Containers, are they safe?

where is the data stored for collections and is it safe there? what with new GDPR rules?