the source IP
Our API reads the request's source IP from standard HTTP headers. The IP is stored in the visit row for 30 days then nulled.
- 3
Country resolved offline
We look up the IP against an offline binary database (GeoLite2-Country) sitting on our own server. No external API call.
- 4
Visit row inserted
The visit, including client_country, is written to your business's analytics_visits table in our database.
- 5
Dashboard receives realtime event
Your dashboard subscribes to new rows for your business via Supabase Realtime. The new arc animates onto the globe.
The destination country (e.g. US for ChatGPT) comes from the platform record, pre-populated by our autonomous crawler that reads each vendor's public trust/security/privacy pages. See How we know the destination.
What we collect from your employees
For every visit your plugin reports, we record these fields:
| Field | What it is | Retention |
|---|---|---|
user_id | Your tenant's user ID (UUID we issued). | Indefinite |
business_id | Your tenant ID. | Indefinite |
platform_id | Which AI tool was opened. | Indefinite |
client_ip | Source IP of the request (from HTTP headers). | 30 days, then NULLed |
client_country | Two-letter country code from offline IP lookup. | Indefinite (anonymous enough for compliance reports) |
created_at | When the visit happened. | Indefinite |
We do not collect: prompt content, conversation transcripts, file uploads, screenshots, browser history beyond the AI tool tab, keystrokes, or any data outside the AI tool itself.
What MaxMind sees (and doesn't)
The country lookup uses GeoLite2-Country, a free offline database from MaxMind. The crucial distinction: it's a binary file, not an API.
✓ At runtime
The lookup happens in our own server's memory against the on-disk file. Zero network calls. Zero customer data sent to MaxMind. Functionally equivalent to using a static CSV file.
⏷ At build time
Once per Aona deploy, our build server downloads the public GeoLite2-Country file from MaxMind. They see our build server's IP and our license key, never anything about you.
This is why GeoLite2 is the standard for security and compliance products. Common alternatives all send every employee's IP to a third-party API:
| Approach | Sends customer IPs to a third party? |
|---|---|
| MaxMind GeoLite2 (offline), what we use | No |
| IPinfo, IPstack (SaaS APIs) | Yes, every visit |
| ipapi.co | Yes, every visit |
| Cloudflare CF-IPCountry header | Yes, Cloudflare proxies all traffic |
For full transparency, MaxMind is listed in our subprocessor disclosure even though no customer data flows to them. We frame it as: "GeoLite2-Country is downloaded weekly to Aona's infrastructure for offline IP-to-country resolution. No customer data is sent to MaxMind."
How we know the destination
The destination of each arc, the country where a vendor stores user data, comes from our autonomous crawler. It reads each vendor's public trust, security, and privacy pages weekly. Every claim we surface comes with a confidence label:
Verified
The crawler found explicit text on the vendor's public trust or security page, mechanically verified that the quote actually appears on that page, and stored the source URL. You can click through to see the source.
Inferred
The vendor doesn't publish residency explicitly, so we fall back to their headquarters country. Reasonable but not authoritative.
Unknown
Not yet crawled, or the vendor publishes no usable signal. Shown in the directory but excluded from confident summaries.
The crawler runs on a 17-day rolling cycle, coverage grows continuously. See the AI Tool Directory to view individual tools' verified residency claims.
Privacy controls
IP retention is finite
The raw IP address (
client_ip) is deleted from our database after 30 days. Only the country code is retained longer-term, anonymous enough for compliance reports.Tenant isolation
Visits are scoped by your
business_idwith Postgres row-level security. Your data is invisible to other Aona customers at the database layer.Optional opt-out
Customers under strict regimes (e.g. German works councils) can disable IP geolocation entirely. Country resolution is skipped, the IP is never written, and arcs default to your business HQ. Ask your account contact to enable
IP_GEOLOCATION_DISABLED.
FAQ
Does Aona ever see the content of my employees' AI prompts?
Not from this feature. The Data Sovereignty Tracker only records that a visit happened, domain, platform, country, time. Prompt content is handled by separate Aona features (Secure / Engage tiers) which are governed by your DPA and explicitly disabled on the Analytics tier.
Why does ChatGPT show the United States, not where I am?
The arc's destination is where the vendor stores YOUR data. ChatGPT routes everything to OpenAI's US infrastructure regardless of where your employee is. That's the whole point of the visualization, it makes data sovereignty risk visible.
Is the country lookup accurate?
GeoLite2-Country is ~99% accurate at the country level for residential and corporate IPs. It's less reliable for users behind enterprise VPNs that exit in different regions, those will show the VPN exit country, which may not match the user's physical location. We display the country we resolved; we don't claim more than that.
What happens if a tool isn't in the directory yet?
Visits to unknown platforms still get logged with the user's country, but no arc appears (we have no destination). Once our crawler reaches that vendor (~17 days for any new tool), arcs start appearing automatically.
Can my employees see this dashboard?
No, the dashboard is admin-only by default. Only users with the appropriate role on your business see the data sovereignty page. End users only see their own per-prompt risk warnings (if you've enabled that feature).
What about subprocessors? ChatGPT uses Stripe, AWS, etc.
The current view shows the primary destination only. We also surface the subprocessors page URL when the vendor publishes one (visible on each tool's detail page in the AI Tool Directory). A future iteration will visualize the full subprocessor chain on the globe.
How quickly does an arc appear after my employee opens a tool?
Typically 1–3 seconds. The plugin sends the visit event immediately; our API enriches and writes to the database; Supabase Realtime pushes to your dashboard. The bottleneck is usually the dashboard render frame, the data path itself is sub-second.
Want to see it on your own data?
Connect Aona to your team in minutes. The Data Sovereignty Tracker lights up automatically, no setup, no extra config.