Data Residency and Privacy
Before uploading, establish where the material goes, how long it stays and whether it can enter training.
Related
Uploading is granting access
Dragging a client's unreleased stems into a browser generator hands the material to a third party. Whether you may do so depends less on file size than on three things lining up: the client contract, the rights in the material, and the service terms. If one is missing, stop first.
Four questions that decide it
| Question | What to ask | Acceptable answer | Evidence to keep |
|---|---|---|---|
| Where does it go | Server region, subprocessors | Matches the contract | Region statement, processing addendum |
| Is it trained on | Opt-in or opt-out by default | Can be disabled in writing | Account screenshot, terms version |
| How long is it kept | Audio, prompts, logs | Defined period and deletion route | Retention clause, deletion confirmation |
| Regional differences | Cross-border transfer, backups | lawful transfer basis | Transfer addendum, backup policy |
Training and retention are the two most often skipped. The first affects rights, the second confidentiality. Neither should rest on a sales claim; both need text you can archive.
A pre-upload checklist
- Does the client contract permit third-party processing
- Does the material contain uncleared samples or voices
- Is the account a business tier with least-privilege access
- Are training, history and autosave switched off
- Do backups or logs survive deletion
- Can access be revoked when a collaborator leaves
- Is there a local or offline alternative
Region is not jurisdiction
A server in one country does not mean that country's law applies; backups may sit elsewhere and support staff may open tickets from a third location. For cross-border work, state separately where processing happens and who can reach it. When material cannot be uploaded, a local model or derived features are safer than betting on a clause. Ask about deletion scope too: primary storage, backups, logs and training copies, and how long each takes to clear.
Listen in the library
All tracks from midicn-lib — inline badge is the license tier (C1 commercial / C2 non-commercial / C3 study only).
Along the same line
Sources
- GDPR 第 28 条（处理者）与标准合同条款（SCC）关于子处理者、保留期与跨境传输的条文。
- 欧盟数据保护机构关于跨境传输与最小化原则的公开指南。
- 录音制作与档案管理惯例，关于未发行素材的访问控制。