What is data custody in AI?

Data custody in AI is the question of who physically holds your data at each moment, and what they are able to do with it while they hold it. It is different from ownership: you can own a document on paper and still have handed a copy to three other organisations the moment you pasted it into a tool.

The word comes from finance and from evidence handling. A custodian bank holds assets on behalf of the owner. A chain of custody in a court case records every hand that touched an exhibit. In both cases the point is the same. Ownership is a legal claim. Custody is a practical fact about where the thing is and who can reach it.

Why custody matters more with AI tools

Ordinary software mostly stores what you type into it. AI tools go further, because useful answers need context. To answer a question about a contract, the tool needs the contract. To help with your code, it needs the code. To summarise a meeting, it needs the audio or the transcript.

That means a working day with AI tools can move far more material, far more often, than a working day without them. Much of that movement is invisible. A single question can carry attached files, earlier conversation, search results and tool outputs along with it. The guide on what gets sent to an AI provider walks through that in detail.

Custody is the discipline of making that movement visible and deliberate.

Ownership, custody, access and control

These four words are often used as if they were one. They are not.

Term	The question it answers
Ownership	Who has the legal right to the data?
Custody	Whose machines is the data sitting on right now?
Access	Who can read it, including staff, contractors and automated systems?
Control	Who decides whether it is kept, changed, shared or deleted?

A contract can say you own your data while another party has custody, broad access and most of the practical control. That is not necessarily a problem. It is how most hosted software works. It becomes a problem when nobody in the organisation can say which arrangement applies to which tool.

The places data can sit

For any AI tool, it helps to list the places your data might rest or pass through:

Your own device. Files, notes, local caches, saved sign-ins.
The tool vendor's servers. The company that makes the application you use. Some applications have no server of their own for your content; many do.
The AI model provider. Often a different company from the tool vendor. The prompt travels here to be answered.
Sub-processors. Hosting, logging, analytics and support services used by either of the above.
Logs and backups. Copies made for reliability or debugging, which may have their own retention periods.

Each hop is a change of custody. The fewer hops, and the better each is understood, the easier the arrangement is to defend.

What good custody looks like

Good custody does not mean "nothing ever leaves the building". Most strong AI models run in someone else's data centre, and using them means sending them a prompt. Good custody means these things are true:

You can say, for each tool, what leaves your device and where it goes.
Only what is needed for the task is sent. Context is chosen, not swept up.
Sign-ins and keys are stored in a proper secret store, and you know who holds them. See where your AI keys and logins should live.
Retention is known: how long each party keeps prompts, outputs and logs. Check the provider's current terms, because these vary by plan and change over time.
You know whether your content may be used to train or improve models, and how that setting is controlled.
You can export your data in a usable format and have it deleted when you leave.
Actions with consequences, such as sending an email or merging code, are approved by a person and recorded.

Custody of answers, not only inputs

Custody is usually discussed as a question about inputs. It applies to outputs too. When an AI system tells you something, you should be able to ask where that came from. If the answer is built on records, each record should carry its origin: who published it, when it was fetched, and proof that it has not changed since.

This is sometimes called provenance, and it is the same chain-of-custody idea applied to facts. The guide on data provenance covers it.

Common misunderstandings

"It is encrypted, so custody does not matter." Encryption in transit protects data on the wire. Encryption at rest protects disks. In both cases the service that processes your prompt has to read it in order to answer it. Encryption is necessary. It does not change who the custodian is.

"We own it under the contract, so we are fine." Ownership clauses do not tell you where copies sit, who can read them, or how long logs last. Read the data processing terms, not only the ownership clause.

"Local means safe." Data on a laptop is in your custody, which also makes it your responsibility. Disk encryption, backups and device management still matter. The guide on local-first AI covers these trade-offs.

"Custody is an IT problem." The person pasting a customer list into a chat window is making a custody decision. Simple, clear rules for staff do more than a policy nobody reads.

A short exercise

Pick the three AI tools your team uses most. For each, write one line under each heading: what leaves the device, who receives it, how long they keep it, who holds the sign-in, how you get data out. If you cannot fill in a line, that is your next question for the vendor. The list of twelve questions to ask an AI vendor can help.

This is general information, not legal advice. If you handle regulated or personal data, check your obligations with your own adviser.

Where Prism fits

Prism Desktop is built around this idea. Each agent signs in with the owner's own AI account, Prism never holds that login, keys stay in the computer's keychain, and only the prompt goes to the AI provider the person chose. Agents propose; a person approves, and decisions are recorded. You can read more on the security page.