In enterprise AI, the model is the engine, but your data is the fuel, the asset, and the liability. Most vendors will hand you an NDA and a page of privacy terms and call that security. It isn’t. A signed promise is a legal remedy you use after your data has already leaked. It is not a control that stops the leak from happening. If you don’t know exactly who is allowed to look at your visual data, and on what machine, you don’t have a secure computer vision pipeline, no matter what the contract says.
If you’ve shipped a computer vision project, you probably already suspect the uncomfortable part. Somewhere between signing the vendor’s NDA and getting your trained model back, your data was seen by people you never met, on machines you never inspected, in places the contract never named. You were told it was handled under “enterprise-grade security”. You had no way to check, and you signed anyway, because everyone does.
That gap between the promise and the proof is where the real risk lives. And the people who know this industry from the inside know that the privacy clause is often the thinnest part of the whole arrangement.
A promise is not a control
Here is the distinction most buyers miss until it costs them. There are two ways a vendor can protect your data. One is a promise: an NDA, a privacy policy, a line in the master services agreement that says your data won’t be misused. This is enforceable in court, which sounds reassuring until you realize what it actually means. A contract gives you the right to sue someone after your defect images, your facility layouts, or your customer footage have already left the building. It does nothing to stop a contractor from pointing a phone at a screen. It is a remedy, not a barrier.
The other is a control: an architecture where the leak is physically hard or impossible in the first place. Locked-down devices. Data that never copies to a machine you don’t own. Access that is logged and provable. Controls don’t ask you to trust anyone. They remove the need to.
Almost every vendor sells you the first and calls it the second. The reason this matters is not theoretical.
The failures were never hacks
In 2019, Belgian broadcaster VRT NWS obtained more than a thousand audio clips recorded by Google Assistant. Some captured home addresses. One captured a woman in clear distress. That same year, Bloomberg and The Guardian confirmed the same practice at Amazon and Apple: contractors, many of them overseas, sitting with headphones on, reviewing medical conversations and private moments as part of human review to improve the assistants. Nobody broke in. The data went exactly where the pipeline was designed to send it. That was the whole problem.
Visual data is worse, because there is more of it and it is more identifying. In April 2023, a Reuters investigation, based on interviews with nine former employees, reported that staff on Tesla’s data-labeling teams had, between 2019 and 2022, privately circulated invasive images captured by customer cars, including footage from inside people’s garages. One former employee’s words are hard to forget: “We could see inside people’s garages and their private properties.”
Note the detail most people get backwards. Those were Tesla’s own in-house employees, not an outsourced warehouse. The lesson is not “outsourcing is evil.” The lesson is sharper and more useful: unmonitored human access to visual data will leak, whether that human sits in a subcontractor’s building or your vendor’s own office, unless the pipeline is built so that misuse is hard and every access is logged. A privacy policy would not have stopped any of it. Only architecture does.
This is now the main event, not a footnote
That data handling, not model cleverness, increasingly decides whether an AI project survives is now mainstream: Gartner expects organizations to abandon 60% of AI projects unsupported by AI-ready data through 2026 (Gartner, February 2025). But the sharper risk isn’t whether your project succeeds. It’s whether your data leaks on the way there.
The breach surface has moved to exactly the place your privacy clause covers weakest: the outside hands your data passes through. Verizon’s 2026 Data Breach Investigations Report found that 48% of breaches involved a third party, a 60% year-over-year jump from 30% in 2025. Your vendor’s subcontractors and tools are now the attack surface.
And it is already happening inside the labeling industry itself. In 2025, a leading data-labeling vendor was found to have left confidential client project files, along with personal data on its own contractors, in publicly accessible documents. No attacker was involved. The data was simply stored where anyone could reach it, which is exactly the point: most leaks are not clever.
The three layers your contract can’t watch
In computer vision specifically, your data is exposed in three places. A privacy policy names all three and protects none of them.
The human layer. Someone has to look at your images to label them. That person sees your factory floor, your warehouse, your infrastructure. The only real defense is whether their access is controlled and logged, not whether they signed something.
The tool layer. Most vendors don’t build their own labeling and data-management software. They rent it. Off-the-shelf annotation SaaS, third-party cloud storage, external project tools. Every integration copies and caches your data on servers you can’t see. If their SaaS provider is breached, so are you, and you’ll likely be the last to find out.
The infrastructure layer. Even a vendor who never subcontracts a single person usually runs on borrowed infrastructure. The most common enterprise IP leak isn’t a clever attack. It’s a storage bucket left open to the public internet. Your data doesn’t have to be stolen to be exposed. It just has to sit somewhere nobody’s watching.
Why it keeps happening
Because the economics push the wrong way. Roughly 84.6% of the data-labeling solution and services market was outsourced in 2024 (Grand View Research estimate, a market-research figure rather than audited data). When labeling is a low-margin, high-volume commodity, security is the cost that eats the margin. So it’s the first thing quietly cut, right after the contract is signed.
Regulators have stopped treating this as a technicality, and the fines are no longer one-offs. In 2024 the Dutch data-protection authority fined Clearview AI €30.5 million for building a facial-recognition database of more than 30 billion scraped images from biometric data it had no lawful basis to process. The same year, Texas reached a $1.4 billion settlement with Meta over facial-recognition data captured from users’ photos without consent, and Italy’s regulator fined OpenAI €15 million over how personal data was used to train ChatGPT. Under the EU’s General Data Protection Regulation and the incoming EU AI Act, the company that builds an AI system carries direct, provable obligations for how its training data was collected and handled. The paperwork trail now has to be real.
Building a computer vision pipeline actually stop data leaks
At Obraz we build computer vision models for enterprises that can’t afford “good enough” security, in manufacturing, energy, logistics, and government. Our position is simple: your data should never leave a pipeline you control, and that claim is worthless unless you can check it. So we built the checks in.
Every annotator’s device is locked down by our own internal tooling. Files can’t be copied, moved to external storage, or exported off the machine. This isn’t a policy we ask people to follow. It’s enforced by the software they work in.
Our phone-use policy exists for one specific reason. A camera pointed at a screen is the one leak no firewall catches. So we design that possibility out of the room rather than promise it away in a clause.
Zero subcontracting-Fully In-house. Every stage, collection, annotation, training, validation, is done in-house by our own vetted team. Your data is never routed to a third-party warehouse, onshore or offshore.
Our own tooling, not rented SaaS. We built our annotation and data-management platforms ourselves, so your data isn’t cached on someone else’s public cloud as a side effect of the tools we happen to use.
Self-hosted infrastructure, end to end. From storage down to our internal project management and HR systems, our stack is self-hosted and closed-loop. No third-party APIs, no external plugins, no fourth parties you never agreed to.
None of this asks you to trust a promise. That’s the point. You can ask us to show you the device controls, the access logs, and the sub-processor list, and there’s something real behind each one.
Your intellectual property isn’t a commodity to route to the lowest bidder. It’s a classified asset. If you already know this industry, you already know why that distinction matters.
P.S. Are you building a computer vision model on data you can’t afford to expose? Ask us to walk you through the workflow. The difference is that we can actually show you.
Sources: Verizon 2026 Data Breach Investigations Report; Gartner, “Lack of AI-Ready Data Puts AI Projects at Risk,” Feb 2025; Grand View Research, Data Labeling Solution and Services Market Report (market estimate); Business Insider / TechRepublic (2025) on a data-labeling vendor’s publicly exposed documents; Reuters, “Tesla workers shared sensitive images recorded by customer cars,” Apr 2023; Bloomberg (Apr 2019), The Guardian (Jul 2019), VRT NWS (Jul 2019) on smart-speaker audio review; Autoriteit Persoonsgegevens (Dutch DPA), Clearview AI decision, 2024; Office of the Texas Attorney General, Meta biometric settlement, Jul 2024; Garante per la protezione dei dati personali (Italy), OpenAI fine, Dec 2024.