Data validation always goes in the model. Check the Rails docs for validating length.