ChatGPT (OpenAI)
🇺🇸 Council Bluffs · USA · Iowa
US CLOUD ActInteractive data-residency map
Where does your AI data go?
Explore how AI-provider locations and subscription choices can affect where prompts and files are processed. This is an illustrative map, not a live view of your organisation.
Subscription tier
Shadow AI example · consumer accounts
This example contrasts approved enterprise access (faded routes) with consumer accounts (bright routes).
Example · /var/log/ai-egress
--:--:--What's leaking
- PII60%
- SECRET40%
Top leakers
- Marketing20%
- Engineering20%
- Finance20%
- PIISarah Chen· Marketing→ChatGPT (OpenAI)🇺🇸patient_record_4421
- PIIJames Park· Engineering→Claude (Anthropic)🇺🇸customer_PII_export.csv
- PIIPriya Patel· Finance→Gemini (Google)🇺🇸employee_SSN_list.xlsx
- SECRETDavid Kim· Legal→Microsoft Copilot🇺🇸stripe_secret_key
- SECRETEmma Wilson· Product→Mistral🇫🇷AWS root access key
Drag to explore · Illustrative data routes
This is not theoretical
Real AI data-leak incidents your peers have lived through
Each entry links to the original reporting. Use them in your next CISO briefing.
Feb 2026
NewEU AI Act Article 5 prohibitions fully enforceable
Prohibited-AI practices (social scoring, workplace emotion recognition, untargeted facial-image scraping) are live. Penalties run up to 7% of global turnover, the highest ceiling of any digital regulation on the books.
Source: European CommissionJan 2026
NewUK ICO: pasting personal data into AI is a UK GDPR breach
The Information Commissioner publishes enforcement guidance clarifying that inputting personal data into third-party AI tools without a lawful basis is a UK GDPR violation, putting every unmanaged ChatGPT prompt in scope.
Source: ICOAug 2025
EU AI Act GPAI Code of Practice binding
Transparency, copyright, and systemic-risk obligations for general-purpose AI models (ChatGPT, Claude, Gemini, Llama) become binding for providers serving the EU.
Source: European CommissionFeb 2025
Italy, Australia, South Korea, Taiwan, US states ban DeepSeek
Within days of the Wiz disclosure, national regulators and US state governors block DeepSeek on government devices over PRC Data Security Law exposure. The Italian Garante orders a full processing halt.
Source: Al JazeeraJan 2025
Italian Garante orders DeepSeek to suspend processing
Italy's data-protection authority blocks DeepSeek from processing Italian users' data, the first regulator to act on the emerging evidence, citing GDPR transparency and lawful-basis failures.
Source: Garante (IT DPA)Jan 2025
DeepSeek leaks a million chat logs in unsecured database
Wiz researchers find a publicly accessible DeepSeek ClickHouse instance leaking chat history, API keys, and operational metadata, discovered within minutes of probing.
Source: Wiz ResearchAug 2024
EU AI Act enters into force
The world's first horizontal AI law goes live. Article 5 prohibitions took effect Feb 2025, GPAI rules Aug 2025, full enforcement Feb 2026. Up to 7% of global turnover at stake.
Source: European CommissionFeb 2024
Air Canada held liable for chatbot's invented refund
British Columbia tribunal rules Air Canada must honour a refund its customer-support chatbot invented, first major precedent on enterprise liability for AI-generated output.
Source: BBCMay 2023
Samsung engineers paste source code into ChatGPT
Three internal incidents in three weeks: confidential semiconductor code and meeting notes pasted into ChatGPT. Samsung issued a company-wide ban, still the canonical case study cited in every CISO briefing.
Source: The VergeBlock vs govern
Banning ChatGPT doesn't work. Here's why.
Network blocks push staff to personal devices, mobile, and the next 10,000 AI tools you've never heard of. Governance fixes what bans can't.
| Block vs govern | Block AI | Govern AI · Aona |
|---|---|---|
| Policy enforcement | Network blacklist | Inline guardrails on every prompt |
| Personal / mobile devices | Bypassed completely | Browser extension + agent coverage |
| Coverage of new AI tools | Always months behind | 10,000+ tools auto-discovered |
| Productivity impact | High, work moves to shadow channels | Low, safe AI use is encouraged |
| Audit posture | Brittle. No prompt-level evidence. | Evidence-ready logs of every interaction |
Published evidence
The visibility gap in employee AI use.
75%
of knowledge workers surveyed used AI at work
Source: Microsoft + LinkedIn, 202478%
of AI users surveyed brought their own AI tools to work
Source: Microsoft + LinkedIn, 202452%
of AI users surveyed were reluctant to admit using AI for their most important tasks
Source: Microsoft + LinkedIn, 202410,000+
AI tools tracked and classified by Aona
Source: Aona AI tool catalogThe receivers
Where prompts may be processed
Compare representative provider locations. Actual routing depends on provider, plan and configuration. Use the linked policies for your evaluation.
Claude (Anthropic)
🇺🇸 Northern Virginia · USA · AWS us-east-1
US CLOUD ActGemini (Google)
🇺🇸 Mountain View · USA · California
US CLOUD ActMicrosoft Copilot
🇺🇸 San Antonio · USA · Azure
US CLOUD ActMistral
🇫🇷 Paris · France · EU
EU GDPRDeepSeek
🇨🇳 Hangzhou · China
PRC Data Security LawQwen (Alibaba)
🇨🇳 Beijing · China
PRC Data Security LawYandexGPT
🇷🇺 Moscow · Russia
Russia Federal Law 152-FZPerplexity
🇺🇸 San Francisco · USA · California
US CLOUD ActA note on the locations. Countries and jurisdictions reflect each provider's public infrastructure footprint (e.g. OpenAI is hosted on Microsoft Azure US regions; DeepSeek on PRC-based infrastructure; YandexGPT on Russian infrastructure). City-level markers are representative default regions pulled from each provider's own documentation, Azure/AWS/Google Cloud region listings, OpenAI's trust portal, Microsoft's EU Data Boundary docs, Anthropic's trust centre. Actual per-request routing varies by load, tenant region, and Enterprise residency selection, switch the Subscription Tier above the globe to see how Enterprise tiers reroute Western providers into EU regions.
How Aona stops it
See it. Block it. Coach the human.
See every endpoint
Aona inspects egress in real time and maps every AI tool your workforce touches, sanctioned or shadow.
Block the leak
Inline guardrails redact PII, secrets and confidential files before they ever leave the device.
Coach in the moment
Employees get a contextual nudge, not a help desk ticket, the second they try to paste regulated data.
Find out exactly what your team is leaking, in 30 days, free.
Aona's Gen AI Risk Discovery shows you every tool, every prompt and every export. No agents on user devices required to start.