Module 16 Lesson 5: Data encryption and residency in the cloud

For governments and regulated industries (Bank, Healthcare), it's not just about "Security"—it's about Geography.

1. What is Data Residency?

Some laws (like GDPR) or defense contracts require that data Never leaves the country.

• The Problem: Many AI models are only available in a few regions (e.g., us-east-1).
• The Conflict: If a German hospital sends patient data to a model in the US, they are violating the law, even if the connection is encrypted.

---

2. Using "Local" Endpoints

Azure and AWS allow you to deploy models in Specific Regions.

• If you are in the EU, you must use West Europe or France Central.
• You must also ensure that the Logs and Vector DB associated with the AI are also located in the same region.

---

3. Encryption: CMK vs. PMK

• PMK (Provider Managed Keys): The cloud provider (Microsoft/Amazon) manages the key. They technically could read your data if they were forced to by a government.
• CMK (Customer Managed Keys): You own the key in your own "Hardware Security Module" (HSM). The cloud provider's AI service must "Ask you" for permission every time it needs to decrypt a prompt or a model file.
• Result: If the cloud provider is hacked or subpoenaed, they cannot give away your data because they don't have the key.

---

4. Double Encryption

For the highest security:

1. Transport: TLS 1.3 (Encryption in motion).
2. Storage: AES-256 (Encryption at rest).
3. In-Use: Confidential Computing. (Special CPU/GPU hardware like NVIDIA H100 with TEE that encrypts the data even while it's being "thought about" by the AI).

---

Exercise: The Sovereignty Officer

1. Why is "Confidential Computing" the future of AI privacy?
2. A company in Canada wants to use Llama 3 but the model is only hosted in the US. What are their options? (Hint: Think about "Self-hosting").
3. What is the difference between "Data Residency" and "Data Sovereignty"?
4. Research: What is "Azure Confidential Computing" and how does it support AI workloads?

---

Summary

You have completed Module 16: Cloud AI Infrastructure Security. You now understand how to secure the APIs, manage identities without keys, isolate networks, control costs, and ensure your data stays where it's legally allowed to be.

Next Module: The LLM Framework: Module 17: Securing LLM Frameworks (LangChain, LlamaIndex).