the Persona CEO response addresses the AI training concern but totally sidesteps the CLOUD Act issue. doesn't matter where data is stored -- if Persona or any of their US-based subprocessors get a US national security letter, that data is accessible. "deleted within 30 days" also means it exists for up to 30 days, which is plenty of time for a legal demand.