Keep primary data under client control
Business records, documents, analytics, images, operating history, and sensitive context can remain on approved client infrastructure. External transfer becomes an explicit decision, not the default architecture.