Every AI product is a bucket with holes in it. Most have dozens. We are plugging ours until none are left.

Ask an AI something you would not say out loud. "Is this mole something to worry about?" "Help me write my resignation letter." "Here is our customer list. Who is about to leave?"

Then ask a second question. Who has a copy now?

Not who could read it. Who holds it. For a moment, for a month, for ever.

For most AI products the answer is long, and nobody can give it to you with certainty. Not even the company whose logo is on the app.

An AI product is not a company. It is a stack of companies.

When you press enter, your question does not go to "ChatGPT". It goes into a bucket that OpenAI has assembled from other people's services. OpenAI's own sub-processor list names about two dozen companies and 29 countries where they may handle your data. Microsoft alone is listed for 27 of them. Cloud providers, a data warehouse, analytics, support tooling, GPU landlords on three continents.

And that is only the first layer. Each of those two dozen companies has a sub-processor list of its own, and each entry on those lists has one too. It is not a list. It is a tree, and nobody has drawn the whole of it. If someone did, my guess is that the count would not be two dozen but thousands.

Each of those is a hole. Your question, in clear text, passes through it. Some holes hold a copy for milliseconds. Some for thirty days. Some, by default, for training.

The first hole is the front door

Here is the part most people do not know. The encryption that protects your question on the way ends at the front door, not at the company you think you are talking to.

The padlock in your browser means nobody can read your question in transit. At the other end, somebody has to open it. For chatgpt.com that somebody is Cloudflare. I checked from my desk in Copenhagen: the connection ends at Cloudflare's Copenhagen site. Your conversation is in clear text on Cloudflare's machines, in your own city, before OpenAI has seen a byte of it.

This is not a scandal. Half the web works like this, and Cloudflare is good at its job. But "good at its job" is a promise. A copy of your whole conversation on a third company's server is a fact. And a server that belongs to an American company answers to American law, wherever it stands.

Then the rest of the bucket

After the front door, the question leaves Europe. It lands on a rented GPU somewhere in a fleet nobody will name, gets answered, gets stored, gets copied into a data warehouse, and unless you found the switch, gets used for training. In 2025 a US court ordered every consumer chat kept, deleted ones included, and twenty million of them were later handed to lawyers in a copyright case. That, too, is a copy.

The answer comes back to you. The question stays.

A copy of what, exactly?

The old privacy fight was about ads. You searched for shoes, and you saw shoes for a month. Irritating, and most people shrugged.

What you put into an AI is different in kind. It is what you know. What you are working on. What you are afraid of. The question you would not ask a colleague, and the draft you would not show anyone. A year of that is not data about you. It is a working copy of you.

And a copy of you is useful in a new way. Not to sell you shoes, but to decide what you are told. A system that holds your thoughts can shape its answers to them, and you would be the last to know.

That is why the question of who holds the copy has stopped being a detail in a policy. It is the whole question.

Why it is built like this

Nobody designed this to be creepy. The stack was built when data was the product, so every layer assumes it may keep some. A privacy policy then becomes a list of promises from each layer that it will behave. The more layers, the more promises.

I would rather have fewer promises.

What we are doing: closing holes, one at a time

Rool runs your AI on machines we rent and operate ourselves. The way we keep your data to ourselves is not clever. We remove, one by one, every company that could see it. Our tree branches like everyone else's, so every company we remove takes its whole branch with it.

Here is the status today.

Closed. Until this week, every sign-in to Rool, whichever method you used, went through Google's identity service, and those records sat outside Europe. That is why it was the first thing to go. Sign-in now runs on our own servers, with the records in our own database in Finland. If you choose to sign in with a Google account, Google still learns that, the same as Apple does. Otherwise it no longer sees who logs in.

What a conversation touches today. Our servers in Helsinki, rented from Hetzner, where the front door is ours: the encryption ends on a machine we run, not at a content network. Then our GPUs in Aarhus, rented from ScanNet, where the question is answered in memory and nothing is written to disk. Then back to Helsinki, where it is stored once, on your machine, encrypted with a key that belongs to that machine.

Two landlords, and one company looking at the text: us. Hetzner and ScanNet own racks. Nothing is sent to them as a service, and each machine's storage is encrypted with its own key.

Still open, and we know it. Our account database and the restore points of your machines still live on Google Cloud, in Finland. The restore points are encrypted with a key only we hold, so Google stores them but cannot read them. The database, which holds your account details and usage records, it can read. Both are next, and they go the same way sign-in went. The files of the web app itself are still delivered from Google's network, which may serve them from outside Europe; that is files to you, never your conversation, and it moves with the rest. Email your machine sends and receives goes through Resend, an American company that stores the content in the United States. That is the biggest hole left. When you talk to Rool, the audio goes to Speechmatics, processed on servers in the EU and not used for training. Payments go to Stripe, support mail sits in Google Workspace, and website visits are counted by Matomo without cookies. None of those three sees a conversation.

Behind a switch. Backup models at TensorX in Ireland and Finland for when ours are busy. Image generation in Google's EU region. Web search at Brave and SerpApi in the United States. Page rendering at Jina. Each one is listed with exactly what it receives, and each one is a switch the owner of the machine can turn off.

That is the whole list. It lives at rool.dev/subprocessors, with a changelog. Every time we close a hole, the list gets shorter and the changelog gets a line. We would rather publish the holes than pretend the bucket is sealed.

The rule

The rule we are building towards fits in one sentence. The text of your conversation is seen by one company, and you are that company's only customer.

Not as a policy. As a wiring diagram.

Ask your AI who has a copy of your question. If the answer takes more than a sentence, you have your answer.