Cost data looks harmless, but it describes your estate in detail: which services you run, in which regions, how big they are and how they change. Before you adopt a cost tool, it is reasonable to ask where that information goes.
Questions to ask any vendor
Where is my cost data stored and processed?
Ask for the actual location, not a general reassurance. If you operate in a particular country or region for a reason, the answer should name it.
Do exports and backups stay there too?
Primary storage is only part of the picture. Ask where backups, logs, report exports and any temporary copies are kept.
Where do the AI features run?
If the tool answers questions in plain English, ask where the model runs and whether your data leaves your region to be answered. This is the question people forget.
Who can access my data, and is that recorded?
Ask which of the vendor's staff can see your data, under what circumstances, and whether that access is logged and can be reviewed.
What happens when I leave?
Ask how your data is returned or deleted, and how long that takes.
What to do with the answers
Get answers in writing, and compare them with any rules that apply to your organisation. A clear, specific answer is a good sign. A vague one is worth pressing on.
How OCIFinOps answers
OCIFinOps is deployed in the client's own OCI region, so cost data stays there, and Ask runs on AI hosted in the region.