Seven things people say, and what the documents say back.

These are the answers a security team gives when somebody raises the subject. Most of them are true, and each one answers a different question from the one being asked.

Each one comes with a question to ask instead — of a supplier, or inside your own organisation. All of them can be answered, and a good answer settles it.

• “It's hosted in Europe”It does not matter that the data centre is European. The order follows the company.Ask instead Which company runs those data centres, and who owns that company?
• “We have SCCs and a DPA”Your contract binds your supplier. It does not bind an American court.Ask instead Which part of the agreement covers an order from a court outside Europe?
• “Enterprise tier — they don't train on our data”That is a promise not to learn from it. It is not a promise not to hand it over.Ask instead Does that paragraph say anything about handing data over, or only about training?
• “They're certified under the Data Privacy Framework”It still stands. The American watchdog it leans on has one member left out of five.Ask instead What is your plan for those systems if the EU-US data deal is struck down on appeal?
• “We're on a sovereign cloud with a European operating entity”That genuinely helps. Now ask who holds the keys, and who can walk up to the machines.Ask instead Who holds the keys, and whose staff can walk up to the machines?
• “It's encrypted, in transit and at rest”A model cannot summarise a document it cannot read.Ask instead Is it still scrambled while the model is actually reading it?
• “Nothing sensitive goes in there”It is a claim about people, not about the tool — and it is the one you can check.Ask instead Which record tells you what was actually pasted in last month?