For what I'd call "stupid" compliance (GDPR,...), allowing for regional storage of data at rest is definitely important. For any internal data where protecting

For what I'd call "stupid" compliance (GDPR,...), allowing for regional storage of data at rest is definitely important. For any internal data where protecting it is a core interest of the company you'll also either need to prove your whole handling is trustworthy or you'll need to design a process that can do all the steps (preprocessing/vectorization/...) on customer controlled hardware. If your solution can run in a customer owned environment without any external dependencies, that could save you a lot of auditing/certification.