The feature flag evaluation is done on the client-side in the ConfigCat SDK. So if you are using the SDK, you can be sure that your data will never leave your system. See ConfigCat's architecture explained here: https://configcat.com/architecture/.