The Data Layer: What You Don't Own Can Testify Against You

In an alarming turn of events, a woman's private diary, written in a third-party AI app, led to her facing a felony charge after the company reported her to law enforcement. This incident serves as a stark reminder of the "data layer" that many overlook. In this series, we have explored various aspects of the tech stack we rent instead of own, from distribution and identity to access and the runtime. Now, we delve into the most crucial layer: data.

The data we entrust to these third-party platforms is far from inert. It fuels models, influences ranking systems, feeds analytics, and becomes a compliance artifact that the platform manages at its own discretion. Your operational data, such as supplier lists, customer conversations, and pricing, resides within a system whose interests are not your own. This raises jurisdictional concerns for businesses operating across borders, as data stored in one region is subject to its laws and disclosure rules.

When you click "accept" on these platforms, you inadvertently expose your data to the jurisdiction of that region. Your supply chain details, vendor information, and even the drafts of your customer replies are all within the reach of the platform that hosts your data. When the time comes to leave, obtaining your data in a usable format and proving its deletion becomes a challenging task, often met with resistance from the platform.

To truly own the data layer, four key properties must be present: exportability, encryptability, self-hostability, and deletability. These properties ensure that you can pull your data out in a usable, machine-readable form, encrypt it with your own keys, run the equivalent function on your own infrastructure, and verify the deletion of your data. While building a data center is not the same as owning the data layer, these four properties are essential for asserting control over your data.

In conclusion, owning the data layer is not about building data centers or renting infrastructure. It is about ensuring that you have four crucial properties to check: exportability, encryptability, self-hostability, and deletability. This layer is where the worst-case scenario is not downtime, but your data being used against you. It is the only layer where the consequences are far more severe than simply losing access to a service.