A cloud AI assistant works by sending your text to a server you do not own. The contract calls it processing. Physically, it is a copy. The copy sits in a database, in a log, in a training queue or in a backup, under the vendor’s rules, and those rules change. Three incidents show where the copy went.
January 2026: 300 million messages, one open database
Chat & Ask AI is a consumer chatbot app built by Codeway, with more than 50 million installs. In January 2026 a security researcher found its backend database publicly readable. Malwarebytes reported that roughly 300 million messages tied to about 25 million users were exposed. The cause was not an exploit. It was a Google Firebase project whose security rules were set to public, which Malwarebytes calls “a well-known and documented Firebase misconfiguration”.
Nobody attacked anything. A configuration checkbox on a cloud service made every conversation readable to anyone with the project URL. The users had no way to know, and no way to check.
February 2026: a prompt that leaks the conversation
Check Point Research found a flaw in ChatGPT that OpenAI patched on 20 February 2026. The Hacker News summarised it in one sentence: “A single malicious prompt could turn an otherwise ordinary conversation into a covert exfiltration channel, leaking user messages, uploaded files, and other sensitive content.” The same report covered a Codex vulnerability that exposed GitHub access tokens through a branch name.
Both were fixed. That is the point. A cloud assistant is patched on the vendor’s schedule, and between discovery and patch your uploaded files are the payload.
May 2023: the source code that went to the chatbot
Samsung Electronics banned ChatGPT and similar tools on company devices in May 2023, after employees in its semiconductor division pasted source code and meeting recordings into the assistant to debug and summarise. The Register reported the internal memo, which Bloomberg had confirmed as authentic: staff were told of “growing concerns about security risks presented by generative AI”.
The employees did nothing unusual. They used the tool the way it is designed to be used. The tool is designed to send the text away.
What this means for a regulated Romanian buyer
- A bank’s contract draft, a hospital’s discharge letter and a law firm’s case file are all “text” to the assistant. The assistant does not know which of them is special-category data under GDPR Article 9.
- The contract you signed with the vendor governs the copy. The vendor’s subcontractors, regions and retention windows govern where the copy physically is. You document the first. You cannot inspect the second.
- No law forces you to keep AI on-premise. GDPR Article 28 lets you use a processor. The question a data protection officer asks is not “is it allowed” but “can I show where it went”. For a cloud assistant the honest answer is a diagram of someone else’s infrastructure.
With Bastion
What Bastion changes
Bastion is a sealed appliance in your building with no outbound internet connection. A prompt travels from a desk to a server room and back. There is no copy outside the network, so there is no Firebase rule to get wrong, no vendor patch window and no third-country transfer to justify.
The limit, stated first: a sealed box protects against data leaving. It does not protect against a user pasting the wrong file into it, and it does not make a model’s answers correct. Your access policy still does that work.
On the record
- 1
- 2
- 3