# The Three Tiers of AI Privacy
Source: https://humanspark.ai/frameworks/three-tiers-of-ai-privacy/

*"Cloud AI" is three different things - match each kind of data to the lowest tier of tool that still protects it.*

**When to use:** When you need to place a kind of data in the right tier of tool - before anything sensitive goes near a chatbot.

1. **Consumer cloud - the public square** - Free or standard web tools: the everyday ChatGPT, Claude, or Gemini. Your inputs may be logged or used to train the model. Treat anything you type here as if you posted it publicly.
2. **Enterprise cloud - the rented office** - A commercial API or business tier with a contract: a DPA plus a no-training, zero-retention term. Where most real business work belongs - if the contract is genuinely in place.
3. **Local - the vault** - Open models on hardware you own. Data never crosses a network boundary - no third party, no cross-border transfer. The safest tier, and the simplest for GDPR.

> **The Tier 1 → 2 jump:** The jump from Tier 1 to Tier 2 - consumer web tool to contracted commercial one - is the difference between a data breach and a compliant workflow. And a contract is the start of compliance, not the finish: for personal data you also need a valid EU-US transfer mechanism, not a DPA alone.

> **Sits beside:** [Where Does It Run?](https://humanspark.ai/frameworks/where-does-it-run/) - the tiers are the data view of venue; that card is the full decision, where the rules run and where the model runs.