An automation or AI agent can be hosted on your company’s servers or cloud, or on the provider’s infrastructure, and both options are valid. The choice depends on your security policy, your technical team’s capacity and your compliance obligations. What matters is deciding at the outset and documenting where data is processed and who monitors it.
What hosting an automation means
Hosting an automation means deciding which servers it runs on: where the workflows, AI agents, databases and activity logs live. There are two broad options.
- On your infrastructure. The solution is installed on your company’s servers or in your cloud. Your data and systems stay in-house, under your rules.
- On the provider’s infrastructure. The provider hosts, operates and monitors the solution. Your company simply uses it, without worrying about servers or technical operations.
There is no single right answer for every company. There is a right answer for each security policy.
Nor does it have to be the same for every process. A company may host the agent that handles customer data on its own servers and leave an internal reporting automation on the provider’s infrastructure. What matters is that each decision is deliberate and documented.
Which criteria to weigh up
These are the questions that usually settle the choice:
- What does your security policy say? Some companies require certain data never to leave their systems.
- Do you have an in-house technical team? Hosting in-house means someone has to manage servers, updates and backups.
- What compliance obligations do you have? Sector rules, audits or customer contracts may point the way.
- Who will monitor the solution? An automation needs continuous supervision: someone has to know when it fails.
- Which systems does it integrate with? If they sit on your network, hosting close to them simplifies the connection.
The benefits and risks of each option
| Criterion | On your infrastructure | On the provider’s |
|---|---|---|
| Control of data | Full, under your rules | Subject to the provider’s contract and safeguards |
| Technical management | Done by your team or delegated | Done by the provider |
| Monitoring and backups | Must be organised | Part of the provider’s operation |
| Integration with internal systems | More direct | Requires secure connections |
| Time to go live | Depends on internal timelines | Usually faster |
| Compliance | Under your direct control | Must be verified in the contract |
On your infrastructure, the benefit is control. The risk is that technical operations fall on a team that is already stretched.
On the provider’s, the benefit is convenience: you simply use the solution. The risk is depending on a third party, which is reduced with a clear contract, security safeguards and documentation.
What about data and the GDPR
The GDPR does not require a particular option. It requires knowing where personal data is processed, with what safeguards and under which contract. In practice, it is advisable to:
- Process only the data each process needs.
- Know which country and data centre it is processed in, preferably within the European Union.
- Sign a data processing agreement whenever the provider accesses personal data.
- Use AI models that do not train on your data.
Our article on AI and GDPR covers these points in more depth. This information is general and does not replace legal advice.
What to ask the provider if it hosts the solution
If you choose the provider’s infrastructure, these questions will help you weigh up its safeguards:
- Which country and data centre will the solution be hosted in?
- Who has access to the systems and data, and how is that access logged?
- How often are backups taken, and how long does a restore take?
- How is the solution monitored, and how quickly are incidents handled?
- Which contract governs the processing of personal data?
- How would the solution be moved to your infrastructure if you decided to one day?
A serious provider answers every one of them in writing. If an answer is vague, that is a sign to ask for more detail before deciding.
What should not depend on the option you choose
Some things must be the same either way:
- Monitoring. The system raises an alert when something fails, wherever it runs.
- Traceability. Every automated action is logged.
- Documentation. Architecture, access and procedures, in writing.
- Least privilege. Each component accesses only what it needs.
With those four in place, the hosting choice becomes a matter of policy and convenience, not of basic security.
You can switch later
A company that starts on the provider’s infrastructure may want to move the solution in-house as its technical team grows. Or the other way round. That is possible if the solution has been built on standard technologies and properly documented. Planning for it at the design stage means a move does not require rebuilding the system.
How we decide with each company
At Neji we adapt to each company’s technology and security policy: we install the solution on your servers or in your cloud, or we host, operate and monitor it on our infrastructure. The decision is made during the specifications phase, with your IT team if you have one, and recorded in writing. You can see how we protect data on our security page and how it fits the whole project in our method.
If you would like to weigh up which option suits your company, let us start with a first conversation to get to know your company and see where we can help.